primcli 3.0.0-preview.6 → 3.0.0-preview.8

package/dist/{api-command-CRjIK1QL.js → api-command-TUwewvqZ.js}

@@ -1,6 +1,7 @@
-import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-CP0h4alF.js";
+import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-DNbrLjEF.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
+import { a as thrownErrorBody } from "./json-output-ch756TXV.js";
 import { d as readMailJson, h as writeMailJson, m as withMailLock, p as syncMailDirectory, u as privateMailPermissions } from "./shared-mail-files-BAQSGxxz.js";
 import { Args, Command, Errors, Flags } from "@oclif/core";
 import { existsSync, lstatSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
@@ -10556,7 +10557,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "revoke-credential",
-		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true and revoked 0, to a caller who could have revoked it; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
+		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked by the person who holds it, whatever it reaches, or by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. Revoking an API key also revokes the keys it replaced in its rotation that are still in their overlap and that you may revoke (predecessors_revoked_count; predecessors_left counts the rest), so its webhooks stop at once; the keys that replaced it carry its work on. Revoking a key already revoked does the same for those keys. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from, each saying whether anything still acts for it (still_acting, with the key in acting_key_id) and, for a webhook, whether it is still delivering. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true, to a caller who could have revoked it, and revoked counts only the keys it replaced that were revoked now; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "revokeCredential",
@@ -10669,7 +10670,7 @@ const operationManifest = [
 					}
 				},
 				"already_revoked": {
-					"description": "true when the API key was already revoked, so nothing changed and revoked is 0. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
+					"description": "true when the API key was already revoked. revoked then counts only the keys it replaced that were revoked now. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
 					"type": "boolean"
 				},
 				"keep_failed": {
@@ -10702,6 +10703,18 @@ const operationManifest = [
 							"org_owned": {
 								"type": "boolean",
 								"description": "true: the organization owns it, and it keeps working. false: the credential owns it itself, as with everything a third-party app or agent delegate made, a webhook made with a narrowed API key, or a wake schedule made with a key that does not cover super_admin. It keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to or kept it. Revoking a third-party app or agent delegate turns these off, except that a block filter it made keeps blocking, within the reach the app had, unless the person revoking chose to stop it."
+							},
+							"still_acting": {
+								"description": "For an API key: whether anything still acts for it after this revoke (the organization, a key of the same rotation that still works, or whoever took it over). Null when that could not be read.",
+								"type": ["boolean", "null"]
+							},
+							"acting_key_id": {
+								"description": "For an API key: the key that still acts for it, shown to a caller who may read the organization's API keys. Null otherwise, and when no key does.",
+								"type": ["string", "null"]
+							},
+							"delivering": {
+								"description": "For an API key's webhook: whether it is still sent received mail, as GET /v1/endpoints/{id} delivery.delivering says. Null when that could not be read.",
+								"type": ["boolean", "null"]
 							}
 						},
 						"required": [
@@ -10712,6 +10725,28 @@ const operationManifest = [
 						],
 						"additionalProperties": {}
 					}
+				},
+				"predecessors_revoked_count": {
+					"description": "For an API key: how many keys it replaced in its rotation, still in their overlap, were revoked with it. Keys that replaced it never are.",
+					"type": "integer",
+					"minimum": -9007199254740991,
+					"maximum": 9007199254740991
+				},
+				"predecessors_left": {
+					"description": "For an API key: how many such keys were left working because you may not revoke them. They work until their overlap ends.",
+					"type": "integer",
+					"minimum": -9007199254740991,
+					"maximum": 9007199254740991
+				},
+				"predecessors_revoked": {
+					"description": "The ids of the keys counted in predecessors_revoked_count, to a caller who may read the organization's API keys.",
+					"type": "array",
+					"items": { "type": "string" }
+				},
+				"predecessors_not_revoked": {
+					"description": "The ids of the keys counted in predecessors_left, to a caller who may read the organization's API keys.",
+					"type": "array",
+					"items": { "type": "string" }
 				}
 			},
 			"required": [
@@ -10730,7 +10765,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "rotate-key",
-		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "rotateKey",
@@ -10904,7 +10939,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-key",
-		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. The one exception is suspending a key (suspended true with no other change; expected_grant_ref may accompany it), which the person who holds it may do whatever the key reaches, calling as themself rather than through another app; lifting a suspension is a change like any other. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateKey",
@@ -12916,7 +12951,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "accept-email-rule-request",
-		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Made-up emails sent in expectation_samples are kept on the rule this writes, where GET /v1/email-rules/{id} lists them. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "acceptEmailRuleRequest",
@@ -13014,6 +13049,131 @@ const operationManifest = [
 					"type": "string",
 					"minLength": 1,
 					"maxLength": 64
+				},
+				"breadth": {
+					"description": "Ignored (the compile answer's breadth).",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
+				},
+				"expectation_samples": {
+					"description": "Made-up emails the rule must match or not, such as look-alikes it must never match, kept on the rule this accept writes.",
+					"minItems": 1,
+					"maxItems": 20,
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					}
 				}
 			},
 			"additionalProperties": false
@@ -13168,6 +13328,14 @@ const operationManifest = [
 						"decline_reason": {
 							"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 							"type": ["string", "null"]
+						},
+						"edited_on_accept": {
+							"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+							"type": ["boolean", "null"]
+						},
+						"notice": {
+							"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+							"type": ["string", "null"]
 						}
 					},
 					"required": [
@@ -13214,6 +13382,10 @@ const operationManifest = [
 							"type": "string",
 							"enum": ["grant", "do_not_share"]
 						},
+						"protection_note": {
+							"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+							"type": "string"
+						},
 						"evaluation_scope": {
 							"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 							"type": "string",
@@ -13244,10 +13416,37 @@ const operationManifest = [
 							"type": ["integer", "null"],
 							"exclusiveMinimum": 0
 						},
+						"revision": {
+							"description": "Moves on by one with every update. Send it as if_revision.",
+							"type": "integer",
+							"exclusiveMinimum": 0
+						},
 						"author_user_id": {
 							"type": "string",
 							"format": "uuid"
 						},
+						"author": {
+							"type": "object",
+							"properties": {
+								"user_id": {
+									"type": "string",
+									"format": "uuid"
+								},
+								"name": {
+									"description": "Their name; null unless you can list members or this is you, and when they have none set.",
+									"type": ["string", "null"]
+								},
+								"email": {
+									"description": "Sign-in email; null unless you can list member emails or this is you.",
+									"type": ["string", "null"]
+								}
+							},
+							"required": [
+								"user_id",
+								"name",
+								"email"
+							]
+						},
 						"is_author": {
 							"type": "boolean",
 							"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -13260,91 +13459,94 @@ const operationManifest = [
 							"type": "string",
 							"format": "date-time"
 						},
-						"current": { "anyOf": [{
-							"type": "object",
-							"properties": {
-								"version": {
-									"type": "integer",
-									"exclusiveMinimum": 0
-								},
-								"english": { "type": "string" },
-								"tree": {
-									"type": "object",
-									"properties": {
-										"version": {
-											"type": "number",
-											"const": 1
-										},
-										"vocabulary": {
-											"type": "string",
-											"description": "Vocabulary version, such as v1."
-										},
-										"when": {
-											"type": "object",
-											"propertyNames": { "type": "string" },
-											"additionalProperties": {},
-											"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
-										},
-										"questions": {
-											"type": "array",
-											"items": { "type": "string" },
-											"description": "Yes/no questions asked once the conditions match; all must be yes."
-										}
+						"current": {
+							"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+							"anyOf": [{
+								"type": "object",
+								"properties": {
+									"version": {
+										"type": "integer",
+										"exclusiveMinimum": 0
 									},
-									"required": [
-										"version",
-										"vocabulary",
-										"when",
-										"questions"
-									]
-								},
-								"explanation": { "type": "string" },
-								"assumptions": {
-									"type": "array",
-									"items": { "type": "string" }
-								},
-								"warnings": {
-									"type": "array",
-									"items": { "type": "string" }
-								},
-								"compiled_by": {
-									"type": "string",
-									"description": "Who produced the tree, as stated when saved (not verified), such as rule-compiler-v1 or member."
-								},
-								"vocabulary": { "type": "string" },
-								"created_at": {
-									"type": "string",
-									"format": "date-time"
-								},
-								"sql": {
-									"description": "Present only when include_sql was true.",
-									"type": "object",
-									"properties": {
-										"expression": {
-											"type": "string",
-											"description": "A parameterized boolean expression over one row per email."
+									"english": { "type": "string" },
+									"tree": {
+										"type": "object",
+										"properties": {
+											"version": {
+												"type": "number",
+												"const": 1
+											},
+											"vocabulary": {
+												"type": "string",
+												"description": "Vocabulary version, such as v1."
+											},
+											"when": {
+												"type": "object",
+												"propertyNames": { "type": "string" },
+												"additionalProperties": {},
+												"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+											},
+											"questions": {
+												"type": "array",
+												"items": { "type": "string" },
+												"description": "Yes/no questions asked once the conditions match; all must be yes."
+											}
 										},
-										"params": {
-											"type": "array",
-											"items": {},
-											"description": "The values bound to $1, $2 and so on."
-										}
+										"required": [
+											"version",
+											"vocabulary",
+											"when",
+											"questions"
+										]
 									},
-									"required": ["expression", "params"]
-								}
-							},
-							"required": [
-								"version",
-								"english",
-								"tree",
-								"explanation",
-								"assumptions",
-								"warnings",
-								"compiled_by",
-								"vocabulary",
-								"created_at"
-							]
-						}, { "type": "null" }] }
+									"explanation": { "type": "string" },
+									"assumptions": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"warnings": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"compiled_by": {
+										"type": "string",
+										"description": "Who produced the tree, as stated when saved (not verified), such as rule-compiler-v1 or member."
+									},
+									"vocabulary": { "type": "string" },
+									"created_at": {
+										"type": "string",
+										"format": "date-time"
+									},
+									"sql": {
+										"description": "Present only when include_sql was true.",
+										"type": "object",
+										"properties": {
+											"expression": {
+												"type": "string",
+												"description": "A parameterized boolean expression over one row per email."
+											},
+											"params": {
+												"type": "array",
+												"items": {},
+												"description": "The values bound to $1, $2 and so on."
+											}
+										},
+										"required": ["expression", "params"]
+									}
+								},
+								"required": [
+									"version",
+									"english",
+									"tree",
+									"explanation",
+									"assumptions",
+									"warnings",
+									"compiled_by",
+									"vocabulary",
+									"created_at"
+								]
+							}, { "type": "null" }]
+						}
 					},
 					"required": [
 						"id",
@@ -13514,6 +13716,10 @@ const operationManifest = [
 						"rule",
 						"rule_id"
 					]
+				},
+				"notice": {
+					"description": "What is now shared, in words.",
+					"type": "string"
 				}
 			},
 			"required": [
@@ -13613,7 +13819,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "compile-email-rule",
-		"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default), so a warning can say when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to five yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "compileEmailRule",
@@ -13686,7 +13892,7 @@ const operationManifest = [
 				},
 				"explanation": {
 					"type": "string",
-					"description": "What the rule matches, in plain English."
+					"description": "What the rule matches, in plain English: only which emails, not what it grants or shares, which follows from its state, its scope and the keys, webhooks and people it reaches. The compiler leaves out a sentence that plainly says what the rule hands over."
