primcli 3.0.0-preview.6 → 3.0.0-preview.7

package/dist/oclif/index.js

@@ -1,14 +1,14 @@
-import { $ as replyExpectation, $t as createCliApiClient, A as bareAddress, At as connectNextSteps, B as wakeReadCommand, Bt as withFlagSuggestion, C as terminalApprovalIo, Ct as sendWaitClampNotice, D as listenForCopyHotkey, Dt as thrownErrorExitCode, E as formatBrowserLoginInstructions, Et as successfulSendOutcome, F as readThreadContext, Ft as currentMailSessionKey, G as clearReadPendingMail, Gt as isEmailId, H as wakeRelationship, Ht as readCallerMailFor, I as sentInThread, It as detectAgentRuntime, J as recordPendingMail, Jt as ATTACHMENT_WAIT_MAX_MS, K as pendingMailPath, Kt as noFactsMessage, L as serverMuted, Lt as detectRuntimeSession, M as displayAddress, Mt as generatedAgentName, N as formatMailWakeLine, Nt as identitySuggestions, O as openBrowser, P as latestOwnOutbound, Pt as loadSkillLine, Q as readEmailInteraction, Qt as createAuthenticatedCliApiClient, R as serverRelationship, Rt as runtimeSessionVariableList, S as promptLine$2, St as sendOutcomeExitCode, T as canOfferCopyHotkey, Tt as serializeErrorPayload, U as claimPendingMail, Ut as classificationFactLines, V as wakeRecipientField, Vt as emptyEmailListHint, W as clearConsumedPendingMail, Wt as classificationOf, X as interactionHumanLine, Xt as ConnectedAgentKeyRequiredError, Y as removePendingMail, Yt as withAttachmentWait, Z as interactionNextActions, _ as writeErrorWithHints, _t as formatSendFailureSummary, a as createOperationCommand, an as RESTRICTED_ROLE_NOTE, at as apiResultHttpStatus, b as STEP_UP_TOKEN_FLAG_DESCRIPTION, bt as reportSendCommandResult, c as formatErrorPayload, cn as isBuiltInRoleKey, ct as buildThrownSendFailureEnvelope, d as isGrantRefusal, dn as roleKeyText, dt as deriveSendIdempotencyKey, en as refreshStoredCliCredentials, et as replyInteractionWarning, f as parameterFlagName, fn as switchCurrentOrg, ft as excludeSignalReplies, g as takesStepUp, gn as operationManifest, gt as formatPriorRepliesWarning, h as surfaceUnauthorizedHint, hn as setKnownCommands, ht as formatPriorRepliesCheckSkipped, i as TIME_FLAG_DESCRIPTION, in as CliOrgRefusedError, it as SEND_OUTCOME_HELP, j as describeWake, k as explainPendingMailNotFound, kt as cliInvocation, l as hasControlCharacter$1, ln as revokeUserLogin, lt as checkPriorReplies, m as runWithTiming, mn as sanitizeForTerminal, mt as formatDeletedEarlierSendNotice, n as API_ERROR_CODES, nn as resolveCliApiRequestConfig, nt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, o as extractErrorCode, on as credentialsFromUserLogin, ot as assertValidIdempotencyKey, p as readTextFileFlag, pn as routeWarningLines, pt as followUpCommandPrefix, q as readPendingMail, qt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, r as OPERATION_PATH_FLAGS, rn as selectedOrgFromEnv, rt as MAX_SEND_WAIT_TIMEOUT_MS, s as extractErrorPayload, sn as fetchCliOrgs, st as buildFollowUpCommand, t as API_BASE_URL_FLAG_DESCRIPTION, tn as refuseOrgSelectionForProfile, u as headerFlagName, un as roleKeyLabel, ut as classifySendError, v as BROWSER_FLAG_DESCRIPTION, vt as formatSendRecordFailureSummary, w as withApproval, wt as sentHistoryWindowStart, x as approveThenRerunHint, xt as sendIdentityFields, y as STEP_UP_HEADER$1, yt as priorRepliesThatWentOut, zt as formatAlreadySentNotice } from "../api-command-CRjIK1QL.js";
-import { $ as parseFromHeader, $n as startAgentClaim, $t as getSendFrom, A as lateMailReread, An as listWakeSchedules, At as downloadEmailAttachmentArchiveMember, B as ensureSearchReportsReplyState, Bn as resendAgentSignupVerification, Bt as getCreditBalance, C as waitOutRetryAfter, Cn as listRepeatingSends, Ct as createWakeSchedule, D as encodeReceivedAtSearchCursor, Dn as listSentEmails, Dt as deleteRoute, E as cursorFromAcceptedRows, En as listSentAttachmentArchiveMembers, Et as deleteMemory, F as AWAITING_VALUES, Ft as getAccessMode, G as queryUsesAwaiting, Gn as searchEmails, Gt as getFunctionTestRunTrace, H as formatRepliesCell, Hn as rotateKey, Ht as getEmail, I as REPLY_STATE_UNSUPPORTED_CODE, In as redeemCreditCode, It as getAccount, Jn as sendEmail, Jt as getMemory, Kn as searchMemories, Kt as getInboxStatus, L as ReplyStateUnsupportedError, Ln as removeDefaultNetworkMember, Lt as getAgentContactPolicy, M as sinceFromFlags, Mn as pullWebhookEvent, N as sleep$3, Nt as downloadSentAttachmentArchiveMember, O as fetchEmailSearchPage, On as listWakeAuthorizations, Ot as deleteWakeAuthorization, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentByFilename, Q as parseWebhookEvent, Qn as simulateRoute, Qt as getRepeatingSend, R as assertAwaitingFilterRows, Rn as reorderRoutes, S as transientFailure, Sn as listOrganizationPeople, St as createWakeAuthorization, T as collectNewAcceptedEmails, Tn as listRoutes, U as hasReplyState, Un as runWakeSchedule, Ut as getFunction, V as formatAwaitingCell, Vn as revokeCredential, Vt as getDefaultNetworkAgent, W as isAwaitingRejectedError, Wt as getFunctionRouting, X as isEmailReceivedEvent, Xn as setFunctionSecret, Xt as getOutboundStatus, Yn as setFunctionRoute, Yt as getOrgRoutingTopology, Zn as setMemory, Zt as getOwnGrant, _ as describeApiFailure, _n as listFunctionLogs, _t as completeWebhookEvent, a as REPEAT_IDLE_MAX_MINUTES, an as listActivityObjects, ar as updateDefaultNetworkMember, at as automatedRejectedError, b as retryTransient, bn as listKeys, bt as createKey, cn as listAgentNetworks, cr as updateRepeatingSend, d as parseRepeatTick, dn as listDefaultNetworkMembers, dr as updateWakeSchedule, dt as addDefaultNetworkMember, en as getSentEmail, er as startAgentSignup, et as AUTOMATED_FILTER_UNSUPPORTED_CODE, f as preparePresenceAliveEmail, fn as listDomains, fr as verifyAgentClaim, ft as cancelSentEmail, g as WaitDeadlineReached, gn as listEndpoints, gt as cliLogout, hn as listEmails, ht as checkSendability, i as REPEAT_EVERY_MAX_MINUTES, in as leaveOrganization, ir as unsetFunctionRoute, it as assertAutomatedVerdict, j as quoteDslValue, jn as pollCliLogin, jt as downloadEmailAttachmentByFilename, k as filtersFromFlags, kn as listWakeDispatches, kt as deleteWakeSchedule, l as parseInteractionEnvelope, lr as updateRoute, lt as hasAutomatedVerdict, m as repeatStopCommand, mn as listEmailRuleResults, mr as whoami, mt as checkDefaultNetworkContactAdmission, nn as getWakeSchedule, nr as stopRepeatFromEmail, nt as AUTOMATED_VALUES, o as REPEAT_MAX_SENDS_MAX, or as updateFunction, p as prepareSignalEmail, pn as listEmailAttachmentArchiveMembers, pr as verifyAgentSignup, pt as cancelSentEmailByIdempotencyKey, qn as semanticSearch, qt as getKey, rr as testFunction, rt as AutomatedFilterUnsupportedError, s as buildRepeatStopBody, sn as listAgentContacts, sr as updateKey, tn as getThread, tr as startCliLogin, tt as AUTOMATED_FLAG_DESCRIPTION, u as parsePresenceEnvelope, un as listDefaultNetworkAgents, ur as updateWakeAuthorization, ut as isAutomatedRejectedError, vn as listFunctions, vt as createEndpoint, w as SINCE_VALUE_HELP, wn as listRoles, x as retryingOperation, xn as listMailboxAccess, xt as createRoute, y as pauseForTransientFailure, yn as listGroups, yt as createFunction, z as awaitingRejectedError, zn as replyToEmail, zt as getConversation } from "../repeats-Dj_o6c-X-CP0h4alF.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-DTyg-sfS.js";
+import { $ as readEmailInteraction, A as explainPendingMailNotFound, At as cliInvocation, Bt as formatAlreadySentNotice, C as promptLine$2, Ct as sendOutcomeExitCode, D as formatBrowserLoginInstructions, Dt as successfulSendOutcome, E as canOfferCopyHotkey, Et as serializeErrorPayload, F as latestOwnOutbound, Ft as loadSkillLine, G as clearConsumedPendingMail, Gt as classificationFactLines, H as wakeRecipientField, Ht as emptyEmailListHint, I as readThreadContext, It as currentMailSessionKey, J as readPendingMail, Jt as noFactsMessage, K as clearReadPendingMail, Kt as classificationOf, L as sentInThread, Lt as detectAgentRuntime, M as describeWake, N as displayAddress, Nt as generatedAgentName, O as listenForCopyHotkey, Ot as thrownErrorExitCode, P as formatMailWakeLine, Pt as identitySuggestions, Q as interactionNextActions, Qt as ConnectedAgentKeyRequiredError, R as serverMuted, Rt as detectRuntimeSession, S as approveThenRerunHint, St as sendIdentityFields, T as withApproval, Tt as sentHistoryWindowStart, U as wakeRelationship, Ut as mailReach, V as wakeReadCommand, Vt as withFlagSuggestion, W as claimPendingMail, Wt as readCallerMailFor, X as removePendingMail, Xt as ATTACHMENT_WAIT_MAX_MS, Y as recordPendingMail, Yt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Z as interactionHumanLine, Zt as withAttachmentWait, _ as takesStepUp, _n as setKnownCommands, _t as formatPriorRepliesWarning, a as createOperationCommand, an as selectedOrgFromEnv, at as SEND_OUTCOME_HELP, b as STEP_UP_HEADER$1, bt as priorRepliesThatWentOut, c as formatErrorPayload, cn as credentialsFromUserLogin, ct as buildFollowUpCommand, d as isGrantRefusal, dn as revokeUserLogin, dt as classifySendError, en as createAuthenticatedCliApiClient, et as replyExpectation, f as parameterFlagName, fn as roleKeyLabel, ft as deriveSendIdempotencyKey, g as surfaceUnauthorizedHint, gn as sanitizeForTerminal, gt as formatPriorRepliesCheckSkipped, h as runWithTiming, hn as routeWarningLines, ht as formatDeletedEarlierSendNotice, i as TIME_FLAG_DESCRIPTION, in as resolveCliApiRequestConfig, it as MAX_SEND_WAIT_TIMEOUT_MS, j as bareAddress, jt as connectNextSteps, k as openBrowser, l as hasControlCharacter$1, ln as fetchCliOrgs, lt as buildThrownSendFailureEnvelope, m as refusalDetails, mn as switchCurrentOrg, mt as followUpCommandPrefix, n as API_ERROR_CODES, nn as refreshStoredCliCredentials, o as extractErrorCode, on as CliOrgRefusedError, ot as apiResultHttpStatus, p as readTextFileFlag, pn as roleKeyText, pt as excludeSignalReplies, q as pendingMailPath, qt as isEmailId, r as OPERATION_PATH_FLAGS, rn as refuseOrgSelectionForProfile, rt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, s as extractErrorPayload, sn as RESTRICTED_ROLE_NOTE, st as assertValidIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createCliApiClient, tt as replyInteractionWarning, u as headerFlagName, un as isBuiltInRoleKey, ut as checkPriorReplies, v as writeErrorWithHints, vn as operationManifest, vt as formatSendFailureSummary, w as terminalApprovalIo, wt as sendWaitClampNotice, x as STEP_UP_TOKEN_FLAG_DESCRIPTION, xt as reportSendCommandResult, y as BROWSER_FLAG_DESCRIPTION, yt as formatSendRecordFailureSummary, z as serverRelationship, zt as runtimeSessionVariableList } from "../api-command-BXYpylbG.js";