 				},
 				"assumptions": {
 					"type": "array",
@@ -13696,12 +13902,31 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "Parts of the description the column contract cannot express, and how the rule handles them. When the rule reads automated or from_mailing_list, it also has a note on what that column reads and what it misses. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
+					"description": "Parts of the description the column contract cannot express, and how the rule handles them. It also has notes on reading automated, from_mailing_list or sender_relationship, a sender address the description does not give, and a grant worded as a prohibition. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
 				},
 				"compiled_by": {
 					"type": "string",
 					"description": "An opaque name for the version of the rule compiler that produced the rule, such as rule-compiler-v1. Send it back as compiled_by when you save the rule."
 				},
+				"breadth": {
+					"description": "How many of your recent emails its conditions hold for, counted over your own mailboxes whatever scope you save it with, warning or not. Null when not counted in full: a rule with questions, headers-only access, no test of it possible as you, or a count that failed or ran out of time. Writes ignore it, so a compile answer (without include_sql) can be sent back unchanged.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
+				},
 				"sql": {
 					"description": "Present only when include_sql was true.",
 					"type": "object",
@@ -13736,7 +13961,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule",
-		"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated). You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated), or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRule",
@@ -13767,9 +13992,13 @@ const operationManifest = [
 					"enum": ["grant", "do_not_share"]
 				},
 				"state": {
-					"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated.",
+					"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated; active only for a do_not_share rule.",
 					"type": "string",
-					"enum": ["draft", "observe"]
+					"enum": [
+						"draft",
+						"observe",
+						"active"
+					]
 				},
 				"evaluation_scope": {
 					"type": "string",
@@ -13830,6 +14059,112 @@ const operationManifest = [
 					"additionalProperties": false,
 					"description": "Emails it must match and must not (at most 100): a test by rule_id judges them unless expect is given, and each version it saves is checked against them."
 				},
+				"expectation_samples": {
+					"description": "Made-up emails it must match or not (at most 20).",
+					"minItems": 1,
+					"maxItems": 20,
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					}
+				},
 				"english": {
 					"type": "string",
 					"minLength": 1,
@@ -13897,6 +14232,25 @@ const operationManifest = [
 					"type": "string",
 					"minLength": 1,
 					"maxLength": 64
+				},
+				"breadth": {
+					"description": "Ignored (the compile answer's breadth).",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
 				}
 			},
 			"required": [
@@ -13927,6 +14281,10 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
+				"protection_note": {
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+					"type": "string"
+				},
 				"evaluation_scope": {
 					"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 					"type": "string",
@@ -13957,10 +14315,37 @@ const operationManifest = [
 					"type": ["integer", "null"],
 					"exclusiveMinimum": 0
 				},
+				"revision": {
+					"description": "Moves on by one with every update. Send it as if_revision.",
+					"type": "integer",
+					"exclusiveMinimum": 0
+				},
 				"author_user_id": {
 					"type": "string",
 					"format": "uuid"
 				},
+				"author": {
+					"type": "object",
+					"properties": {
+						"user_id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"name": {
+							"description": "Their name; null unless you can list members or this is you, and when they have none set.",
+							"type": ["string", "null"]
+						},
+						"email": {
+							"description": "Sign-in email; null unless you can list member emails or this is you.",
+							"type": ["string", "null"]
+						}
+					},
+					"required": [
+						"user_id",
+						"name",
+						"email"
+					]
+				},
 				"is_author": {
 					"type": "boolean",
 					"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -13973,91 +14358,94 @@ const operationManifest = [
 					"type": "string",
 					"format": "date-time"
 				},
-				"current": { "anyOf": [{
-					"type": "object",
-					"properties": {
-						"version": {
-							"type": "integer",
-							"exclusiveMinimum": 0
-						},
-						"english": { "type": "string" },
-						"tree": {
-							"type": "object",
-							"properties": {
-								"version": {
-									"type": "number",
-									"const": 1
-								},
-								"vocabulary": {
-									"type": "string",
-									"description": "Vocabulary version, such as v1."
-								},
-								"when": {
-									"type": "object",
-									"propertyNames": { "type": "string" },
-									"additionalProperties": {},
-									"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
-								},
-								"questions": {
-									"type": "array",
-									"items": { "type": "string" },
-									"description": "Yes/no questions asked once the conditions match; all must be yes."
-								}
+				"current": {
+					"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "integer",
+								"exclusiveMinimum": 0
 							},
-							"required": [
-								"version",
-								"vocabulary",
-								"when",
-								"questions"
-							]
-						},
-						"explanation": { "type": "string" },
-						"assumptions": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"warnings": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"compiled_by": {
-							"type": "string",
-							"description": "Who produced the tree, as stated when saved (not verified), such as rule-compiler-v1 or member."
-						},
-						"vocabulary": { "type": "string" },
-						"created_at": {
-							"type": "string",
-							"format": "date-time"
-						},
-						"sql": {
-							"description": "Present only when include_sql was true.",
-							"type": "object",
-							"properties": {
-								"expression": {
-									"type": "string",
-									"description": "A parameterized boolean expression over one row per email."
+							"english": { "type": "string" },
+							"tree": {
+								"type": "object",
+								"properties": {
+									"version": {
+										"type": "number",
+										"const": 1
+									},
+									"vocabulary": {
+										"type": "string",
+										"description": "Vocabulary version, such as v1."
+									},
+									"when": {
+										"type": "object",
+										"propertyNames": { "type": "string" },
+										"additionalProperties": {},
+										"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+									},
+									"questions": {
+										"type": "array",
+										"items": { "type": "string" },
+										"description": "Yes/no questions asked once the conditions match; all must be yes."
+									}
 								},
-								"params": {
-									"type": "array",
-									"items": {},
-									"description": "The values bound to $1, $2 and so on."
-								}
+								"required": [
+									"version",
+									"vocabulary",
+									"when",
+									"questions"
+								]
 							},
-							"required": ["expression", "params"]
-						}
-					},
-					"required": [
-						"version",
-						"english",
-						"tree",
-						"explanation",
-						"assumptions",
-						"warnings",
-						"compiled_by",
-						"vocabulary",
-						"created_at"
-					]
-				}, { "type": "null" }] },
+							"explanation": { "type": "string" },
+							"assumptions": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"warnings": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"compiled_by": {
+								"type": "string",
+								"description": "Who produced the tree, as stated when saved (not verified), such as rule-compiler-v1 or member."
+							},
+							"vocabulary": { "type": "string" },
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							},
+							"sql": {
+								"description": "Present only when include_sql was true.",
+								"type": "object",
+								"properties": {
+									"expression": {
+										"type": "string",
+										"description": "A parameterized boolean expression over one row per email."
+									},
+									"params": {
+										"type": "array",
+										"items": {},
+										"description": "The values bound to $1, $2 and so on."
+									}
+								},
+								"required": ["expression", "params"]
+							}
+						},
+						"required": [
+							"version",
+							"english",
+							"tree",
+							"explanation",
+							"assumptions",
+							"warnings",
+							"compiled_by",
+							"vocabulary",
+							"created_at"
+						]
+					}, { "type": "null" }]
+				},
 				"scope_warnings": {
 					"description": "Names in scope_selection that match nothing this organization receives mail at (a typo, or an inbox not yet in use). Present only when there are some.",
 					"type": "array",
@@ -14088,8 +14476,114 @@ const operationManifest = [
 						]
 					}
 				},
+				"expectation_samples": {
+					"description": "Its saved made-up emails, when this write set or added some.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": { "type": ["string", "null"] },
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"expected",
+							"label",
+							"email",
+							"created_at"
+						]
+					}
+				},
 				"expectations_check": {
-					"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest.",
+					"description": "After a write that saved a version or changed its expectations or made-up emails, if it has some: the emails by id judged on that version from stored classifications without asking its questions, and any made-up emails listed as undecided. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed), and after a write that changed only made-up emails on a rule with emails by id. Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
 					"type": "object",
 					"properties": {
 						"version": {
@@ -14101,7 +14595,7 @@ const operationManifest = [
 							"type": ["boolean", "null"]
 						},
 						"decided": {
-							"description": "Whether every expectation was judged (undecided is empty). Absent from a server that predates it.",
+							"description": "Whether every expectation was judged (undecided and undecided_samples are empty). Absent from a server that predates it.",
 							"type": "boolean"
 						},
 						"failed": {
@@ -14117,6 +14611,26 @@ const operationManifest = [
 								"type": "string",
 								"format": "uuid"
 							}
+						},
+						"failed_samples": {
+							"description": "Made-up emails that failed, by index in the set judged (saved oldest first, then added; or as sent).",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"undecided_samples": {
+							"description": "Made-up emails not decided, by index. Only a write sent with if_expectations_pass that saves a version or activates the rule judges them.",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"note": {
+							"description": "On an update that saved a version that did not pass, or a do_not_share rule created active: that it was saved anyway, is current, and whether it is live.",
+							"type": "string"
 						}
 					},
 					"required": [
@@ -14125,6 +14639,41 @@ const operationManifest = [
 						"failed",
 						"undecided"
 					]
+				},
+				"restored_from": {
+					"description": "When this write saved an earlier version again (restore_version): which, and that the scope is not part of a version.",
+					"type": "object",
+					"properties": {
+						"version": {
+							"type": "integer",
+							"exclusiveMinimum": 0
+						},
+						"note": { "type": "string" }
+					},
+					"required": ["version", "note"]
+				},
+				"affects": {
+					"description": "After an update that saved a version: API keys listing the rule, the webhooks they own, and shares this write ended. The rule keeps its state. Absent if not read.",
+					"type": "object",
+					"properties": {
+						"keys": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"endpoints": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"shares_ended": {
+							"type": "integer",
+							"minimum": 0
+						}
+					},
+					"required": [
+						"keys",
+						"endpoints",
+						"shares_ended"
+					]
 				}
 			},
 			"required": [
@@ -14258,6 +14807,25 @@ const operationManifest = [
 					"type": "string",
 					"minLength": 1,
 					"maxLength": 64
+				},
+				"breadth": {
+					"description": "Ignored (the compile answer's breadth).",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
 				}
 			},
 			"required": [
@@ -14415,6 +14983,14 @@ const operationManifest = [
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
 				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
+				},
 				"target_can_accept": {
 					"description": "Whether the member asked can accept it now under their role. Null unless you can list members and their roles (members:read), or when it could not be read.",
 					"type": ["boolean", "null"]
@@ -14635,6 +15211,14 @@ const operationManifest = [
 				"decline_reason": {
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
+				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -14792,11 +15376,325 @@ const operationManifest = [
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "generate-look-alikes",
+		"description": "Writes made-up emails that come close to what a grant rule describes but are private (a personal medical bill, pay for named people, a personal purchase, personal banking or tax, or another near case), and reports what the rule decides for each, as test-sample would. failed means the rule matched it, so it would be shared. Nothing is stored and no mail is read. Keep the ones it must never match with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "generateLookAlikes",
+		"path": "/email-rules/look-alikes",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": {
+			"type": "object",
+			"properties": {
+				"tree": {
+					"type": "object",
+					"properties": {
+						"version": {
+							"type": "number",
+							"const": 1
+						},
+						"vocabulary": {
+							"type": "string",
+							"description": "Vocabulary version, such as v1."
+						},
+						"when": {
+							"type": "object",
+							"propertyNames": { "type": "string" },
+							"additionalProperties": {},
+							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+						},
+						"questions": {
+							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": [
+						"version",
+						"vocabulary",
+						"when"
+					],
+					"additionalProperties": false
+				},
+				"english": {
+					"description": "What the tree is meant to match; without it, the tree is described in words.",
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 2e3
+				},
+				"evaluation_scope": {
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those mail:share_own lets you share). author: all you can read, inboxes added later included. selected: what scope_selection names."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
+				},
+				"rule_id": {
+					"description": "A saved rule you can see: its current version and words.",
+					"type": "string",
+					"format": "uuid"
+				},
+				"request_id": {
+					"description": "A rule request you can see: its rule as asked.",
+					"type": "string",
+					"format": "uuid"
+				},
+				"kind": {
+					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
+				"count": {
+					"description": "How many, 1 to 8; 6 by default.",
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 8
+				},
+				"kinds": {
+					"description": "Which kinds, taken in turn; all by default, the private ones first.",
+					"minItems": 1,
+					"maxItems": 5,
+					"type": "array",
+					"items": {
+						"type": "string",
+						"enum": [
+							"medical",
+							"payroll",
+							"personal_purchase",
+							"bank_tax",
+							"other"
+						]
+					}
+				},
+				"to": {
+					"description": "The mailbox they arrive in; by default the rule author's (a request's target's) sign-in address when you may see it, else yours.",
+					"type": "string",
+					"maxLength": 254,
+					"format": "email",
+					"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+				}
+			},
+			"additionalProperties": false
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"rule": {
+					"type": "object",
+					"properties": {
+						"id": {
+							"type": ["string", "null"],
+							"format": "uuid"
+						},
+						"version": {
+							"type": ["integer", "null"],
+							"exclusiveMinimum": 0
+						},
+						"vocabulary": { "type": "string" }
+					},
+					"required": [
+						"id",
+						"version",
+						"vocabulary"
+					]
+				},
+				"look_alikes": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": {
+								"type": "string",
+								"enum": [
+									"medical",
+									"payroll",
+									"personal_purchase",
+									"bank_tax",
+									"other"
+								]
+							},
+							"why": {
+								"type": "string",
+								"description": "Why the rule should not match it."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": { "type": "string" },
+											"name": { "type": "string" }
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"cc": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"subject": { "type": "string" },
+									"text": { "type": "string" },
+									"attachment_types": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" }
+								},
+								"required": [
+									"from",
+									"to",
+									"cc",
+									"subject",
+									"text",
+									"attachment_types",
+									"automated",
+									"from_mailing_list"
+								],
+								"description": "A made-up email, as test-sample takes it."
+							},
+							"outcome": {
+								"type": "string",
+								"enum": [
+									"matched",
+									"near_miss",
+									"no_match",
+									"not_decided"
+								]
+							},
+							"status": {
+								"type": "string",
+								"enum": [
+									"passed",
+									"failed",
+									"undecided"
+								],
+								"description": "failed: the rule matched it, so it would be shared. undecided: the rule reads a spam score, which it cannot carry, whatever it decided; or not matched on something it could not decide (not classified, a fact or answer missing, or not reached in time)."
+							},
+							"question_answers": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"question": { "type": "string" },
+										"answer": { "type": ["boolean", "null"] },
+										"probability": { "type": ["number", "null"] },
+										"error_class": { "type": "string" }
+									},
+									"required": [
+										"question",
+										"answer",
+										"probability"
+									]
+								}
+							}
+						},
+						"required": [
+							"kind",
+							"why",
+							"email",
+							"outcome",
+							"status",
+							"question_answers"
+						]
+					}
+				},
+				"counts": {
+					"type": "object",
+					"properties": {
+						"passed": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"failed": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"undecided": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"dropped": {
+							"type": "integer",
+							"minimum": 0,
+							"description": "Asked for but not returned: not written, outside the sample bounds, or of a kind not asked for."
+						}
+					},
+					"required": [
+						"passed",
+						"failed",
+						"undecided",
+						"dropped"
+					]
+				},
+				"note": {
+					"type": "string",
+					"description": "That the emails are made up and were never sent or stored."
+				}
+			},
+			"required": [
+				"rule",
+				"look_alikes",
+				"counts",
+				"note"
+			]
+		},
+		"sdkName": "generateLookAlikes",
+		"summary": "Write look-alike emails a rule should not match",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule",
-		"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. The current version's text (english, tree, explanation, assumptions, warnings) is under current, and current_version is its number. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRule",
@@ -14840,6 +15738,10 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
+				"protection_note": {
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+					"type": "string"
+				},
 				"evaluation_scope": {
 					"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 					"type": "string",
@@ -14870,10 +15772,37 @@ const operationManifest = [
 					"type": ["integer", "null"],
 					"exclusiveMinimum": 0
 				},
+				"revision": {
+					"description": "Moves on by one with every update. Send it as if_revision.",
+					"type": "integer",
+					"exclusiveMinimum": 0
+				},
 				"author_user_id": {
 					"type": "string",
 					"format": "uuid"
 				},
+				"author": {
+					"type": "object",
+					"properties": {
+						"user_id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"name": {
+							"description": "Their name; null unless you can list members or this is you, and when they have none set.",
+							"type": ["string", "null"]
+						},
+						"email": {
+							"description": "Sign-in email; null unless you can list member emails or this is you.",
+							"type": ["string", "null"]
+						}
+					},
+					"required": [
+						"user_id",
+						"name",
+						"email"
+					]
+				},
 				"is_author": {
 					"type": "boolean",
 					"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -14886,91 +15815,94 @@ const operationManifest = [
 					"type": "string",
 					"format": "date-time"
 				},
-				"current": { "anyOf": [{
-					"type": "object",
-					"properties": {
-						"version": {
-							"type": "integer",
-							"exclusiveMinimum": 0
-						},
-						"english": { "type": "string" },
-						"tree": {
-							"type": "object",
-							"properties": {
-								"version": {
-									"type": "number",
-									"const": 1
-								},
-								"vocabulary": {
-									"type": "string",
-									"description": "Vocabulary version, such as v1."
-								},
-								"when": {
-									"type": "object",
-									"propertyNames": { "type": "string" },
-									"additionalProperties": {},
-									"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
-								},
-								"questions": {
-									"type": "array",
-									"items": { "type": "string" },
-									"description": "Yes/no questions asked once the conditions match; all must be yes."
-								}
+				"current": {
+					"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "integer",
+								"exclusiveMinimum": 0
 							},
-							"required": [
-								"version",
-								"vocabulary",
-								"when",
-								"questions"
-							]
-						},
-						"explanation": { "type": "string" },
-						"assumptions": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"warnings": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"compiled_by": {
-							"type": "string",
-							"description": "Who produced the tree, as stated when saved (not verified), such as rule-compiler-v1 or member."
-						},
-						"vocabulary": { "type": "string" },
-						"created_at": {
-							"type": "string",
-							"format": "date-time"
-						},
-						"sql": {
-							"description": "Present only when include_sql was true.",
-							"type": "object",
-							"properties": {
-								"expression": {
-									"type": "string",
-									"description": "A parameterized boolean expression over one row per email."
+							"english": { "type": "string" },
+							"tree": {
+								"type": "object",
+								"properties": {
+									"version": {
+										"type": "number",
+										"const": 1
+									},
+									"vocabulary": {
+										"type": "string",
+										"description": "Vocabulary version, such as v1."
+									},
+									"when": {
+										"type": "object",
+										"propertyNames": { "type": "string" },
+										"additionalProperties": {},
+										"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+									},
+									"questions": {
+										"type": "array",
+										"items": { "type": "string" },
+										"description": "Yes/no questions asked once the conditions match; all must be yes."
+									}
 								},
-								"params": {
-									"type": "array",
-									"items": {},
-									"description": "The values bound to $1, $2 and so on."
-								}
+								"required": [
+									"version",
+									"vocabulary",
+									"when",
+									"questions"
+								]
 							},
-							"required": ["expression", "params"]
-						}
-					},
-					"required": [
-						"version",
-						"english",
-						"tree",
-						"explanation",
-						"assumptions",
-						"warnings",
-						"compiled_by",
-						"vocabulary",
-						"created_at"
-					]
-				}, { "type": "null" }] },
+							"explanation": { "type": "string" },
+							"assumptions": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"warnings": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"compiled_by": {
+								"type": "string",
+								"description": "Who produced the tree, as stated when saved (not verified), such as rule-compiler-v1 or member."
+							},
+							"vocabulary": { "type": "string" },
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							},
+							"sql": {
+								"description": "Present only when include_sql was true.",
+								"type": "object",
+								"properties": {
+									"expression": {
+										"type": "string",
+										"description": "A parameterized boolean expression over one row per email."
+									},
+									"params": {
+										"type": "array",
+										"items": {},
+										"description": "The values bound to $1, $2 and so on."
+									}
+								},
+								"required": ["expression", "params"]
+							}
+						},
+						"required": [
+							"version",
+							"english",
+							"tree",
+							"explanation",
+							"assumptions",
+							"warnings",
+							"compiled_by",
+							"vocabulary",
+							"created_at"
+						]
+					}, { "type": "null" }]
+				},
 				"expectations": {
 					"description": "Its saved expectations, each list by email id.",
 					"type": "object",
@@ -14991,6 +15923,112 @@ const operationManifest = [
 						}
 					},
 					"required": ["match", "no_match"]
+				},
+				"expectation_samples": {
+					"description": "Its saved made-up emails, oldest first.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": { "type": ["string", "null"] },
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"expected",
+							"label",
+							"email",
+							"created_at"
+						]
+					}
 				}
 			},
 			"required": [
@@ -15014,7 +16052,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-request",
-		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleRequest",
@@ -15178,6 +16216,14 @@ const operationManifest = [
 				"decline_reason": {
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
+				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -16060,6 +17106,14 @@ const operationManifest = [
 					"decline_reason": {
 						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 						"type": ["string", "null"]
+					},
+					"edited_on_accept": {
+						"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+						"type": ["boolean", "null"]
+					},
+					"notice": {
+						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"type": ["string", "null"]
 					}
 				},
 				"required": [
@@ -17144,7 +18198,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rules",
-		"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule). With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule) and current_version, but not the version's text: read that under current from GET /email-rules/{id}. With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRules",
@@ -17203,6 +18257,10 @@ const operationManifest = [
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -17233,10 +18291,37 @@ const operationManifest = [
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"revision": {
+						"description": "Moves on by one with every update. Send it as if_revision.",
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
 					"author_user_id": {
 						"type": "string",
 						"format": "uuid"
 					},
+					"author": {
+						"type": "object",
+						"properties": {
+							"user_id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"name": {
+								"description": "Their name; null unless you can list members or this is you, and when they have none set.",
+								"type": ["string", "null"]
+							},
+							"email": {
+								"description": "Sign-in email; null unless you can list member emails or this is you.",
+								"type": ["string", "null"]
+							}
+						},
+						"required": [
+							"user_id",
+							"name",
+							"email"
+						]
+					},
 					"is_author": {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -17608,10 +18693,114 @@ const operationManifest = [
 								"type": "string",
 								"format": "uuid"
 							}
+						},
+						"samples": {
+							"maxItems": 20,
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"expected": {
+										"type": "string",
+										"enum": ["match", "no_match"]
+									},
+									"label": {
+										"type": ["string", "null"],
+										"minLength": 1,
+										"maxLength": 200,
+										"pattern": "^[^\\u0000]*$",
+										"description": "What the email stands for, such as a personal medical bill."