+import { $ as parseFromHeader, $n as startAgentClaim, $t as getSendFrom, A as lateMailReread, An as listWakeSchedules, At as downloadEmailAttachmentArchiveMember, B as ensureSearchReportsReplyState, Bn as resendAgentSignupVerification, Bt as getCreditBalance, C as waitOutRetryAfter, Cn as listRepeatingSends, Ct as createWakeSchedule, D as encodeReceivedAtSearchCursor, Dn as listSentEmails, Dt as deleteRoute, E as cursorFromAcceptedRows, En as listSentAttachmentArchiveMembers, Et as deleteMemory, F as AWAITING_VALUES, Ft as getAccessMode, G as queryUsesAwaiting, Gn as searchEmails, Gt as getFunctionTestRunTrace, H as formatRepliesCell, Hn as rotateKey, Ht as getEmail, I as REPLY_STATE_UNSUPPORTED_CODE, In as redeemCreditCode, It as getAccount, Jn as sendEmail, Jt as getMemory, Kn as searchMemories, Kt as getInboxStatus, L as ReplyStateUnsupportedError, Ln as removeDefaultNetworkMember, Lt as getAgentContactPolicy, M as sinceFromFlags, Mn as pullWebhookEvent, N as sleep$3, Nt as downloadSentAttachmentArchiveMember, O as fetchEmailSearchPage, On as listWakeAuthorizations, Ot as deleteWakeAuthorization, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentByFilename, Q as parseWebhookEvent, Qn as simulateRoute, Qt as getRepeatingSend, R as assertAwaitingFilterRows, Rn as reorderRoutes, S as transientFailure, Sn as listOrganizationPeople, St as createWakeAuthorization, T as collectNewAcceptedEmails, Tn as listRoutes, U as hasReplyState, Un as runWakeSchedule, Ut as getFunction, V as formatAwaitingCell, Vn as revokeCredential, Vt as getDefaultNetworkAgent, W as isAwaitingRejectedError, Wt as getFunctionRouting, X as isEmailReceivedEvent, Xn as setFunctionSecret, Xt as getOutboundStatus, Yn as setFunctionRoute, Yt as getOrgRoutingTopology, Zn as setMemory, Zt as getOwnGrant, _ as describeApiFailure, _n as listFunctionLogs, _t as completeWebhookEvent, a as REPEAT_IDLE_MAX_MINUTES, an as listActivityObjects, ar as updateDefaultNetworkMember, at as automatedRejectedError, b as retryTransient, bn as listKeys, bt as createKey, cn as listAgentNetworks, cr as updateRepeatingSend, d as parseRepeatTick, dn as listDefaultNetworkMembers, dr as updateWakeSchedule, dt as addDefaultNetworkMember, en as getSentEmail, er as startAgentSignup, et as AUTOMATED_FILTER_UNSUPPORTED_CODE, f as preparePresenceAliveEmail, fn as listDomains, fr as verifyAgentClaim, ft as cancelSentEmail, g as WaitDeadlineReached, gn as listEndpoints, gt as cliLogout, hn as listEmails, ht as checkSendability, i as REPEAT_EVERY_MAX_MINUTES, in as leaveOrganization, ir as unsetFunctionRoute, it as assertAutomatedVerdict, j as quoteDslValue, jn as pollCliLogin, jt as downloadEmailAttachmentByFilename, k as filtersFromFlags, kn as listWakeDispatches, kt as deleteWakeSchedule, l as parseInteractionEnvelope, lr as updateRoute, lt as hasAutomatedVerdict, m as repeatStopCommand, mn as listEmailRuleResults, mr as whoami, mt as checkDefaultNetworkContactAdmission, nn as getWakeSchedule, nr as stopRepeatFromEmail, nt as AUTOMATED_VALUES, o as REPEAT_MAX_SENDS_MAX, or as updateFunction, p as prepareSignalEmail, pn as listEmailAttachmentArchiveMembers, pr as verifyAgentSignup, pt as cancelSentEmailByIdempotencyKey, qn as semanticSearch, qt as getKey, rr as testFunction, rt as AutomatedFilterUnsupportedError, s as buildRepeatStopBody, sn as listAgentContacts, sr as updateKey, tn as getThread, tr as startCliLogin, tt as AUTOMATED_FLAG_DESCRIPTION, u as parsePresenceEnvelope, un as listDefaultNetworkAgents, ur as updateWakeAuthorization, ut as isAutomatedRejectedError, vn as listFunctions, vt as createEndpoint, w as SINCE_VALUE_HELP, wn as listRoles, x as retryingOperation, xn as listMailboxAccess, xt as createRoute, y as pauseForTransientFailure, yn as listGroups, yt as createFunction, z as awaitingRejectedError, zn as replyToEmail, zt as getConversation } from "../repeats-Dj_o6c-X-C6tOKAqk.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-Bm59oy4j.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-3H-rNH8v.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-CvqdlWuX.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-YQWxPePp.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-GItY2PvL.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CPxRPbHK.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CvEDx8qQ.js";
+import { a as thrownErrorBody, i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-ch756TXV.js";
 import { a as backgroundListenStatus, c as runBackgroundListen, d as stopBackgroundListen, f as verifyBackgroundListenTarget, o as backgroundListenToken, r as backgroundListenConfiguration, u as startBackgroundListen } from "../listen-background-DyBYca28.js";
-import { i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-DWrJMakZ.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
 import { n as createConfig, t as createClient } from "../client.gen-6rZvmHfx.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
@@ -21978,7 +21978,7 @@ const openapiDocument = {
 		"/email-rules/compile": { "post": {
 			"operationId": "compileEmailRule",
 			"summary": "Compile a rule description",
-			"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default), so a warning can say when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22375,7 +22375,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "listEmailRules",
 				"summary": "List rules",
-				"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule). With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule) and current_version, but not the version's text: read that under current from GET /email-rules/{id}. With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [
@@ -22498,7 +22498,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEmailRule",
 				"summary": "Read a rule",
-				"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. The current version's text (english, tree, explanation, assumptions, warnings) is under current, and current_version is its number. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22613,7 +22613,7 @@ const openapiDocument = {
 			"patch": {
 				"operationId": "updateEmailRule",
 				"summary": "Change a rule",
-				"description": "Renames the rule, saves a new version (english and tree together, with an explanation or one the server writes; earlier versions stay), changes its state (draft is off; observe; active), whose mail it runs over (evaluation_scope, with scope_selection when selected) or its saved expectations (each saved version and new set is judged in expectations_check). Anyone but its author who sees it may only disable it (state draft), and while it is shared only if they manage members from the dashboard. Without evaluation_scope the scope stays; a scope change saves a new version with the same conditions, and what was granted stays. A shared rule keeps its scope; a kind never changes. Send if_version, the current_version you read, so a write never replaces a version saved since. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Renames the rule, saves a new version (english and tree together, with an explanation or one the server writes; earlier versions stay) or an earlier one again (restore_version), changes its state (draft is off; observe; active), whose mail it runs over (evaluation_scope, with scope_selection when selected) or its saved expectations (each saved version and new set is judged in expectations_check). Anyone but its author who sees it may only disable it (state draft), and while it is shared only if they manage members from the dashboard. Without evaluation_scope the scope stays; a scope change saves a new version with the same conditions, and what was granted stays. A shared rule keeps its scope; a kind never changes. A saved version takes effect at once (an active rule stays active); affects counts what it reaches. Send if_version, the current_version you read, so a write never replaces a version saved since, or if_revision to refuse it after any update. Without if_expectations_pass a version is saved even when its expectations_check fails. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22646,17 +22646,8 @@ const openapiDocument = {
 						}
 					},
 					"400": {
-						"description": "Invalid request parameters",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "validation_error",
-									"message": "Invalid domain format"
-								}
-							}
-						} }
+						"description": "validation_error: invalid body or tree (details.errors), too large (too_large), a version that no longer renders (version_not_renderable), or restore_version names the current version (already_current). no_expectations: if_expectations_pass with no expectations to judge; nothing was saved.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"401": {
 						"description": "Invalid or missing API key",
@@ -22678,24 +22669,15 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden with details.reason rule_shared: the rule is shared with another member, so only its author, or someone who manages members from the dashboard, can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read.",
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden (rule_shared): the rule is shared, so only its author or a member manager can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read. grant_forbidden (mail_depth): if_expectations_pass needs content access to mail.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
-						"description": "Resource not found",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "not_found",
-									"message": "Resource not found"
-								}
-							}
-						} }
+						"description": "not_found: no such rule you can see, or restore_version names no version of it (details.reason version_not_found).",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"409": {
-						"description": "email_rule_conflict: the rule changed while saving, or (details.reason version_moved, with details.current_version) its current version differs from if_version; read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope.",
+						"description": "email_rule_conflict: the rule changed (details.reason version_moved with current_version, revision_moved with current_revision, expectations_moved or rule_changed); read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope. expectations_failed or expectations_undecided (if_expectations_pass): nothing was saved; details carries current_version, state and expectations_check.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -39320,6 +39302,8 @@ const openapiDocument = {
 									"email_rule_share_limit",
 									"embedding_provider_unavailable",
 									"entitlement",
+									"expectations_failed",
+									"expectations_undecided",
 									"expired",
 									"feature_not_enabled",
 									"fresh_send_not_authorized",
@@ -39394,6 +39378,7 @@ const openapiDocument = {
 									"network_view_denied",
 									"no_code",
 									"no_endpoint",
+									"no_expectations",
 									"no_mail_read",
 									"not_a_template_install",
 									"not_available",
@@ -46240,12 +46225,12 @@ const openapiDocument = {
 					},
 					"retry_scheduled": {
 						"type": ["boolean", "null"],
-						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will."
+						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. A rule-granted delivery is retried on a schedule of its own, to the same endpoint, deciding it afresh: on its latest attempt true while another attempt is to come (the delivery's next_attempt_at says when); null while an attempt is under way (read it again shortly), while it waits on an owner who cannot receive mail or on a held endpoint (checked again hourly, and sent once that clears), when it is past its 7-day limit, or when that could not be read just now; and false otherwise, including once the endpoint is off or already has the email. Null on every attempt of a delivery retried or settled on a schedule of its own that this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will."
 					},
 					"next_attempt_at": {
 						"type": ["string", "null"],
 						"format": "date-time",
-						"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled."
+						"description": "When the next automatic attempt of a rule-granted delivery is due: set on its latest attempt while retry_scheduled is true. The attempt runs at the first retry pass at or after this time (one runs every few minutes), so a time already past means it is due now. Null otherwise, and on every delivery that is not rule-granted, whose retries are passes for the email with no time reported (whether one is coming is retry_scheduled)."
 					}
 				},
 				"required": [
@@ -49452,6 +49437,22 @@ const openapiDocument = {
 					"questions"
 				]
 			},
+			"EmailRuleBreadth": {
+				"type": "object",
+				"properties": {
+					"checked": {
+						"type": "integer",
+						"minimum": 0,
+						"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+					},
+					"matched": {
+						"type": "integer",
+						"minimum": 0,
+						"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+					}
+				},
+				"required": ["checked", "matched"]
+			},
 			"CompileEmailRuleRequest": {
 				"type": "object",
 				"properties": {
@@ -49480,7 +49481,7 @@ const openapiDocument = {
 					"tree": { "$ref": "#/components/schemas/EmailRuleTree" },
 					"explanation": {
 						"type": "string",
-						"description": "What the rule matches, in plain English."
+						"description": "What the rule matches, in plain English: only which emails, not what it grants or shares, which follows from its state, its scope and the keys, webhooks and people it reaches. The compiler leaves out a sentence that plainly says what the rule hands over."
 					},
 					"assumptions": {
 						"type": "array",
@@ -49496,6 +49497,10 @@ const openapiDocument = {
 						"type": "string",
 						"description": "An opaque name for the version of the rule compiler that produced the rule, such as rule-compiler-v1. Send it back as compiled_by when you save the rule."