+									},
+									"email": {
+										"type": "object",
+										"properties": {
+											"from": {
+												"type": "object",
+												"properties": {
+													"address": {
+														"type": "string",
+														"maxLength": 254,
+														"format": "email",
+														"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+													},
+													"name": {
+														"type": "string",
+														"maxLength": 200,
+														"pattern": "^[^\\u0000]*$"
+													}
+												},
+												"required": ["address"]
+											},
+											"to": {
+												"minItems": 1,
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"maxLength": 254,
+													"format": "email",
+													"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+												}
+											},
+											"cc": {
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"maxLength": 254,
+													"format": "email",
+													"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+												}
+											},
+											"subject": {
+												"type": "string",
+												"maxLength": 998,
+												"pattern": "^[^\\u0000]*$"
+											},
+											"text": {
+												"type": "string",
+												"minLength": 1,
+												"maxLength": 4e3,
+												"pattern": "^[^\\u0000]*$"
+											},
+											"attachment_types": {
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"minLength": 1,
+													"maxLength": 255,
+													"pattern": "^[^\\u0000]*$"
+												}
+											},
+											"automated": { "type": "boolean" },
+											"from_mailing_list": { "type": "boolean" },
+											"spam_score": {
+												"type": "number",
+												"minimum": -1e3,
+												"maximum": 1e3
+											}
+										},
+										"required": [
+											"from",
+											"to",
+											"text"
+										],
+										"description": "A made-up email, as POST /email-rules/test-sample takes it."
+									},
+									"id": {
+										"type": "string",
+										"format": "uuid"
+									},
+									"created_at": { "type": "string" }
+								},
+								"required": ["expected", "email"],
+								"additionalProperties": false
+							}
 						}
 					},
 					"additionalProperties": false,
-					"description": "Emails the rule must match and must not, at most 100 in all, always tested whatever their age: added to email_ids, or to the recent window, which gives up a place for each. The answer's expectations judge each."
+					"description": "Emails the rule must match and must not (at most 100), always tested whatever their age, and made-up emails (samples, at most 20). Given, it replaces a saved rule's own."
 				}
 			},
 			"additionalProperties": false
@@ -17993,7 +19182,7 @@ const operationManifest = [
 					}
 				},
 				"expectations": {
-					"description": "Present when expect was given, or for a saved rule with saved expectations.",
+					"description": "Present when expect was given, or for a saved rule with saved expectations or made-up emails.",
 					"type": "object",
 					"properties": {
 						"passed": {
@@ -18063,6 +19252,71 @@ const operationManifest = [
 								]
 							},
 							"description": "match first, then no_match, each in the order given (saved expectations by email id)."
+						},
+						"samples": {
+							"description": "Made-up emails judged (expect.samples, or a saved rule's), in order; counts include them.",
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"index": {
+										"type": "integer",
+										"minimum": 0
+									},
+									"sample_id": {
+										"type": ["string", "null"],
+										"format": "uuid"
+									},
+									"label": { "type": ["string", "null"] },
+									"expected": {
+										"type": "string",
+										"enum": ["match", "no_match"]
+									},
+									"outcome": {
+										"type": "string",
+										"enum": [
+											"matched",
+											"near_miss",
+											"no_match",
+											"not_decided"
+										]
+									},
+									"status": {
+										"type": "string",
+										"enum": [
+											"passed",
+											"failed",
+											"undecided"
+										]
+									},
+									"question_answers": {
+										"type": "array",
+										"items": {
+											"type": "object",
+											"properties": {
+												"question": { "type": "string" },
+												"answer": { "type": ["boolean", "null"] },
+												"probability": { "type": ["number", "null"] },
+												"error_class": { "type": "string" }
+											},
+											"required": [
+												"question",
+												"answer",
+												"probability"
+											]
+										}
+									}
+								},
+								"required": [
+									"index",
+									"sample_id",
+									"label",
+									"expected",
+									"outcome",
+									"status",
+									"question_answers"
+								]
+							}
 						}
 					},
 					"required": [
@@ -18437,7 +19691,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-email-rule",
-		"description": "Renames the rule, saves a new version (english and tree together, with an explanation or one the server writes; earlier versions stay), changes its state (draft is off; observe; active), whose mail it runs over (evaluation_scope, with scope_selection when selected) or its saved expectations (each saved version and new set is judged in expectations_check). Anyone but its author who sees it may only disable it (state draft), and while it is shared only if they manage members from the dashboard. Without evaluation_scope the scope stays; a scope change saves a new version with the same conditions, and what was granted stays. A shared rule keeps its scope; a kind never changes. Send if_version, the current_version you read, so a write never replaces a version saved since. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Renames the rule, saves a new version (english and tree together, with an explanation or one the server writes; earlier versions stay) or an earlier one again (restore_version), changes its state (draft is off; observe; active), whose mail it runs over (evaluation_scope, with scope_selection when selected) or its saved expectations (each saved version and new set is judged in expectations_check). Anyone but its author who sees it may only disable it (state draft), and while it is shared only if they manage members from the dashboard. Without evaluation_scope the scope stays; a scope change saves a new version with the same conditions, and what was granted stays. A shared rule keeps its scope; a kind never changes. A saved version takes effect at once (an active rule stays active); affects counts what it reaches. Send if_version, the current_version you read, so a write never replaces a version saved since, or if_revision to refuse it after any update. Without if_expectations_pass a version is saved even when its expectations_check fails. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateEmailRule",
@@ -18539,6 +19793,25 @@ const operationManifest = [
 					"minLength": 1,
 					"maxLength": 64
 				},
+				"breadth": {
+					"description": "Ignored (the compile answer's breadth).",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
+				},
 				"evaluation_scope": {
 					"type": "string",
 					"enum": [
@@ -18576,7 +19849,7 @@ const operationManifest = [
 					"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
 				},
 				"if_version": {
-					"description": "The current_version you read. If the rule's now differs, nothing changes: 409 email_rule_conflict, details.reason version_moved and details.current_version. Send it with a new version so a concurrent edit is never replaced unseen. It guards versions only: a change to expectations alone saves none.",
+					"description": "The current_version you read: if it has moved, nothing is saved (409 email_rule_conflict, version_moved). It guards versions only; if_revision guards every update.",
 					"type": "integer",
 					"minimum": 1
 				},
@@ -18602,6 +19875,233 @@ const operationManifest = [
 					},
 					"additionalProperties": false,
 					"description": "Replaces its saved expectations (author only); null removes them."
+				},
+				"expectation_samples": {
+					"maxItems": 20,
+					"type": ["array", "null"],
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					},
+					"description": "Replaces its saved made-up emails (author only); null or [] removes them."
+				},
+				"add_expectation_samples": {
+					"description": "Adds made-up emails to those saved (author only), up to 20 in all.",
+					"minItems": 1,
+					"maxItems": 20,
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					}
+				},
+				"if_revision": {
+					"description": "The revision you read: if the rule was updated since, nothing is saved (409 email_rule_conflict, revision_moved).",
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 2147483647
+				},
+				"if_expectations_pass": {
+					"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; undecided: 409 expectations_undecided (both with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
+					"type": "boolean"
+				},
+				"restore_version": {
+					"description": "Save version n again as the next version (author only): its english, tree, explanation, assumptions, warnings and compiled_by. A version carries no scope: the rule keeps its own unless evaluation_scope is sent. 404 version_not_found; 400 already_current or version_not_renderable. Not with a version's own fields.",
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 2147483647
 				}
 			},
 			"additionalProperties": false
@@ -18627,6 +20127,10 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
+				"protection_note": {
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+					"type": "string"
+				},
 				"evaluation_scope": {
 					"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 					"type": "string",
@@ -18657,10 +20161,37 @@ const operationManifest = [
 					"type": ["integer", "null"],
 					"exclusiveMinimum": 0
 				},
+				"revision": {
+					"description": "Moves on by one with every update. Send it as if_revision.",
+					"type": "integer",
+					"exclusiveMinimum": 0
+				},
 				"author_user_id": {
 					"type": "string",
 					"format": "uuid"
 				},
+				"author": {
+					"type": "object",
+					"properties": {
+						"user_id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"name": {
+							"description": "Their name; null unless you can list members or this is you, and when they have none set.",
+							"type": ["string", "null"]
+						},
+						"email": {
+							"description": "Sign-in email; null unless you can list member emails or this is you.",
+							"type": ["string", "null"]
+						}
+					},
+					"required": [
+						"user_id",
+						"name",
+						"email"
+					]
+				},
 				"is_author": {
 					"type": "boolean",
 					"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -18673,91 +20204,94 @@ const operationManifest = [
 					"type": "string",
 					"format": "date-time"
 				},
-				"current": { "anyOf": [{
-					"type": "object",
-					"properties": {
-						"version": {
-							"type": "integer",
-							"exclusiveMinimum": 0
-						},
-						"english": { "type": "string" },
-						"tree": {
-							"type": "object",
-							"properties": {
-								"version": {
-									"type": "number",
-									"const": 1
-								},
-								"vocabulary": {
-									"type": "string",
-									"description": "Vocabulary version, such as v1."
-								},
-								"when": {
-									"type": "object",
-									"propertyNames": { "type": "string" },
-									"additionalProperties": {},
-									"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
-								},
-								"questions": {
-									"type": "array",
-									"items": { "type": "string" },
-									"description": "Yes/no questions asked once the conditions match; all must be yes."
-								}
+				"current": {
+					"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "integer",
+								"exclusiveMinimum": 0
 							},
-							"required": [
-								"version",
-								"vocabulary",
-								"when",
-								"questions"
-							]
-						},
-						"explanation": { "type": "string" },
-						"assumptions": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"warnings": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"compiled_by": {
-							"type": "string",
-							"description": "Who produced the tree, as stated when saved (not verified), such as rule-compiler-v1 or member."
-						},
-						"vocabulary": { "type": "string" },
-						"created_at": {
-							"type": "string",
-							"format": "date-time"
-						},
-						"sql": {
-							"description": "Present only when include_sql was true.",
-							"type": "object",
-							"properties": {
-								"expression": {
-									"type": "string",
-									"description": "A parameterized boolean expression over one row per email."
+							"english": { "type": "string" },
+							"tree": {
+								"type": "object",
+								"properties": {
+									"version": {
+										"type": "number",
+										"const": 1
+									},
+									"vocabulary": {
+										"type": "string",
+										"description": "Vocabulary version, such as v1."
+									},
+									"when": {
+										"type": "object",
+										"propertyNames": { "type": "string" },
+										"additionalProperties": {},
+										"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+									},
+									"questions": {
+										"type": "array",
+										"items": { "type": "string" },
+										"description": "Yes/no questions asked once the conditions match; all must be yes."
+									}
 								},
-								"params": {
-									"type": "array",
-									"items": {},
-									"description": "The values bound to $1, $2 and so on."
-								}
+								"required": [
+									"version",
+									"vocabulary",
+									"when",
+									"questions"
+								]
 							},
-							"required": ["expression", "params"]
-						}
-					},
-					"required": [
-						"version",
-						"english",
-						"tree",
-						"explanation",
-						"assumptions",
-						"warnings",
-						"compiled_by",
-						"vocabulary",
-						"created_at"
-					]
-				}, { "type": "null" }] },
+							"explanation": { "type": "string" },
+							"assumptions": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"warnings": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"compiled_by": {
+								"type": "string",
+								"description": "Who produced the tree, as stated when saved (not verified), such as rule-compiler-v1 or member."
+							},
+							"vocabulary": { "type": "string" },
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							},
+							"sql": {
+								"description": "Present only when include_sql was true.",
+								"type": "object",
+								"properties": {
+									"expression": {
+										"type": "string",
+										"description": "A parameterized boolean expression over one row per email."
+									},
+									"params": {
+										"type": "array",
+										"items": {},
+										"description": "The values bound to $1, $2 and so on."
+									}
+								},
+								"required": ["expression", "params"]
+							}
+						},
+						"required": [
+							"version",
+							"english",
+							"tree",
+							"explanation",
+							"assumptions",
+							"warnings",
+							"compiled_by",
+							"vocabulary",
+							"created_at"
+						]
+					}, { "type": "null" }]
+				},
 				"scope_warnings": {
 					"description": "Names in scope_selection that match nothing this organization receives mail at (a typo, or an inbox not yet in use). Present only when there are some.",
 					"type": "array",
@@ -18788,8 +20322,114 @@ const operationManifest = [
 						]
 					}
 				},
+				"expectation_samples": {
+					"description": "Its saved made-up emails, when this write set or added some.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": { "type": ["string", "null"] },
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"expected",
+							"label",
+							"email",
+							"created_at"
+						]
+					}
+				},
 				"expectations_check": {
-					"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest.",
+					"description": "After a write that saved a version or changed its expectations or made-up emails, if it has some: the emails by id judged on that version from stored classifications without asking its questions, and any made-up emails listed as undecided. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed), and after a write that changed only made-up emails on a rule with emails by id. Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
 					"type": "object",
 					"properties": {
 						"version": {
@@ -18801,7 +20441,7 @@ const operationManifest = [
 							"type": ["boolean", "null"]
 						},
 						"decided": {
-							"description": "Whether every expectation was judged (undecided is empty). Absent from a server that predates it.",
+							"description": "Whether every expectation was judged (undecided and undecided_samples are empty). Absent from a server that predates it.",
 							"type": "boolean"
 						},
 						"failed": {
@@ -18817,6 +20457,26 @@ const operationManifest = [
 								"type": "string",
 								"format": "uuid"
 							}
+						},
+						"failed_samples": {
+							"description": "Made-up emails that failed, by index in the set judged (saved oldest first, then added; or as sent).",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"undecided_samples": {
+							"description": "Made-up emails not decided, by index. Only a write sent with if_expectations_pass that saves a version or activates the rule judges them.",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"note": {
+							"description": "On an update that saved a version that did not pass, or a do_not_share rule created active: that it was saved anyway, is current, and whether it is live.",
+							"type": "string"
 						}
 					},
 					"required": [
@@ -18825,6 +20485,41 @@ const operationManifest = [
 						"failed",
 						"undecided"
 					]
+				},
+				"restored_from": {
+					"description": "When this write saved an earlier version again (restore_version): which, and that the scope is not part of a version.",
+					"type": "object",
+					"properties": {
+						"version": {
+							"type": "integer",
+							"exclusiveMinimum": 0
+						},
+						"note": { "type": "string" }
+					},
+					"required": ["version", "note"]
+				},
+				"affects": {
+					"description": "After an update that saved a version: API keys listing the rule, the webhooks they own, and shares this write ended. The rule keeps its state. Absent if not read.",
+					"type": "object",
+					"properties": {
+						"keys": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"endpoints": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"shares_ended": {
+							"type": "integer",
+							"minimum": 0
+						}
+					},
+					"required": [
+						"keys",
+						"endpoints",
+						"shares_ended"
+					]
 				}
 			},
 			"required": [
@@ -19018,6 +20713,14 @@ const operationManifest = [
 				"decline_reason": {
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
+				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -35034,7 +36737,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "decide-suspension",
-		"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
+		"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it needs the decider to cover it, and so does revoking an API key unless the decider holds it and decides as themself rather than through another app (revoking an uncovered key someone else holds is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "decideSuspension",
@@ -46372,11 +48075,11 @@ const operationManifest = [
 					"description": "Whether this is the latest attempt of its delivery: the one recorded last, where a record of no attempt (a rule skip or a held send, attempt_count 0) is latest only when no attempt was made. A retry is recorded as a new attempt with its own id and attempt_count (not always higher than the one before), so an earlier attempt never changes: follow the latest one, or read attempts on any of them."
 				},
 				"retry_scheduled": {
-					"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+					"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. A rule-granted delivery is retried on a schedule of its own, to the same endpoint, deciding it afresh: on its latest attempt true while another attempt is to come (the delivery's next_attempt_at says when); null while an attempt is under way (read it again shortly), while it waits on an owner who cannot receive mail or on a held endpoint (checked again hourly, and sent once that clears), when it is past its 7-day limit, or when that could not be read just now; and false otherwise, including once the endpoint is off or already has the email. Null on every attempt of a delivery retried or settled on a schedule of its own that this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
 					"type": ["boolean", "null"]
 				},
 				"next_attempt_at": {
-					"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled.",
+					"description": "When the next automatic attempt of a rule-granted delivery is due: set on its latest attempt while retry_scheduled is true. The attempt runs at the first retry pass at or after this time (one runs every few minutes), so a time already past means it is due now. Null otherwise, and on every delivery that is not rule-granted, whose retries are passes for the email with no time reported (whether one is coming is retry_scheduled).",
 					"type": ["string", "null"]
 				},
 				"attempts": {
@@ -46406,7 +48109,7 @@ const operationManifest = [
 								"type": ["string", "null"]
 							},
 							"retry_scheduled": {
-								"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+								"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. A rule-granted delivery is retried on a schedule of its own, to the same endpoint, deciding it afresh: on its latest attempt true while another attempt is to come (the delivery's next_attempt_at says when); null while an attempt is under way (read it again shortly), while it waits on an owner who cannot receive mail or on a held endpoint (checked again hourly, and sent once that clears), when it is past its 7-day limit, or when that could not be read just now; and false otherwise, including once the endpoint is off or already has the email. Null on every attempt of a delivery retried or settled on a schedule of its own that this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
 								"type": ["boolean", "null"]
 							}
 						},
@@ -46620,12 +48323,12 @@ const operationManifest = [
 					},
 					"retry_scheduled": {
 						"type": ["boolean", "null"],
-						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will."
+						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. A rule-granted delivery is retried on a schedule of its own, to the same endpoint, deciding it afresh: on its latest attempt true while another attempt is to come (the delivery's next_attempt_at says when); null while an attempt is under way (read it again shortly), while it waits on an owner who cannot receive mail or on a held endpoint (checked again hourly, and sent once that clears), when it is past its 7-day limit, or when that could not be read just now; and false otherwise, including once the endpoint is off or already has the email. Null on every attempt of a delivery retried or settled on a schedule of its own that this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will."
 					},
 					"next_attempt_at": {
 						"type": ["string", "null"],
 						"format": "date-time",
-						"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled."
+						"description": "When the next automatic attempt of a rule-granted delivery is due: set on its latest attempt while retry_scheduled is true. The attempt runs at the first retry pass at or after this time (one runs every few minutes), so a time already past means it is due now. Null otherwise, and on every delivery that is not rule-granted, whose retries are passes for the email with no time reported (whether one is coming is retry_scheduled)."
 					}
 				},
 				"required": [
@@ -46834,7 +48537,7 @@ function sanitizeForTerminal(value) {
 	return out;
 }
 // src/oclif/answer-reports.ts
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 /** Text from an answer, made safe and one line for a report: no terminal controls. */
@@ -46843,10 +48546,10 @@ function oneLine(text) {
 }
 /** One line per warning a route write answers with (createRoute, updateRoute). */
 function routeWarningLines(data) {
-	const warnings = isRecord$2(data) ? data.warnings : void 0;
+	const warnings = isRecord$3(data) ? data.warnings : void 0;
 	if (!Array.isArray(warnings)) return [];
 	return warnings.flatMap((warning) => {
-		if (!isRecord$2(warning)) return [];
+		if (!isRecord$3(warning)) return [];
 		const message = typeof warning.message === "string" ? oneLine(warning.message) : "";
 		if (message) return [`Route warning: ${withCliCommands(message)}`];
 		const code = typeof warning.code === "string" ? oneLine(warning.code) : "";
@@ -46874,11 +48577,11 @@ const DELIVERED_STATUSES = /* @__PURE__ */ new Set(["delivered", "header_confirm
 * and has no recorded answer says so.
 */
 function deliveryAttemptLines(data) {
-	const attempts = isRecord$2(data) ? data.attempts : void 0;
+	const attempts = isRecord$3(data) ? data.attempts : void 0;
 	if (!Array.isArray(attempts)) return [];
 	const lines = [];
 	for (const attempt of attempts) {
-		if (!isRecord$2(attempt)) continue;
+		if (!isRecord$3(attempt)) continue;
 		const text = (value) => typeof value === "string" && value ? oneLine(value) : "";
 		const status = text(attempt.status);
 		const parts = [
@@ -46972,7 +48675,7 @@ var CliOrgRefusedError = class extends Errors.CLIError {
 		this.orgId = params.orgId;
 	}
 };
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function apiOrigin(apiBaseUrl) {
@@ -46999,7 +48702,7 @@ function isUuid(value) {
 	return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
 function isOrgAccessToken(value) {
-	return isRecord$1(value) && typeof value.access_token === "string" && value.access_token.length > 0 && value.token_type === "Bearer" && typeof value.expires_in === "number" && value.expires_in > 0 && typeof value.org_id === "string" && (value.org_name === null || typeof value.org_name === "string") && typeof value.oauth_grant_id === "string";
+	return isRecord$2(value) && typeof value.access_token === "string" && value.access_token.length > 0 && value.token_type === "Bearer" && typeof value.expires_in === "number" && value.expires_in > 0 && typeof value.org_id === "string" && (value.org_name === null || typeof value.org_name === "string") && typeof value.oauth_grant_id === "string";
 }
 function orgTokenFromResponse(token, now = Date.now) {
 	return {
@@ -47046,7 +48749,7 @@ async function postTokenEndpoint(params) {
 		throw new Errors.CLIError(`Could not reach the Primitive OAuth token endpoint: ${detail}`, { exit: 1 });
 	}
 	const payload = await response.json().catch(() => null);
-	if (response.ok && isRecord$1(payload)) return {
+	if (response.ok && isRecord$2(payload)) return {
 		ok: true,
 		payload
 	};
@@ -47054,7 +48757,7 @@ async function postTokenEndpoint(params) {
 		ok: true,
 		payload: {}
 	};
-	const record = isRecord$1(payload) ? payload : {};
+	const record = isRecord$2(payload) ? payload : {};
 	return {
 		ok: false,
 		status: response.status,
@@ -47257,12 +48960,12 @@ async function fetchCliOrgs(params) {
 	}
 	const payload = await response.json().catch(() => null);
 	if (!response.ok) {
-		const error = isRecord$1(payload) && isRecord$1(payload.error) ? payload.error : {};
+		const error = isRecord$2(payload) && isRecord$2(payload.error) ? payload.error : {};
 		if (response.status === 404 && error.code === "feature_disabled") throw new Errors.CLIError("This Primitive server does not support switching organizations for CLI logins.", { exit: 1 });
 		throw new Errors.CLIError(`Could not list organizations${typeof error.message === "string" ? `: ${error.message}` : ` (HTTP ${response.status}).`}`, { exit: 1 });
 	}
-	const data = isRecord$1(payload) ? payload.data : null;
-	if (!isRecord$1(data) || !Array.isArray(data.orgs)) throw new Errors.CLIError("Primitive API returned an unexpected organization list.", { exit: 1 });
+	const data = isRecord$2(payload) ? payload.data : null;
+	if (!isRecord$2(data) || !Array.isArray(data.orgs)) throw new Errors.CLIError("Primitive API returned an unexpected organization list.", { exit: 1 });
 	return data;
 }
 /** How long a command waits for another CLI process to finish with the saved login. */
@@ -47835,6 +49538,358 @@ async function withAttachmentWait(call, options) {
 	}
 	return result;
 }
+// src/oclif/email-rule-samples.ts
+function errorDetail(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function usageError$1(message) {
+	return new Errors.CLIError(message, { exit: 2 });
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** A path as a shell word: quoted when it holds anything but plain characters. */
+function shellWord(value) {
+	return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+/** A JSON file a flag names, parsed, or an exit-1 error saying why not. */
+function readJsonFileFlag(path, flag) {
+	let text;
+	try {
+		text = readFileSync(path, "utf8");
+	} catch (error) {
+		throw new Errors.CLIError(`Could not read ${flag} ${path}: ${errorDetail(error)}`, { exit: 1 });
+	}
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		throw new Errors.CLIError(`${flag} ${path} is not valid JSON: ${errorDetail(error)}`, { exit: 1 });
+	}
+}
+/** The longest label the API keeps on a sample. */
+const SAMPLE_LABEL_MAX = 200;
+/**
+* `text` cut to `max` UTF-16 units, as the API counts a label's length,
+* never inside a character.