 					},
+					"breadth": {
+						"description": "How many of your recent emails its conditions hold for, counted over your own mailboxes whatever scope you save it with, warning or not. Null when not counted in full: a rule with questions, headers-only access, no test of it possible as you, or a count that failed or ran out of time. Writes ignore it, so a compile answer (without include_sql) can be sent back unchanged.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
 					"sql": {
 						"description": "Present only when include_sql was true.",
 						"type": "object",
@@ -50419,10 +50424,19 @@ const openapiDocument = {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"revision": {
+						"description": "Moves on by one with every update. Send it as if_revision.",
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
 					"author_user_id": {
 						"type": "string",
 						"format": "uuid"
 					},
+					"author": {
+						"description": "Who wrote it: author_user_id with their name and sign-in email.",
+						"$ref": "#/components/schemas/EmailRuleAuthor"
+					},
 					"is_author": {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -50435,14 +50449,17 @@ const openapiDocument = {
 						"type": "string",
 						"format": "date-time"
 					},
-					"current": { "anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }] },
+					"current": {
+						"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }]
+					},
 					"scope_warnings": {
 						"description": "Names in scope_selection that match nothing this organization receives mail at (a typo, or an inbox not yet in use). Present only when there are some.",
 						"type": "array",
 						"items": { "$ref": "#/components/schemas/EmailRuleScopeWarning" }
 					},
 					"expectations_check": {
-						"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest.",
+						"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
 						"type": "object",
 						"properties": {
 							"version": {
@@ -50470,6 +50487,10 @@ const openapiDocument = {
 									"type": "string",
 									"format": "uuid"
 								}
+							},
+							"note": {
+								"description": "On an update that saved a version that did not pass: that it was saved anyway, is current, and whether it is live.",
+								"type": "string"
 							}
 						},
 						"required": [
@@ -50478,6 +50499,41 @@ const openapiDocument = {
 							"failed",
 							"undecided"
 						]
+					},
+					"restored_from": {
+						"description": "When this write saved an earlier version again (restore_version): which, and that the scope is not part of a version.",
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "integer",
+								"exclusiveMinimum": 0
+							},
+							"note": { "type": "string" }
+						},
+						"required": ["version", "note"]
+					},
+					"affects": {
+						"description": "After an update that saved a version: API keys listing the rule, the webhooks they own, and shares this write ended. The rule keeps its state. Absent if not read.",
+						"type": "object",
+						"properties": {
+							"keys": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"endpoints": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"shares_ended": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"required": [
+							"keys",
+							"endpoints",
+							"shares_ended"
+						]
 					}
 				},
 				"required": [
@@ -50506,6 +50562,28 @@ const openapiDocument = {
 				},
 				"required": ["addresses", "domains"]
 			},
+			"EmailRuleAuthor": {
+				"type": "object",
+				"properties": {
+					"user_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"name": {
+						"description": "Their name; null unless you can list members or this is you, and when they have none set.",
+						"type": ["string", "null"]
+					},
+					"email": {
+						"description": "Sign-in email; null unless you can list member emails or this is you.",
+						"type": ["string", "null"]
+					}
+				},
+				"required": [
+					"user_id",
+					"name",
+					"email"
+				]
+			},
 			"EmailRuleVersion": {
 				"type": "object",
 				"properties": {
@@ -50655,6 +50733,10 @@ const openapiDocument = {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 64
+					},
+					"breadth": {
+						"description": "Ignored (the compile answer's breadth).",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					}
 				},
 				"required": [
@@ -50703,10 +50785,19 @@ const openapiDocument = {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"revision": {
+						"description": "Moves on by one with every update. Send it as if_revision.",
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
 					"author_user_id": {
 						"type": "string",
 						"format": "uuid"
 					},
+					"author": {
+						"description": "Who wrote it: author_user_id with their name and sign-in email.",
+						"$ref": "#/components/schemas/EmailRuleAuthor"
+					},
 					"is_author": {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -50788,10 +50879,19 @@ const openapiDocument = {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"revision": {
+						"description": "Moves on by one with every update. Send it as if_revision.",
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
 					"author_user_id": {
 						"type": "string",
 						"format": "uuid"
 					},
+					"author": {
+						"description": "Who wrote it: author_user_id with their name and sign-in email.",
+						"$ref": "#/components/schemas/EmailRuleAuthor"
+					},
 					"is_author": {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -50804,7 +50904,10 @@ const openapiDocument = {
 						"type": "string",
 						"format": "date-time"
 					},
-					"current": { "anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }] },
+					"current": {
+						"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }]
+					},
 					"expectations": {
 						"description": "Its saved expectations, each list by email id.",
 						"type": "object",
@@ -50900,6 +51003,10 @@ const openapiDocument = {
 						"minLength": 1,
 						"maxLength": 64
 					},
+					"breadth": {
+						"description": "Ignored (the compile answer's breadth).",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
 					"evaluation_scope": {
 						"type": "string",
 						"enum": [
@@ -50911,7 +51018,7 @@ const openapiDocument = {
 					},
 					"scope_selection": { "$ref": "#/components/schemas/EmailRuleScopeSelection" },
 					"if_version": {
-						"description": "The current_version you read. If the rule's now differs, nothing changes: 409 email_rule_conflict, details.reason version_moved and details.current_version. Send it with a new version so a concurrent edit is never replaced unseen. It guards versions only: a change to expectations alone saves none.",
+						"description": "The current_version you read: if it has moved, nothing is saved (409 email_rule_conflict, version_moved). It guards versions only; if_revision guards every update.",
 						"type": "integer",
 						"minimum": 1
 					},
@@ -50937,6 +51044,22 @@ const openapiDocument = {
 						},
 						"additionalProperties": false,
 						"description": "Replaces its saved expectations (author only); null removes them."
+					},
+					"if_revision": {
+						"description": "The revision you read: if the rule was updated since, nothing is saved (409 email_rule_conflict, revision_moved).",
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 2147483647
+					},
+					"if_expectations_pass": {
+						"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; undecided: 409 expectations_undecided (both with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
+						"type": "boolean"
+					},
+					"restore_version": {
+						"description": "Save version n again as the next version (author only): its english, tree, explanation, assumptions, warnings and compiled_by. A version carries no scope: the rule keeps its own unless evaluation_scope is sent. 404 version_not_found; 400 already_current or version_not_renderable. Not with a version's own fields.",
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 2147483647
 					}
 				},
 				"additionalProperties": false
@@ -51543,6 +51666,10 @@ const openapiDocument = {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 64
+					},
+					"breadth": {
+						"description": "Ignored (the compile answer's breadth).",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					}
 				},
 				"required": [
@@ -51863,10 +51990,19 @@ const openapiDocument = {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"revision": {
+						"description": "Moves on by one with every update. Send it as if_revision.",
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
 					"author_user_id": {
 						"type": "string",
 						"format": "uuid"
 					},
+					"author": {
+						"description": "Who wrote it: author_user_id with their name and sign-in email.",
+						"$ref": "#/components/schemas/EmailRuleAuthor"
+					},
 					"is_author": {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -51879,7 +52015,10 @@ const openapiDocument = {
 						"type": "string",
 						"format": "date-time"
 					},
-					"current": { "anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }] }
+					"current": {
+						"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }]
+					}
 				},
 				"required": [
 					"id",
@@ -52102,6 +52241,10 @@ const openapiDocument = {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 64
+					},
+					"breadth": {
+						"description": "Ignored (the compile answer's breadth).",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					}
 				},
 				"additionalProperties": false
@@ -54350,11 +54493,11 @@ const openapiDocument = {
 						"description": "Whether this is the latest attempt of its delivery: the one recorded last, where a record of no attempt (a rule skip or a held send, attempt_count 0) is latest only when no attempt was made. A retry is recorded as a new attempt with its own id and attempt_count (not always higher than the one before), so an earlier attempt never changes: follow the latest one, or read attempts on any of them."
 					},
 					"retry_scheduled": {
-						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. A rule-granted delivery is retried on a schedule of its own, to the same endpoint, deciding it afresh: on its latest attempt true while another attempt is to come (the delivery's next_attempt_at says when); null while an attempt is under way (read it again shortly), while it waits on an owner who cannot receive mail or on a held endpoint (checked again hourly, and sent once that clears), when it is past its 7-day limit, or when that could not be read just now; and false otherwise, including once the endpoint is off or already has the email. Null on every attempt of a delivery retried or settled on a schedule of its own that this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
 						"type": ["boolean", "null"]
 					},
 					"next_attempt_at": {
-						"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled.",
+						"description": "When the next automatic attempt of a rule-granted delivery is due: set on its latest attempt while retry_scheduled is true. The attempt runs at the first retry pass at or after this time (one runs every few minutes), so a time already past means it is due now. Null otherwise, and on every delivery that is not rule-granted, whose retries are passes for the email with no time reported (whether one is coming is retry_scheduled).",
 						"type": ["string", "null"]
 					},
 					"attempts": {
@@ -54384,7 +54527,7 @@ const openapiDocument = {
 									"type": ["string", "null"]
 								},
 								"retry_scheduled": {
-									"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+									"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. A rule-granted delivery is retried on a schedule of its own, to the same endpoint, deciding it afresh: on its latest attempt true while another attempt is to come (the delivery's next_attempt_at says when); null while an attempt is under way (read it again shortly), while it waits on an owner who cannot receive mail or on a held endpoint (checked again hourly, and sent once that clears), when it is past its 7-day limit, or when that could not be read just now; and false otherwise, including once the endpoint is off or already has the email. Null on every attempt of a delivery retried or settled on a schedule of its own that this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
 									"type": ["boolean", "null"]
 								}
 							},
@@ -65178,7 +65321,9 @@ function unauthorizedRefusal(errorPayload, authFailureContext) {
 * Anything else, including an organization-wide key, an agent_delegate and
 * a person with no member address they may send from, gets no default: the
 * command refuses, lists what the credential may send from, and asks for
-* --from. The From is never an address guessed from the organization's
+* --from. A credential whose grant has no mail:send is refused by that
+* permission instead (MissingSendPermissionError), with no --from hint. The
+* From is never an address guessed from the organization's
 * domains, such as agent@ at the first verified one. A failed answer from an
 * API that has it refuses rather than fall back.
 */
@@ -65236,6 +65381,57 @@ const SEND_FROM_SOURCES = {
 	member_address: "member_address",
 	granted_address: "granted_address"
 };
+/**
+* The refusal of a send by a credential whose grant has no mail:send, in the
+* shape the send route itself refuses it with (code grant_forbidden, details
+* naming the permission), so a script can branch on it. It names what the
+* credential lacks first, then what would fix it, never --from.
+*/
+var MissingSendPermissionError = class extends Errors.CLIError {
+	details = {
+		permission: "mail:send",
+		reason: "permission_missing"
+	};
+	constructor(missing) {
+		super(missingSendPermissionMessage(missing), {
+			code: "grant_forbidden",
+			exit: 1
+		});
+	}
+};
+function missingSendPermissionMessage(missing) {
+	const parts = [`${KEY_CREDENTIAL_KINDS.has(missing.credentialKind ?? "") ? "This key" : "This credential"} has no mail:send, so it cannot send new mail from any address; --from does not change that.`];
+	if (missing.replies) parts.push("It can still reply to mail it received.");
+	parts.push(missing.credentialKind === "org_key" && missing.keyId ? `To send, add the permission to the key (a member who manages keys runs \`primitive keys update ${missing.keyId} --add mail:send\`), or use a credential that holds mail:send.` : PERSON_CREDENTIAL_KINDS.has(missing.credentialKind ?? "") ? "To send, ask an organization admin for a role that includes mail:send." : "To send, use a credential that holds mail:send.");
+	return parts.join(" ");
+}
+/**
+* The credential's own grant when it has no mail:send, outright or over a
+* reach of its own (as the API decides whether a caller may send), or null
+* when it has it or the grant cannot be read: then nothing is claimed.