+*/
+function cutLabel(text, max) {
+	const cut = text.slice(0, max);
+	return (/[\uD800-\uDBFF]$/.test(cut) ? cut.slice(0, -1) : cut).trimEnd();
+}
+/**
+* A look-alike as a must-not-match sample: the email as written, labelled
+* with its kind and why the rule should not match it ("medical: ..."), or
+* the why alone when both do not fit a label.
+*/
+function lookAlikeSample(lookAlike) {
+	if (!isRecord$1(lookAlike) || !isRecord$1(lookAlike.email)) return null;
+	const kind = typeof lookAlike.kind === "string" ? lookAlike.kind : "";
+	const why = typeof lookAlike.why === "string" ? lookAlike.why.trim() : "";
+	const both = kind && why ? `${kind}: ${why}` : kind || why;
+	const label = both.length <= SAMPLE_LABEL_MAX ? both : why.length <= SAMPLE_LABEL_MAX ? why : `${cutLabel(why, 197)}...`;
+	return {
+		expected: "no_match",
+		...label ? { label } : {},
+		email: lookAlike.email
+	};
+}
+/**
+* The look-alikes of a generate-look-alikes answer that can be saved (each
+* with an email), in the answer's order. The report numbers these and the
+* samples file holds these, so a number means the same email in both.
+*/
+function lookAlikeEntries(answer) {
+	const list = isRecord$1(answer) && Array.isArray(answer.look_alikes) ? answer.look_alikes : [];
+	const entries = [];
+	for (const item of list) {
+		const sample = lookAlikeSample(item);
+		if (sample && isRecord$1(item)) entries.push({
+			lookAlike: item,
+			sample
+		});
+	}
+	return entries;
+}
+/** The look-alikes of a generate-look-alikes answer, as samples, in order. */
+function lookAlikeSamples(answer) {
+	return lookAlikeEntries(answer).map((entry) => entry.sample);
+}
+/** The fields a saved made-up email takes, and the API's bounds on them. */
+const SAMPLE_EMAIL_KEYS = /* @__PURE__ */ new Set([
+	"from",
+	"to",
+	"cc",
+	"subject",
+	"text",
+	"attachment_types",
+	"automated",
+	"from_mailing_list",
+	"spam_score"
+]);
+const SAMPLE_TEXT_MAX = 4e3;
+const SAMPLE_SUBJECT_MAX = 998;
+const SAMPLE_LIST_MAX = 10;
+/**
+* Refuse, naming the sample and the field, a made-up email the API would
+* refuse to keep: the fields it takes and their bounds. The API checks the
+* rest (address forms, a NUL).
+*/
+function checkSampleEmail(email, at) {
+	const fail = (what) => {
+		throw usageError$1(`${at}: email ${what}.`);
+	};
+	const unknown = Object.keys(email).find((key) => !SAMPLE_EMAIL_KEYS.has(key));
+	if (unknown !== void 0) fail(`takes no "${unknown}" (it takes ${[...SAMPLE_EMAIL_KEYS].join(", ")})`);
+	if (!isRecord$1(email.from) || typeof email.from.address !== "string") fail("needs from.address");
+	const list = (key, min) => {
+		const value = email[key];
+		if (value === void 0 && min === 0) return;
+		if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string") || value.length < min || value.length > SAMPLE_LIST_MAX) fail(`${key} must be a list of ${min > 0 ? `${min} to ` : "at most "}${SAMPLE_LIST_MAX} strings`);
+	};
+	list("to", 1);
+	list("cc", 0);
+	list("attachment_types", 0);
+	if (email.subject !== void 0 && (typeof email.subject !== "string" || email.subject.length > SAMPLE_SUBJECT_MAX)) fail(`subject must be a string of at most ${SAMPLE_SUBJECT_MAX} characters`);
+	if (typeof email.text !== "string" || email.text.length === 0 || email.text.length > SAMPLE_TEXT_MAX) fail(`text must be 1 to ${SAMPLE_TEXT_MAX} characters`);
+	for (const key of ["automated", "from_mailing_list"]) if (email[key] !== void 0 && typeof email[key] !== "boolean") fail(`${key} must be true or false`);
+	if (email.spam_score !== void 0 && (typeof email.spam_score !== "number" || !Number.isFinite(email.spam_score))) fail("spam_score must be a number");
+}
+/** The keys a sample may carry: a saved one's id and time are taken and ignored. */
+const SAMPLE_KEYS = /* @__PURE__ */ new Set([
+	"expected",
+	"label",
+	"email",
+	"id",
+	"created_at"
+]);
+/**
+* The samples a file holds: a JSON array of samples, as --samples-file
+* writes them, or a generate-look-alikes answer saved as the command printed
+* it (with or without --json), whose look-alikes become must-not-match
+* samples numbered as its report numbered them. Only a literal [] holds no
+* samples; an answer with none is refused, so it never empties a rule's.
+*/
+function samplesFromJson(value, source) {
+	const data = isRecord$1(value) && isRecord$1(value.data) ? value.data : value;
+	if (isRecord$1(data) && Array.isArray(data.look_alikes)) {
+		const samples = lookAlikeSamples(data);
+		if (samples.length === 0) throw usageError$1(`${source} is a generate-look-alikes answer with no look-alikes in it.`);
+		samples.forEach((sample, index) => {
+			checkSampleEmail(sample.email, `${source}, look-alike ${index + 1}`);
+		});
+		return samples;
+	}
+	if (!Array.isArray(data)) throw usageError$1(`${source} must hold a JSON array of samples, such as [{"expected": "no_match", "label": "a personal bill", "email": {...}}], or a generate-look-alikes answer.`);
+	return data.map((item, index) => {
+		const at = `${source}, sample ${index + 1}`;
+		if (!isRecord$1(item)) throw usageError$1(`${at} is not an object.`);
+		const unknown = Object.keys(item).find((key) => !SAMPLE_KEYS.has(key));
+		if (unknown !== void 0) throw usageError$1(`${at}: "${unknown}" is not a sample field; a sample takes expected, label and email.`);
+		if (item.expected !== "match" && item.expected !== "no_match") throw usageError$1(`${at}: expected must be "match" or "no_match".`);
+		if (!isRecord$1(item.email)) throw usageError$1(`${at}: email must be an object, as test-email-rule-on-sample takes it.`);
+		checkSampleEmail(item.email, at);
+		const label = item.label;
+		if (label !== void 0 && label !== null) {
+			if (typeof label !== "string") throw usageError$1(`${at}: label must be a string.`);
+			if (label.trim() === "") throw usageError$1(`${at}: label is blank; leave it out or say what the email stands for.`);
+			if (label.trim().length > SAMPLE_LABEL_MAX) throw usageError$1(`${at}: label is longer than ${SAMPLE_LABEL_MAX} characters.`);
+		}
+		return {
+			expected: item.expected,
+			...label !== void 0 ? { label } : {},
+			email: item.email
+		};
+	});
+}
+/**
+* The numbers --pick names, from 1, in the order given and without repeats,
+* or a usage error: "2,4" or "2 4". `count` is how many there are to pick
+* from; a number past it is refused, rather than skipped.
+*/
+function pickNumbers(pick, count, source) {
+	const parts = pick.split(/[\s,]+/).map((part) => part.trim()).filter((part) => part !== "");
+	if (parts.length === 0) throw usageError$1("--pick needs the numbers of the samples to take, such as --pick 2,4.");
+	const chosen = [];
+	for (const part of parts) {
+		if (!/^\d+$/.test(part)) throw usageError$1(`--pick ${pick}: "${part}" is not a sample number.`);
+		const n = Number(part);
+		if (n < 1 || n > count) throw usageError$1(count === 0 ? `--pick ${pick}: ${source} holds no samples.` : `--pick ${pick}: ${n} is not a sample number; ${source} holds ${count === 1 ? "sample 1" : `samples 1 to ${count}`}.`);
+		if (!chosen.includes(n)) chosen.push(n);
+	}
+	return chosen;
+}
+/** The samples --pick chooses, by their numbers from 1. */
+function pickSamples(samples, pick, source) {
+	return pickNumbers(pick, samples.length, source).map((n) => samples[n - 1]);
+}
+/**
+* The number a person knows a sample a command sent by: its number in the
+* samples file when --pick took it, else its place from 1 in what was sent.
+* `index` is its place in what was sent, from 0, as the API gives it.
+*/
+function sentSampleNumber(index, flags) {
+	const pick = flags?.[PICK_FLAG];
+	if (typeof pick !== "string") return index + 1;
+	try {
+		return pickNumbers(pick, Number.MAX_SAFE_INTEGER, "")[index] ?? index + 1;
+	} catch {
+		return index + 1;
+	}
+}
+/** The samples file flags: replace (create and update), add (update), and test. */
+const SAMPLES_FILE_FLAG = "expectation-samples-file";
+const ADD_SAMPLES_FILE_FLAG = "add-expectation-samples-file";
+const EXPECT_SAMPLES_FILE_FLAG = "expect-samples-file";
+const PICK_FLAG = "pick";
+/** generate-look-alikes' flag for the file it writes them to. */
+const LOOK_ALIKES_SAMPLES_FILE_FLAG = "samples-file";
+/** The samples a samples file flag names, only those --pick chooses if given. */
+function readSamplesFile(path, flag, pick) {
+	const source = `--${flag} ${path}`;
+	const all = samplesFromJson(readJsonFileFlag(path, `--${flag}`), source);
+	const samples = typeof pick === "string" ? pickSamples(all, pick, source) : all;
+	if (samples.length > 20) throw usageError$1(`${source} holds ${samples.length} samples, and a rule or a test takes at most 20; take some with --pick.`);
+	return samples;
+}
+/** The one of `names` given as a file path, or null; --pick without one is refused. */
+function givenSamplesFlag(flags, names) {
+	const given = names.find((name) => typeof flags[name] === "string") ?? null;
+	if (given === null && typeof flags["pick"] === "string") throw usageError$1(`--pick chooses from a samples file: pass it with ${names.map((name) => `--${name}`).join(" or ")}.`);
+	return given;
+}
+/**
+* The body fields a samples file sets on create-email-rule and
+* update-email-rule: expectation_samples (on update it replaces them) or, on
+* update, add_expectation_samples. With --pick, only the samples it names.