+*/
+async function missingSendPermission(apiClient) {
+	let own;
+	try {
+		own = await getOwnGrant({
+			client: apiClient.client,
+			responseStyle: "fields"
+		});
+	} catch {
+		return null;
+	}
+	if (!own || own.error) return null;
+	const data = own.data?.data;
+	const grant = data?.grant;
+	if (!grant || !Array.isArray(grant.permissions)) return null;
+	const holds = (permission) => grant.permissions.includes(permission) || grant.scoped_permissions !== null && typeof grant.scoped_permissions === "object" && Object.hasOwn(grant.scoped_permissions, permission);
+	if (holds("mail:send")) return null;
+	return {
+		credentialKind: typeof grant.credential_kind === "string" ? grant.credential_kind : null,
+		keyId: typeof data?.key_id === "string" ? data.key_id : null,
+		replies: holds("mail:reply")
+	};
+}
 function errorDetail(error) {
 	return error instanceof Error ? error.message : String(error);
 }
@@ -65292,6 +65488,10 @@ async function sendFromAnswer(apiClient, authFailureContext, purpose) {
 	const addresses = data.addresses.map((entry) => entry && typeof entry === "object" ? entry.address : void 0).filter((address) => typeof address === "string");
 	const domains = Array.isArray(data.domains) ? data.domains.filter((domain) => typeof domain === "string") : [];
 	if (purpose === "reply" && addresses.length === 0 && domains.length === 0) return void 0;
+	if (addresses.length === 0 && domains.length === 0) {
+		const missing = await missingSendPermission(apiClient);
+		if (missing) throw new MissingSendPermissionError(missing);
+	}
 	const parts = [typeof data.reason === "string" && data.reason.trim() ? data.reason.trim().replace(/\.?$/, ".") : "This credential has no single address to send from, so --from has no default."];
 	if (addresses.length > 0) parts.push(`Addresses you may send from: ${addresses.join(", ")}.`);
 	if (domains.length > 0) parts.push(`${addresses.length > 0 ? "Also any" : "Any"} address at: ${domains.join(", ")}.`);
@@ -66106,7 +66306,7 @@ var ChatCommand = class ChatCommand extends Command {
 			env: "PRIMITIVE_API_BASE_URL",
 			hidden: true
 		}),
-		from: Flags.string({ description: "Sender address. Defaults to the selected connected profile's pinned address; on your own login, to your member address when you may send from it; with a key whose grant names exactly one address, to that address. Otherwise the command asks for --from. A connected profile rejects another sender." }),
+		from: Flags.string({ description: "Sender address. Defaults to the selected connected profile's pinned address; on your own login, to your member address when you may send from it; with a key whose grant names exactly one address, to that address. Otherwise the command asks for --from, except that a credential without mail:send is refused by that permission. A connected profile rejects another sender." }),
 		subject: Flags.string({
 			description: "Advanced email transport override. Usually omit; chat threading does not depend on the subject.",
 			hidden: true
@@ -66186,7 +66386,7 @@ var ChatCommand = class ChatCommand extends Command {
 			}
 			const outcome = phase === "sending" || error instanceof UncertainChatSendError ? "uncertain" : "not_sent";
 			if (flags.json) this.log(JSON.stringify(buildChatSendFailureEnvelope({
-				error: { message: detail },
+				error: thrownErrorBody(error),
 				exitCode: outcome === "not_sent" ? thrownErrorExitCode(error) : void 0,
 				idempotencyKey: this.chatProgress.idempotencyKey,
 				noun,
@@ -66976,15 +67176,12 @@ var ChatReplyCommand = class ChatReplyCommand extends Command {
 		try {
 			await this.runReply(args, flags);
 		} catch (error) {
-			if (flags.json && !this.delegatedToChat) {
-				const detail = error instanceof Error ? error.message : String(error);
-				this.log(JSON.stringify(buildChatSendFailureEnvelope({
-					error: { message: detail },
-					exitCode: thrownErrorExitCode(error),
-					noun: "Reply",
-					outcome: "not_sent"
-				}), null, 2));
-			}
+			if (flags.json && !this.delegatedToChat) this.log(JSON.stringify(buildChatSendFailureEnvelope({
+				error: thrownErrorBody(error),
+				exitCode: thrownErrorExitCode(error),
+				noun: "Reply",
+				outcome: "not_sent"
+			}), null, 2));
 			throw error;
 		}
 	}
@@ -68435,7 +68632,9 @@ const ID_DESCRIPTION = "The id of the received email (from `primitive emails lis
 /**
 * `primitive emails facts <id>`: what the classifier read from one received
 * email, every fact as email rule conditions read it, from the email's rule
-* results (GET /emails/{id}/rule-results).
+* results (GET /emails/{id}/rule-results). A credential that may not read
+* rule results gets the facts as written, from the email read
+* (GET /emails/{id}, `understanding`).
 */
 var EmailsFactsCommand = class EmailsFactsCommand extends Command {
 	static summary = "Show what the classifier read from an email";
@@ -68443,7 +68642,7 @@ var EmailsFactsCommand = class EmailsFactsCommand extends Command {
 
 Use it to see why an email rule did or did not match, alongside \`primitive email-rules list-email-rule-results --email-id <id>\`, which this reads. An email with no classification (not classified yet, never to be, or content that cannot be read) prints a message saying so on stderr and nothing on stdout. With --json, prints the classification object, or null when there is none.
 
-Needs the email rules feature, and a member's own credential with their full access (not an API key, agent key or narrowed token).`;
+Needs the email rules feature. Rule results are read with a member's own credential with their full access. An API key, agent key or narrowed token cannot read them, so for one of those the command reads the facts from the email itself instead (\`understanding.facts\` of \`primitive emails get <id> --json\`), as the classifier wrote them, and says so on stderr (in \`warnings\` with --json). Those differ from what rule conditions read in two ways: conditions read a multi fact's options lowercased, and read a fact the classifier left out as null, where \`understanding.facts\` leaves it out.`;
 	static examples = ["<%= config.bin %> emails facts 3f0e1c2a-8b7d-4c6e-9a1b-2d3e4f5a6b7c", "<%= config.bin %> emails facts --id 3f0e1c2a-8b7d-4c6e-9a1b-2d3e4f5a6b7c --json"];
 	static args = { id: Args.string({
 		description: ID_DESCRIPTION,
@@ -68451,7 +68650,7 @@ Needs the email rules feature, and a member's own credential with their full acc
 	}) };
 	static flags = {
 		id: Flags.string({ description: ID_DESCRIPTION }),
-		json: Flags.boolean({ description: "Print the classification object as one JSON document on stdout (null when the email has none), and nothing on stderr. A failure prints the error with exit_code." }),
+		json: Flags.boolean({ description: "Print the classification object as one JSON document on stdout (null when the email has none), and nothing on stderr. When the facts come from the email itself, the note saying so is in its warnings. A failure prints the error with exit_code." }),
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -68484,6 +68683,14 @@ Needs the email rules feature, and a member's own credential with their full acc
 			});
 			if (result.error) {
 				const payload = extractErrorPayload(result.error);
+				if (refusesRuleResultsToCredential(payload)) {
+					await this.printFactsFromEmail(id, Boolean(flags.json), {
+						apiClient,
+						auth,
+						baseUrlOverridden
+					});
+					return;
+				}
 				writeErrorWithHints(payload, result.response);
 				surfaceUnauthorizedHint({
 					auth,
@@ -68508,7 +68715,80 @@ Needs the email rules feature, and a member's own credential with their full acc
 			this.log(lines.join("\n"));
 		});
 	}
+	/**
+	* The facts as `emails get` reads them, for a credential that may not read
+	* rule results: the email's understanding, when it is ready.
+	*/
+	async printFactsFromEmail(id, json, client) {
+		const read = await getEmail({
+			client: client.apiClient.client,
+			path: { id },
+			responseStyle: "fields"
+		});
+		if (read.error) {
+			const payload = extractErrorPayload(read.error);
+			process.stderr.write("This credential cannot read email rule results, and reading the facts from the email itself failed:\n");
+			writeErrorWithHints(payload, read.response);
+			surfaceUnauthorizedHint({
+				auth: client.auth,
+				baseUrlOverridden: client.baseUrlOverridden,
+				configDir: this.config.configDir,
+				payload
+			});
+			process.exitCode = 1;
+			return;
+		}
+		const understanding = read.data?.data?.understanding;
+		const classification = classificationFromUnderstanding(understanding);
+		if (classification) process.stderr.write(`${understandingNote(id)}\n`);
+		if (json) {
+			this.log(JSON.stringify(classification, null, 2));
+			return;
+		}
+		const lines = classification ? classificationFactLines(classification) : [];
+		if (lines.length === 0) {
+			process.stderr.write(`${classification ? "This email's classification has no facts." : noUnderstandingMessage(understanding)}\n`);
+			return;
+		}
+		this.log(lines.join("\n"));
+	}
 };
+/** The refusals of rule results to a credential that is not a member's own, unnarrowed one. */
+const NOT_A_RULE_READER = /* @__PURE__ */ new Set(["rule_author_credential", "narrowed_credential"]);
+/** Whether rule results were refused only because of the kind of credential. */
+function refusesRuleResultsToCredential(payload) {
+	if (extractErrorCode(payload) !== "forbidden") return false;
+	const { reason } = refusalDetails(payload);
+	return typeof reason === "string" && NOT_A_RULE_READER.has(reason);
+}
+/**
+* The email's `understanding` as the classification rule results show
+* (id, vocabulary, classified_at, facts), when it is ready; otherwise null.
+*/
+function classificationFromUnderstanding(understanding) {
+	if (!isRecord$1(understanding) || understanding.status !== "ready") return null;
+	return {
+		id: understanding.classification_id ?? null,
+		vocabulary: understanding.vocabulary ?? null,
+		classified_at: understanding.classified_at ?? null,
+		facts: isRecord$1(understanding.facts) ? understanding.facts : {}
+	};
+}
+/** Where facts read from the email came from, and how they differ. */
+function understandingNote(id) {
+	return `This credential cannot read email rule results, so these facts come from the email itself (\`primitive emails get ${id} --json\`, understanding.facts), as the classifier wrote them. Rule conditions read a multi fact's options lowercased, and a fact left out here reads null to them.`;
+}
+/** Why an email read gave no facts to show. */
+function noUnderstandingMessage(understanding) {
+	const status = isRecord$1(understanding) ? understanding.status : void 0;
+	if (status === "pending") return "No classification for this email yet: it has not been classified. Recent mail can take a while, so try again later.";
+	if (status === "unavailable") return "No classification to show for this email: it was not classified in time, its content was discarded first, or its facts are too large to include.";
+	if (typeof status === "string") return `No classification to show: the email's understanding is ${status}.`;
+	return "No classification to show: the email read carries no facts. Its content may be withheld, discarded or failed to parse, this credential may not read message content, or the facts could not be read just now, so try again.";
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 // src/oclif/repeat-message.ts
 const UUID$5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** The server-verified repeat marker on an email read, if any. */
@@ -71015,8 +71295,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.6";
-const CLI_VERSION_RANGE = "^3.0.0-preview.6";
+const SDK_VERSION_RANGE = "^3.0.0-preview.7";
+const CLI_VERSION_RANGE = "^3.0.0-preview.7";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -72848,7 +73128,8 @@ const INBOX_NEXT_EXIT_CODE_HELP = `Exit codes:
 const SCAN_PAGE_SIZE = 100;
 const DEFAULT_WAIT_TIMEOUT_SECONDS = 300;
 const MAX_LONG_POLL_SECONDS$1 = 30;
-const EPOCH_CURSOR = "1970-01-01T00:00:00.000000Z|00000000-0000-4000-8000-000000000000";
+const TIME_CURSOR_ID = "00000000-0000-4000-8000-000000000000";
+const EPOCH_CURSOR = `1970-01-01T00:00:00.000000Z|${TIME_CURSOR_ID}`;
 /** An API call failed; carries the error payload for printing. */
 var InboxNextApiError = class extends Error {
 	surface;
@@ -73090,18 +73371,43 @@ async function countAutomatedAwaiting(params) {
 		capped: page.totalCapped
 	};
 }
+/** Pages of the forward tail `baselineCursor` reads to catch up, at most. */
+const BASELINE_CATCH_UP_PAGES = 5;
 /**
-* The wake-up cursor for --wait: the newest email's position, read
-* BEFORE the first state check. Anything that becomes visible after it
-* is returned by the long-poll, so there is no gap between "checked,
-* nothing awaits" and "started waiting". Built from the newest row the
-* way the API documents bootstrapping `since`; no client clock involved.
+* The wake-up cursor for --wait (and for `primitive wait`): the end of the
+* forward tail, the position of the email made visible most recently, read
+* BEFORE the first state check. Anything that becomes visible after it is
+* returned by the long-poll, so there is no gap between "checked, nothing
+* awaits" and "started waiting". Taken from the server's answers alone, with
+* no client clock involved.
+*
+* The tail orders and cursors on when an email became visible, which the
+* API stamps when it accepts the email: after the created_at a list row
+* carries, and to the microsecond where that created_at is truncated to the
+* millisecond. So a cursor built from the newest row's created_at sits
+* before that row on the tail, and the tail would hand it back, with any
+* older email made visible after it, as new mail. From that cursor the tail
+* is read forward without waiting until it is caught up, and the position it
+* gives is the baseline. The read stops after BASELINE_CATCH_UP_PAGES pages;
+* mail past that would still be handed back, which needs more than that many
+* pages of mail made visible after the newest row's created_at.
 */
 async function baselineCursor(params) {
-	const newest = (await listPage(params.api ?? DEFAULT_API, params.apiClient, { limit: 1 })).rows[0];
+	const api = params.api ?? DEFAULT_API;
+	const newest = (await listPage(api, params.apiClient, { limit: 1 })).rows[0];
 	const createdAt = str$1(newest?.created_at);
 	const id = str$1(newest?.id);
-	return createdAt && id ? `${createdAt}|${id}` : EPOCH_CURSOR;
+	let cursor = createdAt && id ? `${createdAt}|${id}` : EPOCH_CURSOR;
+	for (let read = 0; read < BASELINE_CATCH_UP_PAGES; read += 1) {
+		const tail = await listPage(api, params.apiClient, {
+			limit: SCAN_PAGE_SIZE,
+			since: cursor
+		});
+		if (tail.rows.length === 0 || !tail.cursor) break;
+		cursor = tail.cursor;
+		if (tail.rows.length < SCAN_PAGE_SIZE) break;
+	}
+	return cursor;
 }
 /**
 * Hold one long-poll on the forward tail. Returns the advanced cursor
@@ -73743,6 +74049,498 @@ var InboxSetupCommand = class InboxSetupCommand extends Command {
 		});
 	}
 };
+// src/oclif/commands/whoami.ts
+/**
+* `GET /whoami` with its grant query parameters. A server without grants
+* ignores them and answers without `grant` or `check`.
+*/
+async function fetchCallerIdentity(client, query, options = {}) {
+	const result = await client.get({
+		...options.fetch ? { fetch: options.fetch } : {},
+		...options.signal ? { signal: options.signal } : {},
+		query,
+		responseStyle: "fields",
+		security: [{
+			scheme: "bearer",
+			type: "http"
+		}],
+		url: "/whoami"
+	});
+	if (result.error) return {
+		identity: null,
+		error: result.error
+	};
+	return {
+		identity: result.data?.data ?? null,
+		error: null
+	};
+}
+/** How many rule ids the Grant line names before it says how many more. */
+const GRANT_LINE_RULES = 3;
+/** Rule ids for the Grant line: the first few, then how many more. */
+function ruleIdList(rules) {
+	const shown = rules.slice(0, GRANT_LINE_RULES);
+	const rest = rules.length - shown.length;
+	const all = rest > 0 ? [...shown, `${rest} more`] : shown;
+	return all.length <= 1 ? all[0] ?? "" : `${all.slice(0, -1).join(", ")} and ${all[all.length - 1]}`;
+}
+/**
+* The mail a grant reaches, for the Grant line. A key cannot read email
+* rules, so a scope that lists them names them by id. A rule grants mail it
+* matches as the mail arrives, while the rule is active, and the key reads it
+* only while the rule stays active.
+*/
+function grantScopeText(scope) {
+	if (scope === void 0) return "all mail in the organization";
+	const reach = mailReach(scope);
+	switch (reach.kind) {
+		case "org": return "all mail in the organization";
+		case "unreadable": return "a mail scope the server could not read, so no mail";
+		case "none": return "no mail through its grant, which names no mailbox, domain or email rule";
+		case "rules_only":
+		case "mailboxes": {
+			if (reach.rules.length === 0) return "a narrowed mail scope";
+			const granted = reach.rules.length === 1 ? `mail that email rule ${ruleIdList(reach.rules)} granted, while it stays active` : `mail that email rules ${ruleIdList(reach.rules)} granted, while each stays active`;
+			const more = reach.rules.length > GRANT_LINE_RULES ? " (`primitive whoami --json --grant` lists every rule)" : "";
+			return reach.kind === "mailboxes" ? `a narrowed mail scope, plus ${granted}${more}` : `${granted}${more}`;
+		}
+		default: return "a narrowed mail scope";
+	}
+}
+function formatGrant(grant, keyId = null) {
+	const what = grant.template ? `template ${grant.template}` : `${grant.grant_type ?? "grant"} with ${grant.permissions.length} permissions`;
+	const credential = keyId ? `${grant.credential_kind}, key id ${keyId}` : grant.credential_kind;
+	const lines = [`Grant: ${what}, ${grantScopeText(grant.mail_scope)} (${credential})`];
+	if (grant.expires_at) lines.push(`Credential expires: ${grant.expires_at}`);
+	return lines;
+}
+/** Lines describing the caller's organization, role and grant. */
+function formatGrantLines(identity, options = {}) {
+	const lines = [];
+	const org = options.orgName ? `${options.orgName} (${identity.org_id})` : identity.org_id;
+	lines.push(`Organization: ${org}`);
+	if (isPersonIdentity(identity)) lines.push(identity.role === "member" ? "Built-in role: member (also shown for a template or custom role that does not fully include member; the Grant line is what this login can do)" : isBuiltInRoleKey(identity.role) ? `Built-in role: ${identity.role}` : `Role key: ${identity.role}`);
+	const grant = identity.grant;
+	if (grant) lines.push(...formatGrant(grant, identity.key_id));
+	if (options.userLogin) lines.push("Signed in as yourself. Switch organizations with `primitive org use <org>`.");
+	return lines;
+}
+function formatPermissionCheck(check) {
+	if (check.allow) return `${check.permission}: allowed`;
+	return `${check.permission}: not allowed${check.reason ? ` (${check.reason})` : ""}`;
+}
+/** Whether GET /whoami answered for an API key. */
+function isKeyIdentity(identity) {
+	return Boolean(identity.key_id) || identity.auth_method === "api_key";
+}
+/** Whether GET /whoami answered for a person's own session or OAuth login. */
+const PERSON_AUTH_METHODS = /* @__PURE__ */ new Set([
+	"oauth",
+	"session",
+	"dashboard_bridge"
+]);
+function isPersonIdentity(identity) {
+	return !isKeyIdentity(identity) && typeof identity.auth_method === "string" && PERSON_AUTH_METHODS.has(identity.auth_method);
+}
+/** What the summary's first line says about who is calling. */
+function identityLine(identity) {
+	if (!identity || identity.member_address === void 0) return "Authenticated";
+	if (identity.member_address) return `Authenticated as ${identity.member_address.address} (your member address)`;
+	if (isKeyIdentity(identity)) return "Authenticated (API keys have no member address)";
+	if (!isPersonIdentity(identity)) return "Authenticated (this credential has no member address)";
+	return `Authenticated (you have no member address in this organization${identity.member_address_suggestion ? `; \`primitive account provision-member-address --address ${identity.member_address_suggestion}\` sets one` : ""})`;
+}
+function formatWhoamiSummary(account, managedInboxDomain, orgName = null, identity = null) {
+	const lines = [
+		identityLine(identity),
+		orgName ? `Organization: ${orgName} (${account.id})` : `Organization id: ${account.id}`,
+		...account.email ? [`Account email: ${account.email} (the email the account was opened with)`] : [],
+		`Plan: ${account.plan}`
+	];
+	if (managedInboxDomain) lines.push(`Managed inbox: any-local-part@${managedInboxDomain}`);
+	return lines.join("\n");
+}
+/** `GET /whoami/grant`, which any credential may ask about itself. */
+async function fetchOwnGrant(client) {
+	try {
+		const result = await getOwnGrant({
+			client,
+			responseStyle: "fields"
+		});
+		if (result.error) return null;
+		return result.data?.data ?? null;
+	} catch {
+		return null;
+	}
+}
+/** The summary for a valid credential whose grant cannot read the account. */
+function formatOwnGrantSummary(own, orgName) {
+	return [
+		"Authenticated. This credential cannot read the account (it lacks org:read).",
+		orgName ? `Organization: ${orgName} (${own.org_id})` : `Organization id: ${own.org_id}`,
+		...own.grant ? formatGrant(own.grant, own.key_id) : []
+	].join("\n");
+}
+var WhoamiCommand = class WhoamiCommand extends Command {
+	static description = `Print the account currently authenticated by saved OAuth credentials or an explicit API key. For account credentials this is a live credentials smoke test. Use account whoami for the authenticated caller, their assigned member address and an address suggestion; account provision-member-address --address <email> saves your chosen personal address.
+
+  With PRIMITIVE_AGENT_PROFILE selected, print the saved connected-agent identity offline, with no API call. The first line is the agent's email address alone; --json adds address, profile and source (session_hook when the selected profile is this Claude Code session's own agent exported by the session start hook, env otherwise). This does not verify live authentication, app pairing, or listener readiness. Inspect the receiver separately: the output names the command for the profile's receiver mode (agent connect --status for Claude hook and poll receivers, listen --status --notify-session for a native listener).