+*/
+function samplesBodyFields(canAdd) {
+	const names = canAdd ? [SAMPLES_FILE_FLAG, ADD_SAMPLES_FILE_FLAG] : [SAMPLES_FILE_FLAG];
+	return (flags) => {
+		const flag = givenSamplesFlag(flags, names);
+		if (flag === null) return [];
+		const path = flags[flag];
+		const samples = readSamplesFile(path, flag, flags[PICK_FLAG]);
+		if (samples.length === 0 && !(canAdd && flag === "expectation-samples-file")) throw usageError$1(`--${flag} ${path} holds no samples.`);
+		return [{
+			flag: `--${flag}`,
+			property: flag === "add-expectation-samples-file" ? "add_expectation_samples" : "expectation_samples",
+			value: samples
+		}];
+	};
+}
+/**
+* The samples test-email-rule expects, from --expect-samples-file (only
+* those --pick chooses if given), or null without the flag. They go in
+* expect.samples.
+*/
+function expectSamples(flags) {
+	const flag = givenSamplesFlag(flags, [EXPECT_SAMPLES_FILE_FLAG]);
+	if (flag === null) return null;
+	const path = flags[flag];
+	const samples = readSamplesFile(path, flag, flags[PICK_FLAG]);
+	if (samples.length === 0) throw usageError$1(`--${flag} ${path} holds no samples.`);
+	return samples;
+}
+/** --pick's help, naming the flags it chooses from. */
+function pickFlagHelp(flags) {
+	return `Take only these samples from ${flags.map((flag) => `--${flag}`).join(" or ")}, by their numbers from 1 as generate-look-alikes printed them: --pick 2,4. A number the file does not hold is refused.`;
+}
+/** What the rule decided for a look-alike, and what its status makes of it. */
+function decidedLine(outcome, status) {
+	if (outcome === "not_decided") return "The rule did not decide it: it was not reached in time, or deciding it failed.";
+	if (outcome === "matched") return status === "undecided" ? "The rule matched it, but it reads a spam score, which a look-alike does not carry, so this one is undecided." : "The rule matched it, so mail like it would be shared.";
+	const decided = outcome === "near_miss" ? "The rule nearly matched it, but did not" : "The rule did not match it";
+	return status === "undecided" ? `${decided}, on something it could not decide (its classification failed, a fact or a question's answer is missing, or it reads a spam score, which a look-alike does not carry), so this one is undecided.` : `${decided}.`;
+}
+/**
+* The stderr report of generate-look-alikes: each look-alike numbered as the
+* samples file numbers it, with its status, kind, subject, sender, why the
+* rule should not match it and what the rule decided; the counts; the
+* answer's note; and how to save the ones you choose. With --samples-file it
+* writes every look-alike there as a must-not-match sample, in that order.
+*/
+function lookAlikesReport(data, request) {
+	const file = request.flags?.[LOOK_ALIKES_SAMPLES_FILE_FLAG];
+	if (!isRecord$1(data)) {
+		if (typeof file !== "string") return { lines: [] };
+		const message = `Did not write --${LOOK_ALIKES_SAMPLES_FILE_FLAG} ${file}: the answer held no look-alikes to write.`;
+		return {
+			lines: [message],
+			exitCode: 1,
+			error: {
+				code: "samples_file_not_written",
+				message
+			}
+		};
+	}
+	const entries = lookAlikeEntries(data);
+	const lines = [];
+	entries.forEach(({ lookAlike }, index) => {
+		const email = lookAlike.email;
+		const from = isRecord$1(email.from) && typeof email.from.address === "string" ? email.from.address : "an unknown sender";
+		const subject = typeof email.subject === "string" && email.subject ? `"${email.subject}"` : "(no subject)";
+		const status = typeof lookAlike.status === "string" ? lookAlike.status : "undecided";
+		const kind = typeof lookAlike.kind === "string" ? lookAlike.kind : "other";
+		const outcome = typeof lookAlike.outcome === "string" ? lookAlike.outcome : "not_decided";
+		lines.push(`${index + 1}. ${status}  ${kind}  ${subject} from ${from}`);
+		if (typeof lookAlike.why === "string" && lookAlike.why.trim()) lines.push(`   Why it should not match: ${lookAlike.why.trim()}`);
+		lines.push(`   ${decidedLine(outcome, status)}`);
+	});
+	const counts = isRecord$1(data.counts) ? data.counts : {};
+	const count = (key) => typeof counts[key] === "number" ? counts[key] : 0;
+	const dropped = count("dropped");
+	lines.push(`Counts: ${count("passed")} passed, ${count("failed")} failed, ${count("undecided")} undecided${dropped > 0 ? `; ${dropped} asked for did not come back` : ""}.`);
+	if (typeof data.note === "string" && data.note.trim()) lines.push(data.note.trim());
+	const numbered = (status) => entries.map(({ lookAlike }, index) => lookAlike.status === status ? index + 1 : 0).filter((n) => n > 0);
+	const matched = numbered("failed");
+	const undecided = numbered("undecided");
+	const chosen = matched.length > 0 ? matched : undecided.length > 0 ? numbered("passed") : [];
+	const pick = chosen.length > 0 ? ` --pick ${chosen.join(",")}` : "";
+	const body = isRecord$1(request.body) ? request.body : {};
+	const ruleId = typeof body.rule_id === "string" ? body.rule_id : null;
+	const requestId = typeof body.request_id === "string" ? body.request_id : null;
+	const target = typeof file === "string" ? shellWord(file) : "<file>";
+	const save = ruleId ? `\`primitive email-rules update-email-rule ${ruleId} --${ADD_SAMPLES_FILE_FLAG} ${target}${pick}\`` : requestId ? `\`primitive email-rules accept-email-rule-request ${requestId} --${SAMPLES_FILE_FLAG} ${target}${pick}\` when the member the request asks accepts it` : `\`primitive email-rules create-email-rule ... --${SAMPLES_FILE_FLAG} ${target}${pick}\` when you save the rule`;
+	const one = (count, single, many) => count === 1 ? single : many;
+	const noneDecided = entries.length > 0 && undecided.length === entries.length ? `None of them was decided (each says why above), so saved as they are they may stay undecided; if the rule reads a spam score, give each email a spam_score${typeof file === "string" ? " in the file" : ""} first.` : "";
+	const which = matched.length > 0 ? `Keep ${one(matched.length, "the one it matched as an email", "the ones it matched as emails")} it must not match` : chosen.length > 0 ? `Keep ${one(chosen.length, "the one it did not match as an email", "the ones it did not match as emails")} it must not match (an undecided one may stay undecided as a sample)` : `Keep ${one(entries.length, "it as an email", "them as emails")} the rule must not match`;
+	const test = matched.length > 0 ? ` Test an edited rule on ${one(matched.length, "it", "them")} with \`primitive email-rules test-email-rule ${ruleId ? `--rule-id ${ruleId}` : "--body-file <body.json>"} --${EXPECT_SAMPLES_FILE_FLAG} ${target}${pick}\`.` : "";
+	if (typeof file === "string") {
+		const samples = entries.map((entry) => entry.sample);
+		if (samples.length === 0) {
+			const message = `Did not write --${LOOK_ALIKES_SAMPLES_FILE_FLAG} ${file}: no look-alikes came back, so it was left as it was.`;
+			return {
+				lines: [...lines, message],
+				exitCode: 1,
+				error: {
+					code: "samples_file_not_written",
+					message
+				}
+			};
+		}
+		try {
+			writeFileSync(file, `${JSON.stringify(samples, null, 2)}\n`);
+		} catch (error) {
+			const message = `Could not write --${LOOK_ALIKES_SAMPLES_FILE_FLAG} ${file}: ${errorDetail(error)}`;
+			return {
+				lines: [
+					...lines,
+					message,
+					"The JSON printed above holds these same look-alikes: save it to a file and give that file instead. Running generate-look-alikes again writes new ones."
+				],
+				exitCode: 1,
+				error: {
+					code: "samples_file_not_written",
+					message
+				}
+			};
+		}
+		const wrote = `Wrote ${one(samples.length, "the look-alike", `the ${samples.length} look-alikes`)} to ${file}, numbered as above.`;
+		lines.push(noneDecided ? `${wrote} ${noneDecided}` : `${wrote} ${which} with ${save}; --pick takes any of the numbers.${test}`);
+	} else if (noneDecided) lines.push(noneDecided);
+	else if (entries.length > 0) lines.push(`${which}: save the JSON printed above to a file and give it to ${save}; --pick takes any of the numbers above.${test}`);
+	return { lines };
+}
 // src/oclif/email-rule-authoring.ts
 const EMAIL_ID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
 /** Whether `id` has the shape of an email id (a UUID). */
@@ -47847,9 +49902,6 @@ function usageError(message) {
 function isRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function errorDetail(error) {
-	return error instanceof Error ? error.message : String(error);
-}
 /** `count` and the word for it: "1 expectation", "2 expectations". */
 function plural$1(count, one, many) {
 	return `${count} ${count === 1 ? one : many}`;
@@ -47890,7 +49942,7 @@ function checkExpectations(value, label) {
 	if (!isRecord(value)) throw usageError(`${label} must hold a JSON object such as {"match": ["<email-id>"], "no_match": ["<email-id>"]}.`);
 	const expectations = {};
 	for (const [key, list] of Object.entries(value)) {
-		if (key !== "match" && key !== "no_match") throw usageError(`${label} takes only "match" and "no_match"; "${key}" is not one of them.`);
+		if (key !== "match" && key !== "no_match") throw usageError(key === "samples" ? `${label} takes emails by id only; give made-up emails with ${label.startsWith("--expectations-file") ? "--expectation-samples-file" : "--expect-samples-file"}.` : `${label} takes only "match" and "no_match"; "${key}" is not one of them.`);
 		if (!Array.isArray(list) || list.some((id) => typeof id !== "string")) throw usageError(`${label}: "${key}" must be a list of email ids.`);
 		const ids = [];
 		const seen = /* @__PURE__ */ new Set();
@@ -47906,33 +49958,19 @@ function checkExpectations(value, label) {
 	assertDisjoint(expectations, label);
 	return expectations;
 }
-/** Read and parse a JSON file a flag names, failing like --body-file does. */
-function readJsonFileFlag(path, flag) {
-	let text;
-	try {
-		text = readFileSync(path, "utf8");
-	} catch (error) {
-		throw new Errors.CLIError(`Could not read ${flag} ${path}: ${errorDetail(error)}`, { exit: 1 });
-	}
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		throw new Errors.CLIError(`${flag} ${path} is not valid JSON: ${errorDetail(error)}`, { exit: 1 });
-	}
-}
-/** `expect` for test-email-rule, from --expect-file or the id flags. */
+/**
+* `expect` for test-email-rule, from --expect-file or the id flags, with the
+* made-up emails --expect-samples-file holds in expect.samples.