+
+  The default output is a concise human summary. Pass --json for the full /account response or the explicit offline connected-agent identity envelope.`;
+	static summary = "Print the live account or saved connected-agent identity";
+	static examples = [
+		"<%= config.bin %> whoami",
+		"<%= config.bin %> whoami --api-key prim_...",
+		"<%= config.bin %> whoami --json | jq .id",
+		"PRIMITIVE_AGENT_PROFILE=work <%= config.bin %> whoami --json"
+	];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		json: Flags.boolean({ description: "Print the account JSON response, or the saved connected identity marked verification: offline. Never prints credentials." }),
+		grant: Flags.boolean({ description: "With --json, add `grant`: the organization, role and grant of this credential. The summary shows them when the server reports them; only a person's own login has a role line." }),
+		check: Flags.string({ description: "Ask whether this credential may use a permission, such as mail:send. Prints the decision and exits 1 when it is not allowed. Nothing is enforced by asking." }),
+		resource: Flags.string({
+			description: "With --check, the resource to check against, as function:<id>, domain:<id>, endpoint:<id> or route:<id>.",
+			dependsOn: ["check"]
+		}),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(WhoamiCommand);
+		await runWithTiming(flags.time, async () => {
+			const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+				apiKey: flags["api-key"],
+				apiBaseUrl: flags["api-base-url"],
+				configDir: this.config.configDir
+			});
+			if (auth.connectedAgent && flags.check !== void 0) throw new Errors.CLIError("--check needs a live account credential. A selected connected-agent profile is shown offline; rerun with `PRIMITIVE_AGENT_PROFILE=` in front of the command to check the member login.", { exit: 1 });
+			if (auth.connectedAgent) {
+				const identity = auth.connectedAgent;
+				const statusCommand = `${cliInvocation(process.argv[1])} agent connect --profile ${identity.profileName} --status --json`;
+				const receiver = receiverStatusCommand(this.config.configDir, identity.profileName);
+				const guidance = `Saved identity only. Live authentication, app pairing, and receiving readiness are not verified. Inspect the ${receiver.mode === "external" ? "Claude hook receiver" : receiver.mode === "poll" ? "poll receiver" : "receiver"} with \`${receiver.command}\`.`;
+				const source = agentIdentitySource(identity);
+				const selectedBy = source === "session_hook" ? `this Claude Code session's start hook (PRIMITIVE_AGENT_PROFILE=${identity.profileName})` : `PRIMITIVE_AGENT_PROFILE=${identity.profileName}`;
+				this.log(flags.json ? JSON.stringify({
+					address: identity.agentAddress,
+					profile: identity.profileName,
+					source,
+					auth_method: "agent_connection",
+					verification: "offline",
+					identity,
+					status_command: statusCommand,
+					guidance
+				}, null, 2) : `${identity.agentAddress}\nSelected by: ${selectedBy}. Prefix a command with \`PRIMITIVE_AGENT_PROFILE=\` to run it as the member login instead.\nSaved connected-agent profile: ${identity.profileName}\nAgent address: ${identity.agentAddress}\nOwner personal address (send reports here): ${identity.ownerMemberAddress ?? "unknown; reply to the member who wrote to you"}\nControl address (setup and presence only): ${identity.ownerAddress}\nAPI origin: ${identity.apiBaseUrl}\n${guidance}\nSaved profile status: ${statusCommand}`);
+				return;
+			}
+			if (isConnectedChatCredential(auth.apiKey)) throw new Errors.CLIError("This connection credential cannot inspect an account. Select its saved profile with PRIMITIVE_AGENT_PROFILE to inspect the connected identity offline.", { exit: 1 });
+			if (flags.check !== void 0) {
+				const check = flags.check.trim();
+				if (!/^[a-z][a-z0-9_.]*:[a-z][a-z0-9_]*$/.test(check)) throw new Errors.CLIError(`--check ${JSON.stringify(flags.check)} is not a permission. Permissions look like \`mail:send\`.`, { exit: 2 });
+				const { identity, error } = await fetchCallerIdentity(apiClient.client, {
+					check,
+					...flags.resource ? { resource: flags.resource.trim() } : {}
+				});
+				if (error) {
+					const errorPayload = extractErrorPayload(error);
+					writeErrorWithHints(errorPayload);
+					surfaceUnauthorizedHint({
+						auth,
+						baseUrlOverridden,
+						configDir: this.config.configDir,
+						payload: errorPayload
+					});
+					process.exitCode = 1;
+					return;
+				}
+				const decision = identity?.check;
+				if (!decision) throw new Errors.CLIError("This Primitive server does not answer permission checks.", { exit: 1 });
+				this.log(flags.json ? JSON.stringify(decision, null, 2) : formatPermissionCheck(decision));
+				if (!decision.allow) process.exitCode = 1;
+				return;
+			}
+			const result = await getAccount({
+				client: apiClient.client,
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const errorPayload = extractErrorPayload(result.error);
+				const own = isGrantRefusal(errorPayload) ? await fetchOwnGrant(apiClient.client) : null;
+				if (own) {
+					const orgName = auth.credentials?.org_id === own.org_id ? auth.credentials.org_name ?? null : null;
+					this.log(flags.json ? JSON.stringify({
+						account: null,
+						...own,
+						org_name: orgName
+					}, null, 2) : formatOwnGrantSummary(own, orgName));
+					return;
+				}
+				writeErrorWithHints(errorPayload);
+				surfaceUnauthorizedHint({
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir,
+					payload: errorPayload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			const account = result.data?.data;
+			if (!account) {
+				process.stderr.write("Server returned an empty account body; this should not happen for a valid key.\n");
+				throw new Errors.CLIError("unexpected empty response");
+			}
+			let managedInboxDomain = null;
+			try {
+				const domainsResult = await listDomains({
+					client: apiClient.client,
+					responseStyle: "fields"
+				});
+				if (!domainsResult.error) managedInboxDomain = (domainsResult.data?.data ?? []).find((row) => row.verified && row.managed_zone !== null)?.domain ?? null;
+			} catch {}
+			const orgName = auth.credentials?.org_id === account.id ? auth.credentials.org_name ?? null : null;
+			const session = guardedSession(void 0, process.env);
+			let registration = null;
+			try {
+				registration = session ? failedSessionRegistration(this.config.configDir, session) : null;
+			} catch {
+				registration = null;
+			}
+			let identity = null;
+			if (!flags.json || flags.grant) try {
+				identity = (await fetchCallerIdentity(apiClient.client, { include: "grant" })).identity;
+			} catch {
+				identity = null;
+			}
+			if (flags.json) {
+				this.log(JSON.stringify({
+					...account,
+					managed_inbox_domain: managedInboxDomain,
+					org_name: orgName,
+					...registration ? { session_registration: registration } : {},
+					...flags.grant ? {
+						grant: identity?.grant ?? null,
+						org_id: identity?.org_id ?? null,
+						role: identity?.role ?? null
+					} : {}
+				}, null, 2));
+				return;
+			}
+			const summary = [formatWhoamiSummary(account, managedInboxDomain, orgName, identity)];
+			if (identity?.grant) summary.push(...formatGrantLines(identity, {
+				orgName: auth.credentials?.org_name ?? null,
+				userLogin: auth.credentials?.auth_method === "user_grant"
+			}).filter((line) => !line.startsWith("Organization:")));
+			this.log(summary.join("\n"));
+			if (registration) this.log(registrationSummaryLine(registration));
+		});
+	}
+};
+// src/oclif/key-permissions.ts
+const KEY_PERMISSION_AREAS = [
+	{
+		label: "Mail",
+		permissions: [
+			"mail:read",
+			"changes:read",
+			"mail.search:semantic",
+			"mail:send",
+			"mail:send_batch",
+			"mail:reply",
+			"mail:signal",
+			"mail.state:write",
+			"mail:delete",
+			"mail.compat:use"
+		]
+	},
+	{
+		label: "Raw mail",
+		permissions: ["mail.raw:read"]
+	},
+	{
+		label: "Scheduled and repeating sends",
+		permissions: ["sent:manage", "sent:cancel"]
+	},
+	{
+		label: "Thread mutes",
+		permissions: ["threads:mute"]
+	},
+	{
+		label: "App sync state",
+		permissions: ["mail_sync:manage"]
+	},
+	{
+		label: "Endpoints and webhooks",
+		permissions: [
+			"webhooks:read",
+			"endpoints:manage",
+			"endpoints.pull:manage",
+			"webhooks:replay"
+		]
+	},
+	{
+		label: "Recipient routes",
+		permissions: ["routes:manage"]
+	},
+	{
+		label: "Filters",
+		permissions: ["filters:manage"]
+	},
+	{
+		label: "Domains",
+		permissions: ["domains:read", "domains:manage"]
+	},
+	{
+		label: "Account",
+		permissions: [
+			"org:read",
+			"account:manage",
+			"account:claim",
+			"credentials:revoke_self"
+		]
+	},
+	{
+		label: "Own activity",
+		permissions: ["activity:read_self"]
+	},
+	{
+		label: "Webhook signing secret",
+		permissions: ["webhook_secret:read", "webhook_secret:manage"]
+	},
+	{
+		label: "Functions",
+		permissions: [
+			"functions:read",
+			"functions:manage",
+			"functions:deploy",
+			"github:manage",
+			"templates:install"
+		]
+	},
+	{
+		label: "Secrets",
+		permissions: ["secrets:manage"]
+	},
+	{
+		label: "Contacts",
+		permissions: [
+			"contacts:read",
+			"contacts:write",
+			"contacts:delete",
+			"agent_contacts:manage"
+		]
+	},
+	{
+		label: "Address notes",
+		permissions: [
+			"notes:read",
+			"notes:write",
+			"notes:delete"
+		]
+	},
+	{
+		label: "Memories",
+		permissions: ["memories:read", "memories:write"]
+	},
+	{
+		label: "Payloads",
+		permissions: ["payloads:read", "payloads:write"]
+	},
+	{
+		label: "Interactions",
+		permissions: [
+			"interactions:read",
+			"interactions:send",
+			"interactions:advance"
+		]
+	},
+	{
+		label: "Wake",
+		permissions: ["wake:manage"]
+	},
+	{
+		label: "Credits",
+		permissions: ["credits:read", "credits:redeem"]
+	},
+	{
+		label: "Push devices",
+		permissions: ["push_devices:manage"]
+	}
+];
+/** Held only by a key that reaches every mailbox (--all-mailboxes). */
+const EVERY_MAILBOX_KEY_PERMISSIONS = ["members:read"];
+/** The permissions a key can hold, by area, for --help-full. */
+function keyPermissionsHelp() {
+	return `Permissions a key can hold, by area, as this CLI version lists them (the API decides, and a key never holds more than you do): ${KEY_PERMISSION_AREAS.map((area) => `${area.label}: ${area.permissions.join(", ")}.`).join(" ")} Only a key that reaches every mailbox (--all-mailboxes) can also hold ${EVERY_MAILBOX_KEY_PERMISSIONS.join(", ")}.`;
+}
+/** How long the refusal hint waits on the permission check. */
+const CHECK_TIMEOUT_MS = 5e3;
+/**
+* The permission a refusal says cannot be granted to a key, or null for any
+* other refusal.
+*/
+function ungrantablePermission(payload) {
+	const error = extractErrorPayload(payload);
+	if (extractErrorCode(error) !== "validation_error") return null;
+	const message = error && typeof error === "object" ? error.message : void 0;
+	if (typeof message !== "string") return null;
+	return /^(.+) cannot be granted to a key$/.exec(message.trim())?.[1] ?? null;
+}
+/**
+* Whether the API knows `name` as a permission at all: GET /whoami?check
+* answers a check for any permission it knows and refuses any other name
+* with "unknown permission". Null when the answer says neither, or does not
+* come in time: the hint never holds the command up for longer than that.
+*/
+async function isKnownPermission(client, name) {
+	let timer;
+	const late = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(null), CHECK_TIMEOUT_MS);
+	});
+	try {
+		return await Promise.race([checkPermission(client, name), late]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+async function checkPermission(client, name) {
+	try {
+		const { identity, error } = await fetchCallerIdentity(client, { check: name }, {
+			fetch: (input, init) => globalThis.fetch(input, init),
+			signal: AbortSignal.timeout(CHECK_TIMEOUT_MS)
+		});
+		if (error) {
+			const payload = extractErrorPayload(error);
+			const message = payload && typeof payload === "object" ? payload.message : void 0;
+			return extractErrorCode(payload) === "validation_error" && typeof message === "string" && message.startsWith("unknown permission") ? false : null;
+		}
+		return identity?.check ? true : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The hint after "<name> cannot be granted to a key": whether the name is
+* not a permission at all or is one a key cannot hold, then what a key can
+* hold, as this CLI lists it. `asked` is the permissions the command asked
+* for, when the request also carried others (an update sends the key's own
+* permissions too), so a refusal of one the key already holds says so.
+*/
+async function ungrantablePermissionHint(client, name, asked) {
+	const known = await isKnownPermission(client, name);
+	const what = known === false ? `${name} is not a permission.` : known === true ? `${name} is a permission, but an API key cannot hold it.` : `${name} is not a permission an API key can hold.`;
+	if (asked && !asked.includes(name)) return `Hint: ${what} The key already holds it, so this change cannot keep it: take it off with --remove ${name}.`;
+	if (KEY_PERMISSION_AREAS.some((area) => area.permissions.includes(name)) || EVERY_MAILBOX_KEY_PERMISSIONS.includes(name)) return `Hint: ${what} This CLI's list of the permissions a key can hold still names it, so the list is older than the API's: update the CLI.`;
+	return `Hint: ${what} As this CLI version lists them, a key can hold ${KEY_PERMISSION_AREAS.flatMap((area) => area.permissions).join(", ")}, and, only when it reaches every mailbox, ${EVERY_MAILBOX_KEY_PERMISSIONS.join(", ")}. \`primitive keys create --help-full\` lists them by area.`;
+}
 // src/oclif/commands/keys.ts
 const STORE_SECRET_NOTICE = "Store this key now. It is shown only once, and the CLI does not save it.";
 const HELD_REQUEST_NOTICE = "A request already held open with this key, such as a long poll or a wait, ends once because the key's permissions changed. Run it again to use the new permissions.";
@@ -73873,11 +74671,12 @@ function describePermissions(grant) {
 	const permissions = grant.permissions ?? [];
 	return permissions.length > 0 ? permissions.join(", ") : "none";
 }
-function formatKeyRows(rows) {
-	if (rows.length === 0) return "No API keys.";
+function formatKeyRows(rows, options = {}) {
+	if (rows.length === 0) return options.includeRevoked ? "No API keys, revoked or not." : "No API keys. Revoked keys are left out; pass --include-revoked to list them too.";
 	return rows.map((row) => {
-		const suspended = row.suspended ? " [suspended]" : "";
-		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}`;
+		const suspended = row.suspended && row.status !== "revoked" ? " [suspended]" : "";
+		const revoked = row.status === "revoked" ? ` [revoked${row.revoked_at ? ` ${row.revoked_at}` : ""}]` : "";
+		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}${revoked}`;
 	}).join("\n");
 }
 function formatKeyDetail(key) {
@@ -74131,9 +74930,11 @@ async function authenticate(command, flags) {
 	});
 }
 /** Print a refusal and set a failing exit code. */
-function reportKeysError(command, outcome, auth, json) {
+async function reportKeysError(command, outcome, auth, json, askedPermissions) {
 	if (json) process.stderr.write(`${JSON.stringify(outcome.payload)}\n`);
 	else writeErrorWithHints(outcome.payload);
+	const ungrantable = ungrantablePermission(outcome.payload);
+	if (ungrantable) process.stderr.write(`${await ungrantablePermissionHint(auth.apiClient.client, ungrantable, askedPermissions)}\n`);
 	if (outcome.stepUpUrl) process.stderr.write(approveThenRerunHint(outcome.stepUpUrl));
 	surfaceUnauthorizedHint({
 		auth: auth.auth,
@@ -74149,26 +74950,37 @@ function writeWarnings(warnings) {
 var KeysListCommand = class KeysListCommand extends Command {
 	static description = `List the organization's API keys with their permissions, mail scope, expiry and last use. Only metadata is shown, never a secret.
 
-  You see your own keys, and every key if your role may read them all, as in the dashboard.`;
+  You see your own keys, and every key if your role may read them all, as in the dashboard.
+
+  Revoked keys are left out unless you pass --include-revoked, which lists them too, each marked [revoked] with when it was revoked. With --json, a revoked key has status "revoked", revoked_at and revoked_by. That confirms a revocation without having noted the key ids beforehand.`;
 	static summary = "List API keys";
-	static examples = ["<%= config.bin %> keys list", "<%= config.bin %> keys list --json"];
+	static examples = [
+		"<%= config.bin %> keys list",
+		"<%= config.bin %> keys list --json",
+		"<%= config.bin %> keys list --include-revoked"
+	];
 	static flags = {
 		"api-key": API_KEY_FLAG$1,
 		"api-base-url": API_BASE_URL_FLAG$2,
+		"include-revoked": Flags.boolean({ description: "List revoked keys too, each marked [revoked] with when it was revoked." }),
 		json: Flags.boolean({ description: "Print the keys as JSON." })
 	};
 	async run() {
 		const { flags } = await this.parse(KeysListCommand);
+		const includeRevoked = flags["include-revoked"] === true;
 		const auth = await authenticate(this, flags);
 		const items = [];
 		let cursor;
 		for (let page = 0; page < LIST_PAGE_LIMIT; page += 1) {
 			const result = await call(listKeys({
 				client: auth.apiClient.client,
-				...cursor ? { query: { cursor } } : {}
+				query: {
+					cursor,
+					include_revoked: includeRevoked ? "true" : void 0
+				}
 			}));
 			if (!result.ok) {
-				reportKeysError(this, result, auth, Boolean(flags.json));
+				await reportKeysError(this, result, auth, Boolean(flags.json));
 				return;
 			}
 			items.push(...result.data.items);
@@ -74179,7 +74991,7 @@ var KeysListCommand = class KeysListCommand extends Command {
 			this.log(JSON.stringify(items, null, 2));
 			return;
 		}
-		this.log(formatKeyRows(items));
+		this.log(formatKeyRows(items, { includeRevoked }));
 	}
 };
 var KeysGetCommand = class KeysGetCommand extends Command {
@@ -74203,7 +75015,7 @@ var KeysGetCommand = class KeysGetCommand extends Command {
 			path: { id: args.id }
 		}));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
 		this.log(flags.json ? JSON.stringify(result.data, null, 2) : formatKeyDetail(result.data));
@@ -74229,7 +75041,9 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 
   The secret is printed once, on its own line on stdout (in the JSON with --json). Store it right away: it is not shown again and the CLI does not save it.
 
-  A key limited to email rules (--rule, repeatable) reaches only the mail those rules match. Give it mail:read with --permission, or use --preset own_addresses_read_only.`;
+  A key limited to email rules (--rule, repeatable) reaches only the mail those rules match. Give it mail:read with --permission, or use --preset own_addresses_read_only.
+
+  ${keyPermissionsHelp()}`;
 	static summary = "Create an API key";
 	static examples = [
 		"<%= config.bin %> keys create --name reader --preset read_only",
@@ -74246,7 +75060,7 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 			options: [...KEY_PRESETS]
 		}),
 		permission: Flags.string({
-			description: "A permission the key holds (repeatable, or comma-separated), for a custom key.",
+			description: "A permission the key holds (repeatable, or comma-separated), for a custom key. See --help-full for the permissions a key can hold.",
 			multiple: true
 		}),
 		address: Flags.string({
@@ -74301,7 +75115,7 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 			}
 		})), approvalIo(flags));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
 		const key = result.data;
@@ -74372,7 +75186,7 @@ var KeysRotateCommand = class KeysRotateCommand extends Command {
 			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
 		})), approvalIo(flags));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
 		const rotated = result.data;
@@ -74382,7 +75196,7 @@ var KeysRotateCommand = class KeysRotateCommand extends Command {
 var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 	static description = `Change an API key's permissions, email rules, name or expiry. It keeps its id and secret.
 
-  --add and --remove take permissions (repeatable, or comma-separated). --add-rule and --remove-rule add email rules to the key or take them off, and keep its other rules. --rule replaces every rule the key has with the ones given, so pass all the rules it should keep; it cannot be combined with --add-rule or --remove-rule. --expires-at gives it a new expiry: a later one extends it, within your organization's credential policy, and is how to keep a key working past its expiry (rotating keeps the expiry). --no-expiry removes it where the policy allows. An expired key cannot be extended. Everything else about the key stays as it is, and the output lists any rules a change took off.
+  --add and --remove take permissions (repeatable, or comma-separated); \`primitive keys create --help-full\` lists the permissions a key can hold. --add-rule and --remove-rule add email rules to the key or take them off, and keep its other rules. --rule replaces every rule the key has with the ones given, so pass all the rules it should keep; it cannot be combined with --add-rule or --remove-rule. --expires-at gives it a new expiry: a later one extends it, within your organization's credential policy, and is how to keep a key working past its expiry (rotating keeps the expiry). --no-expiry removes it where the policy allows. An expired key cannot be extended. Everything else about the key stays as it is, and the output lists any rules a change took off.
 
   The change runs directly; if your organization requires approval, the command prints the approval link and takes --step-up-token, as for a new key. A key never holds more than you do.
 
@@ -74412,7 +75226,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 			multiple: true
 		}),
 		rule: Flags.string({
-			description: "An email rule id the key reaches (repeatable, or comma-separated). Replaces every rule the key has: pass all the rules it should keep, or use --add-rule and --remove-rule.",
+			description: "Replaces the key's rules with these email rule ids. Pass every rule it should keep (repeatable, or comma-separated), or use --add-rule and --remove-rule, which keep its other rules.",
 			multiple: true,
 			exclusive: ["add-rule", "remove-rule"]
 		}),
@@ -74470,7 +75284,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 				path: { id: args.id }
 			}));
 			if (!current.ok) {
-				reportKeysError(this, current, auth, Boolean(flags.json));
+				await reportKeysError(this, current, auth, Boolean(flags.json));
 				return;
 			}
 			if (current.data.status === "revoked") this.error(`Key ${args.id} is revoked, so it cannot be changed.`, { exit: 1 });
@@ -74511,7 +75325,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
 		})), approvalIo(flags));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json), add);
 			return;
 		}
 		const grantChanged = result.data.changed.includes("grant");
@@ -74597,7 +75411,7 @@ var KeysRevokeCommand = class KeysRevokeCommand extends Command {
 			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
 		})), approvalIo(flags));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
 		if (flags.json) {
@@ -83161,7 +83975,9 @@ var SendCommand = class SendCommand extends Command {
   \`primitive account whoami\` reports) when you may send from it; a key
   whose grant names exactly one address sends from that address. Otherwise
   there is no default: the command lists the addresses you may send from
-  and asks for --from. Without --json, stderr names the From it used.
+  and asks for --from. A credential without mail:send is refused with
+  grant_forbidden naming mail:send instead, since no --from would help.
+  Without --json, stderr names the From it used.
   --subject defaults to the first line of the body when omitted.
   --attachment attaches a file; repeat it to attach multiple files.
   --header adds a custom header such as "X-Campaign-Id: spring-sale";
@@ -83216,7 +84032,7 @@ var SendCommand = class SendCommand extends Command {
 			description: "Recipient address (e.g. alice@example.com).",
 			required: true
 		}),
-		from: Flags.string({ description: "Sender address. Without it: a connected agent's own address, your member address on your own login, or a key's one granted address; otherwise the command asks for --from." }),
+		from: Flags.string({ description: "Sender address. Without it: a connected agent's own address, your member address on your own login, or a key's one granted address; otherwise the command asks for --from, except that a credential without mail:send is refused by that permission." }),
 		subject: Flags.string({ description: "Subject line. Defaults to the first line of --body / --html when omitted." }),
 		body: Flags.string({ description: "Plain-text message body. Either --body or --html (or both) is required." }),
 		"body-file": Flags.string({ description: "Read the plain-text message body from a UTF-8 file. This does not attach the file; use --attachment for file attachments. Mutually exclusive with --body and --body-stdin." }),
@@ -84625,6 +85441,11 @@ const WAIT_EXIT_CODES = {
 const MAX_LONG_POLL_SECONDS = 30;
 const TAIL_PAGE_SIZE = 100;
 const EXISTING_PAGE_SIZE = 50;
+/**
+* Pages of mail made visible since the start that are read before the
+* long-poll; any more are walked by the long-poll itself.
+*/
+const SINCE_START_PAGES = 5;
 const PRINTED_BODY_CHARS = 1200;
 const JSON_TEXT_CHARS = 4e3;
 /**
@@ -84765,9 +85586,20 @@ async function firstMatch(api, apiClient, rows, filters, seen) {
 	}
 	return null;
 }
-function arrivedSince(row, threshold) {
-	const at = Date.parse(str(row.created_at) ?? str(row.received_at) ?? "");
-	return Number.isFinite(at) && at >= threshold;
+/**
+* The forward-tail cursor for an instant, on the client clock: the tail
+* returns what became visible after it.
+*/
+function tailCursorAt(at) {
+	return `${new Date(at).toISOString().replace(/Z$/, "000Z")}|${TIME_CURSOR_ID}`;
+}
+/**
+* Whether tail cursor `a` sorts before `b`. A cursor's time is microseconds
+* from the tail and milliseconds from a list row, so it is padded first.
+*/
+function cursorBefore(a, b) {
+	const pad = (cursor) => cursor.replace(/(\.\d{3})Z\|/, "$1000Z|");
+	return pad(a) < pad(b);
 }
 /**
 * Block until an email matching `filters` arrives (or, with
@@ -84795,11 +85627,21 @@ async function tailForEmail(api, params) {
 		apiClient,
 		api
 	});
-	const recent = await listRows(api, apiClient, { limit: EXISTING_PAGE_SIZE });
-	const early = await firstMatch(api, apiClient, recent.rows.filter((row) => arrivedSince(row, params.startedAt)).reverse(), filters, seen);
-	if (early) return early;
+	let fromStart = tailCursorAt(params.startedAt);
+	let caughtUp = false;
+	for (let read = 0; read < SINCE_START_PAGES && !caughtUp; read += 1) {
+		const page = await listRows(api, apiClient, {
+			limit: TAIL_PAGE_SIZE,
+			since: fromStart
+		});
+		const early = await firstMatch(api, apiClient, page.rows, filters, seen);
+		if (early) return early;
+		if (page.rows.length < TAIL_PAGE_SIZE || !page.cursor) caughtUp = true;
+		else fromStart = page.cursor;
+	}
+	if (!caughtUp && cursorBefore(fromStart, since)) since = fromStart;
 	if (params.includeExisting) {
-		const found = await firstMatch(api, apiClient, recent.rows, filters, seen);
+		const found = await firstMatch(api, apiClient, (await listRows(api, apiClient, { limit: EXISTING_PAGE_SIZE })).rows, filters, seen);
 		if (found) return found;
 	}
 	for (;;) {
@@ -85592,265 +86434,6 @@ var WakeSchedulesUpdateCommand = class WakeSchedulesUpdateCommand extends Comman
 		});
 	}
 };
-// src/oclif/commands/whoami.ts
-/**
-* `GET /whoami` with its grant query parameters. A server without grants
-* ignores them and answers without `grant` or `check`.
-*/
-async function fetchCallerIdentity(client, query) {
-	const result = await client.get({
-		query,
-		responseStyle: "fields",
-		security: [{
-			scheme: "bearer",
-			type: "http"
-		}],
-		url: "/whoami"
-	});
-	if (result.error) return {
-		identity: null,
-		error: result.error
-	};
-	return {
-		identity: result.data?.data ?? null,
-		error: null
-	};
-}
-function formatGrant(grant) {
-	const lines = [`Grant: ${grant.template ? `template ${grant.template}` : `${grant.grant_type ?? "grant"} with ${grant.permissions.length} permissions`}, ${grant.mail_scope === "org" || grant.mail_scope === void 0 ? "all mail in the organization" : "a narrowed mail scope"} (${grant.credential_kind})`];
-	if (grant.expires_at) lines.push(`Credential expires: ${grant.expires_at}`);
-	return lines;
-}
-/** Lines describing the caller's organization, role and grant. */
-function formatGrantLines(identity, options = {}) {
-	const lines = [];
-	const org = options.orgName ? `${options.orgName} (${identity.org_id})` : identity.org_id;
-	lines.push(`Organization: ${org}`);
-	if (isPersonIdentity(identity)) lines.push(identity.role === "member" ? "Built-in role: member (also shown for a template or custom role that does not fully include member; the Grant line is what this login can do)" : isBuiltInRoleKey(identity.role) ? `Built-in role: ${identity.role}` : `Role key: ${identity.role}`);
-	const grant = identity.grant;
-	if (grant) lines.push(...formatGrant(grant));
-	if (options.userLogin) lines.push("Signed in as yourself. Switch organizations with `primitive org use <org>`.");
-	return lines;
-}
-function formatPermissionCheck(check) {
-	if (check.allow) return `${check.permission}: allowed`;
-	return `${check.permission}: not allowed${check.reason ? ` (${check.reason})` : ""}`;
-}
-/** Whether GET /whoami answered for an API key. */
-function isKeyIdentity(identity) {
-	return Boolean(identity.key_id) || identity.auth_method === "api_key";
-}
-/** Whether GET /whoami answered for a person's own session or OAuth login. */
-const PERSON_AUTH_METHODS = /* @__PURE__ */ new Set([
-	"oauth",
-	"session",
-	"dashboard_bridge"
-]);
-function isPersonIdentity(identity) {
-	return !isKeyIdentity(identity) && typeof identity.auth_method === "string" && PERSON_AUTH_METHODS.has(identity.auth_method);
-}
-/** What the summary's first line says about who is calling. */
-function identityLine(identity) {
-	if (!identity || identity.member_address === void 0) return "Authenticated";
-	if (identity.member_address) return `Authenticated as ${identity.member_address.address} (your member address)`;
-	if (isKeyIdentity(identity)) return "Authenticated (API keys have no member address)";
-	if (!isPersonIdentity(identity)) return "Authenticated (this credential has no member address)";
-	return `Authenticated (you have no member address in this organization${identity.member_address_suggestion ? `; \`primitive account provision-member-address --address ${identity.member_address_suggestion}\` sets one` : ""})`;
-}
-function formatWhoamiSummary(account, managedInboxDomain, orgName = null, identity = null) {
-	const lines = [
-		identityLine(identity),
-		orgName ? `Organization: ${orgName} (${account.id})` : `Organization id: ${account.id}`,
-		...account.email ? [`Account email: ${account.email} (the email the account was opened with)`] : [],
-		`Plan: ${account.plan}`
-	];
-	if (managedInboxDomain) lines.push(`Managed inbox: any-local-part@${managedInboxDomain}`);
-	return lines.join("\n");
-}
-/** `GET /whoami/grant`, which any credential may ask about itself. */
-async function fetchOwnGrant(client) {
-	try {
-		const result = await getOwnGrant({
-			client,
-			responseStyle: "fields"
-		});
-		if (result.error) return null;
-		return result.data?.data ?? null;
-	} catch {
-		return null;
-	}
-}
-/** The summary for a valid credential whose grant cannot read the account. */
-function formatOwnGrantSummary(own, orgName) {
-	return [
-		"Authenticated. This credential cannot read the account (it lacks org:read).",
-		orgName ? `Organization: ${orgName} (${own.org_id})` : `Organization id: ${own.org_id}`,
-		...own.grant ? formatGrant(own.grant) : []
-	].join("\n");
-}
-var WhoamiCommand = class WhoamiCommand extends Command {
-	static description = `Print the account currently authenticated by saved OAuth credentials or an explicit API key. For account credentials this is a live credentials smoke test. Use account whoami for the authenticated caller, their assigned member address and an address suggestion; account provision-member-address --address <email> saves your chosen personal address.
-
-  With PRIMITIVE_AGENT_PROFILE selected, print the saved connected-agent identity offline, with no API call. The first line is the agent's email address alone; --json adds address, profile and source (session_hook when the selected profile is this Claude Code session's own agent exported by the session start hook, env otherwise). This does not verify live authentication, app pairing, or listener readiness. Inspect the receiver separately: the output names the command for the profile's receiver mode (agent connect --status for Claude hook and poll receivers, listen --status --notify-session for a native listener).
-
-  The default output is a concise human summary. Pass --json for the full /account response or the explicit offline connected-agent identity envelope.`;
-	static summary = "Print the live account or saved connected-agent identity";
-	static examples = [
-		"<%= config.bin %> whoami",
-		"<%= config.bin %> whoami --api-key prim_...",
-		"<%= config.bin %> whoami --json | jq .id",
-		"PRIMITIVE_AGENT_PROFILE=work <%= config.bin %> whoami --json"
-	];
-	static flags = {
-		"api-key": Flags.string({
-			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
-			env: "PRIMITIVE_API_KEY"
-		}),
-		"api-base-url": Flags.string({
-			description: API_BASE_URL_FLAG_DESCRIPTION,
-			env: "PRIMITIVE_API_BASE_URL",
-			hidden: true
-		}),
-		json: Flags.boolean({ description: "Print the account JSON response, or the saved connected identity marked verification: offline. Never prints credentials." }),
-		grant: Flags.boolean({ description: "With --json, add `grant`: the organization, role and grant of this credential. The summary shows them when the server reports them; only a person's own login has a role line." }),
-		check: Flags.string({ description: "Ask whether this credential may use a permission, such as mail:send. Prints the decision and exits 1 when it is not allowed. Nothing is enforced by asking." }),
-		resource: Flags.string({
-			description: "With --check, the resource to check against, as function:<id>, domain:<id>, endpoint:<id> or route:<id>.",
-			dependsOn: ["check"]
-		}),
-		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
-	};
-	async run() {
-		const { flags } = await this.parse(WhoamiCommand);
-		await runWithTiming(flags.time, async () => {
-			const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
-				apiKey: flags["api-key"],
-				apiBaseUrl: flags["api-base-url"],
-				configDir: this.config.configDir
-			});
-			if (auth.connectedAgent && flags.check !== void 0) throw new Errors.CLIError("--check needs a live account credential. A selected connected-agent profile is shown offline; rerun with `PRIMITIVE_AGENT_PROFILE=` in front of the command to check the member login.", { exit: 1 });
-			if (auth.connectedAgent) {
-				const identity = auth.connectedAgent;
-				const statusCommand = `${cliInvocation(process.argv[1])} agent connect --profile ${identity.profileName} --status --json`;
-				const receiver = receiverStatusCommand(this.config.configDir, identity.profileName);
-				const guidance = `Saved identity only. Live authentication, app pairing, and receiving readiness are not verified. Inspect the ${receiver.mode === "external" ? "Claude hook receiver" : receiver.mode === "poll" ? "poll receiver" : "receiver"} with \`${receiver.command}\`.`;
-				const source = agentIdentitySource(identity);
-				const selectedBy = source === "session_hook" ? `this Claude Code session's start hook (PRIMITIVE_AGENT_PROFILE=${identity.profileName})` : `PRIMITIVE_AGENT_PROFILE=${identity.profileName}`;
-				this.log(flags.json ? JSON.stringify({
-					address: identity.agentAddress,
-					profile: identity.profileName,
-					source,
-					auth_method: "agent_connection",
-					verification: "offline",
-					identity,
-					status_command: statusCommand,
-					guidance
-				}, null, 2) : `${identity.agentAddress}\nSelected by: ${selectedBy}. Prefix a command with \`PRIMITIVE_AGENT_PROFILE=\` to run it as the member login instead.\nSaved connected-agent profile: ${identity.profileName}\nAgent address: ${identity.agentAddress}\nOwner personal address (send reports here): ${identity.ownerMemberAddress ?? "unknown; reply to the member who wrote to you"}\nControl address (setup and presence only): ${identity.ownerAddress}\nAPI origin: ${identity.apiBaseUrl}\n${guidance}\nSaved profile status: ${statusCommand}`);
-				return;
-			}
-			if (isConnectedChatCredential(auth.apiKey)) throw new Errors.CLIError("This connection credential cannot inspect an account. Select its saved profile with PRIMITIVE_AGENT_PROFILE to inspect the connected identity offline.", { exit: 1 });
-			if (flags.check !== void 0) {
-				const check = flags.check.trim();
-				if (!/^[a-z][a-z0-9_.]*:[a-z][a-z0-9_]*$/.test(check)) throw new Errors.CLIError(`--check ${JSON.stringify(flags.check)} is not a permission. Permissions look like \`mail:send\`.`, { exit: 2 });
-				const { identity, error } = await fetchCallerIdentity(apiClient.client, {
-					check,
-					...flags.resource ? { resource: flags.resource.trim() } : {}
-				});
-				if (error) {
-					const errorPayload = extractErrorPayload(error);
-					writeErrorWithHints(errorPayload);
-					surfaceUnauthorizedHint({
-						auth,
-						baseUrlOverridden,
-						configDir: this.config.configDir,
-						payload: errorPayload
-					});
-					process.exitCode = 1;
-					return;
-				}
-				const decision = identity?.check;
-				if (!decision) throw new Errors.CLIError("This Primitive server does not answer permission checks.", { exit: 1 });
-				this.log(flags.json ? JSON.stringify(decision, null, 2) : formatPermissionCheck(decision));
-				if (!decision.allow) process.exitCode = 1;
-				return;
-			}
-			const result = await getAccount({
-				client: apiClient.client,
-				responseStyle: "fields"
-			});
-			if (result.error) {
-				const errorPayload = extractErrorPayload(result.error);
-				const own = isGrantRefusal(errorPayload) ? await fetchOwnGrant(apiClient.client) : null;
-				if (own) {
-					const orgName = auth.credentials?.org_id === own.org_id ? auth.credentials.org_name ?? null : null;
-					this.log(flags.json ? JSON.stringify({
-						account: null,
-						...own,
-						org_name: orgName
-					}, null, 2) : formatOwnGrantSummary(own, orgName));
-					return;
-				}
-				writeErrorWithHints(errorPayload);
-				surfaceUnauthorizedHint({
-					auth,
-					baseUrlOverridden,
-					configDir: this.config.configDir,
-					payload: errorPayload
-				});
-				process.exitCode = 1;
-				return;
-			}
-			const account = result.data?.data;
-			if (!account) {
-				process.stderr.write("Server returned an empty account body; this should not happen for a valid key.\n");
-				throw new Errors.CLIError("unexpected empty response");
-			}
-			let managedInboxDomain = null;
-			try {
-				const domainsResult = await listDomains({
-					client: apiClient.client,
-					responseStyle: "fields"
-				});
-				if (!domainsResult.error) managedInboxDomain = (domainsResult.data?.data ?? []).find((row) => row.verified && row.managed_zone !== null)?.domain ?? null;
-			} catch {}
-			const orgName = auth.credentials?.org_id === account.id ? auth.credentials.org_name ?? null : null;
-			const session = guardedSession(void 0, process.env);
-			let registration = null;
-			try {
-				registration = session ? failedSessionRegistration(this.config.configDir, session) : null;
-			} catch {
-				registration = null;
-			}
-			let identity = null;
-			if (!flags.json || flags.grant) try {
-				identity = (await fetchCallerIdentity(apiClient.client, { include: "grant" })).identity;
-			} catch {
-				identity = null;
-			}
-			if (flags.json) {
-				this.log(JSON.stringify({
-					...account,
-					managed_inbox_domain: managedInboxDomain,
-					org_name: orgName,
-					...registration ? { session_registration: registration } : {},
-					...flags.grant ? {
-						grant: identity?.grant ?? null,
-						org_id: identity?.org_id ?? null,
-						role: identity?.role ?? null
-					} : {}
-				}, null, 2));
-				return;
-			}
-			const summary = [formatWhoamiSummary(account, managedInboxDomain, orgName, identity)];
-			if (identity?.grant) summary.push(...formatGrantLines(identity, {
-				orgName: auth.credentials?.org_name ?? null,
-				userLogin: auth.credentials?.auth_method === "user_grant"
-			}).filter((line) => !line.startsWith("Organization:")));
-			this.log(summary.join("\n"));
-			if (registration) this.log(registrationSummaryLine(registration));
-		});
-	}
-};
 // src/oclif/fish-completion.ts
 function fishEscape(value) {
 	return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");