+*/
 function expectBodyFields(flags) {
+	const samples = expectSamples(flags);
 	const file = flags["expect-file"];
-	if (typeof file === "string") {
-		const label = `--expect-file ${file}`;
-		return [{
-			flag: "--expect-file",
-			property: "expect",
-			value: checkExpectations(readJsonFileFlag(file, "--expect-file"), label)
-		}];
-	}
 	const expect = {};
 	const given = [];
+	if (typeof file === "string") {
+		Object.assign(expect, checkExpectations(readJsonFileFlag(file, "--expect-file"), `--expect-file ${file}`));
+		given.push("--expect-file");
+	}
 	const match = flags["expect-match"];
 	if (Array.isArray(match)) {
 		expect.match = parseEmailIdList(match, "--expect-match");
@@ -47943,8 +49981,12 @@ function expectBodyFields(flags) {
 		expect.no_match = parseEmailIdList(noMatch, "--expect-no-match");
 		given.push("--expect-no-match");
 	}
-	if (given.length === 0) return [];
 	assertDisjoint(expect, given.join(" and "));
+	if (samples) {
+		expect.samples = samples;
+		given.push(`--${EXPECT_SAMPLES_FILE_FLAG}`);
+	}
+	if (given.length === 0) return [];
 	return [{
 		flag: given.join(", "),
 		property: "expect",
@@ -48081,18 +50123,72 @@ function expectationLine(result, results) {
 	const note = result.status === "undecided" ? undecidedNote(undecidedReason(result, results)) : void 0;
 	return `  ${result.status}: ${result.email_id} expected ${result.expected}, got ${result.outcome}${note ? ` (${note})` : ""}`;
 }
-function expectationsLines(expectations, testResults) {
+/** The made-up emails a test's expectations judged, in order. */
+function sampleJudgments(expectations) {
+	return (isRecord(expectations) && Array.isArray(expectations.samples) ? expectations.samples : []).filter(isRecord).map((item, position) => ({
+		index: typeof item.index === "number" ? item.index : position,
+		label: typeof item.label === "string" ? item.label : null,
+		expected: String(item.expected ?? ""),
+		outcome: String(item.outcome ?? "not_decided"),
+		status: String(item.status ?? "undecided"),
+		question_answers: Array.isArray(item.question_answers) ? item.question_answers.filter(isRecord) : []
+	}));
+}
+function sampleNamer(request) {
+	const sent = isRecord(request?.body) && isRecord(request.body.expect) && Array.isArray(request.body.expect.samples);
+	const fromFile = sent && typeof request?.flags?.["expect-samples-file"] === "string";
+	return ({ index, label }) => {
+		const n = fromFile ? sentSampleNumber(index, request?.flags) : index + 1;
+		const name = sent ? `sample ${n}` : `saved sample ${n}`;
+		return label ? `${name} ("${label}")` : name;
+	};
+}
+/**
+* Why a made-up email is undecided, and whether a later test can decide it:
+* yes when it was not reached or a question went unanswered; maybe not
+* otherwise, since a spam score it does not carry, a fact its
+* classification left out or a failed classification look the same. A
+* spam score left unset makes one undecided even with a question
+* unanswered, which then reads as decidable later: the answer cannot tell.
+*/
+function sampleUndecidedReason(sample) {
+	if (sample.outcome === "not_decided") return {
+		why: "it was not reached in time, or deciding it failed",
+		resolvable: true
+	};
+	const answers = sample.question_answers;
+	if (answers.some((answer) => answer.answer === null) && !answers.some((answer) => answer.answer === false)) return {
+		why: "a question went unanswered",
+		resolvable: true
+	};
+	return {
+		why: "it reads a spam score the sample does not carry, a fact its classification left out, or its classification failed",
+		resolvable: false,
+		may: true
+	};
+}
+function sampleLines(sample, name) {
+	const note = sample.status === "undecided" ? ` (${undecidedNote(sampleUndecidedReason(sample))})` : "";
+	const lines = [`  ${sample.status}: ${name(sample)} expected ${sample.expected}, got ${sample.outcome}${note}`];
+	if (sample.question_answers.length > 0) lines.push(`    questions: ${sample.question_answers.map(answerText).join("; ")}`);
+	return lines;
+}
+function expectationsLines(expectations, testResults, name = sampleNamer()) {
 	if (!expectations) return [];
 	const results = Array.isArray(expectations.results) ? expectations.results : [];
 	const passed = expectations.counts?.passed ?? 0;
 	const failed = expectations.counts?.failed ?? 0;
 	const undecided = expectations.counts?.undecided ?? 0;
 	if (expectations.passed && failed === 0 && undecided === 0) return [`Expectations: all ${passed} passed.`];
-	return [`Expectations: ${[
-		failed > 0 ? `${failed} failed` : "",
-		undecided > 0 ? `${undecided} undecided` : "",
-		`${passed} passed`
-	].filter((part) => part !== "").join(", ")}.`, ...results.filter((result) => result.status !== "passed").map((result) => expectationLine(result, testResults))];
+	return [
+		`Expectations: ${[
+			failed > 0 ? `${failed} failed` : "",
+			undecided > 0 ? `${undecided} undecided` : "",
+			`${passed} passed`
+		].filter((part) => part !== "").join(", ")}.`,
+		...results.filter((result) => result.status !== "passed").map((result) => expectationLine(result, testResults)),
+		...sampleJudgments(expectations).filter((sample) => sample.status !== "passed").flatMap((sample) => sampleLines(sample, name))
+	];
 }
 const NOT_MATCHED_ORDER = {
 	near_miss: 1,
@@ -48154,14 +50250,24 @@ function notMatchedLines(results, expectations) {
 *   test can decide it;
 * - else nothing: the exit code stays 0.
 */
-function expectationsOutcome(expectations, testResults = []) {
+function expectationsOutcome(expectations, testResults = [], name = sampleNamer()) {
 	if (!expectations) return {};
 	const results = Array.isArray(expectations.results) ? expectations.results : [];
-	const failed = results.filter((result) => result.status === "failed").map((result) => result.email_id);
-	const undecided = results.filter((result) => result.status === "undecided").map((result) => ({
+	const samples = sampleJudgments(expectations);
+	const failed = [...results.filter((result) => result.status === "failed").map((result) => result.email_id), ...samples.filter((sample) => sample.status === "failed").map((sample) => name({
+		index: sample.index,
+		label: null
+	}))];
+	const undecided = [...results.filter((result) => result.status === "undecided").map((result) => ({
 		id: result.email_id,
 		reason: undecidedReason(result, testResults)
-	}));
+	})), ...samples.filter((sample) => sample.status === "undecided").map((sample) => ({
+		id: name({
+			index: sample.index,
+			label: null
+		}),
+		reason: sampleUndecidedReason(sample)
+	}))];
 	const unresolvable = undecided.filter(({ reason }) => !reason.resolvable);
 	const failedCount = Math.max(expectations.counts?.failed ?? 0, failed.length);
 	const undecidedCount = Math.max(expectations.counts?.undecided ?? 0, undecided.length);
@@ -48177,7 +50283,7 @@ function expectationsOutcome(expectations, testResults = []) {
 		exitCode: 1,
 		error: {
 			code: "expectations_unresolvable",
-			message: `${plural$1(unresolvable.length, "expectation is", "expectations are")} undecided, and testing again will not decide ${unresolvable.length === 1 ? "it" : "them"}: ${why(unresolvable)}.`
+			message: `${plural$1(unresolvable.length, "expectation is", "expectations are")} undecided, and testing again ${unresolvable.every(({ reason }) => reason.may) ? "may not decide" : "will not decide"} ${unresolvable.length === 1 ? "it" : "them"}: ${why(unresolvable)}.`
 		}
 	};
 	if (undecidedCount > 0) return {
@@ -48190,8 +50296,9 @@ function expectationsOutcome(expectations, testResults = []) {
 	return {};
 }
 /** The stderr report and exit code of a test-email-rule answer. */
-function testEmailRuleReport(data) {
+function testEmailRuleReport(data, request) {
 	if (!isRecord(data)) return { lines: [] };
+	const name = sampleNamer(request);
 	const result = data;
 	const results = Array.isArray(result.results) ? result.results : [];
 	const summary = isRecord(result.summary) ? result.summary : void 0;
@@ -48201,24 +50308,58 @@ function testEmailRuleReport(data) {
 			...scopeWarningLines(result.scope_warnings),
 			...conditionLines(summary),
 			...questionLines(summary, results),
-			...expectationsLines(result.expectations, results),
+			...expectationsLines(result.expectations, results, name),
 			...notMatchedLines(results, result.expectations)
 		],
-		...expectationsOutcome(result.expectations, results)
+		...expectationsOutcome(result.expectations, results, name)
+	};
+}
+/** A list of numbers from 0, as the API gives sample indexes. */
+function indexList(value) {
+	return Array.isArray(value) ? value.filter((n) => typeof n === "number") : [];
+}
+/**
+* How a rule write names a made-up email its check gives by index, from 0 in
+* the set judged: those this write sends in place of the rule's
+* (expectation_samples), or the rule's saved ones oldest first and then
+* those it adds (add_expectation_samples). One this write sent is "sample
+* N", its number in the samples file --pick took it from (or its place in
+* what was sent); any other is "saved sample N", its place among the rule's.
+* With its label when known. `saved` is the answer's expectation_samples,
+* every one the rule keeps after the write, when it has them.
+*/
+function writtenSampleNamer(body, flags, saved) {
+	const sent = isRecord(body) && Array.isArray(body.expectation_samples) ? body.expectation_samples : null;
+	const added = isRecord(body) && Array.isArray(body.add_expectation_samples) ? body.add_expectation_samples : null;
+	const kept = Array.isArray(saved) ? saved : null;
+	const labelled = (name, sample) => isRecord(sample) && typeof sample.label === "string" && sample.label ? `${name} ("${sample.label}")` : name;
+	return (index) => {
+		if (sent) return labelled(`sample ${sentSampleNumber(index, flags)}`, sent[index]);
+		if (added) {
+			const start = kept ? kept.length - added.length : null;
+			if (start === null) return `made-up email ${index + 1}`;
+			if (index >= start) return labelled(`sample ${sentSampleNumber(index - start, flags)}`, added[index - start]);
+		}
+		return labelled(`saved sample ${index + 1}`, kept?.[index]);
 	};
 }
-function expectationsCheckLine(check, ruleId) {
+function expectationsCheckLine(check, ruleId, name = (index) => `saved sample ${index + 1}`) {
 	if (!isRecord(check)) return void 0;
 	const on = typeof check.version === "number" ? `version ${check.version}` : "the current version";
 	const failed = Array.isArray(check.failed) ? check.failed : [];
 	const undecided = Array.isArray(check.undecided) ? check.undecided : [];
-	if (check.passed && failed.length === 0 && undecided.length === 0) return `Expectations on ${on}: all passed.`;
+	const failedSamples = indexList(check.failed_samples);
+	const undecidedSamples = indexList(check.undecided_samples);
+	if (check.passed && failed.length === 0 && undecided.length === 0 && failedSamples.length === 0 && undecidedSamples.length === 0) return `Expectations on ${on}: all passed.`;
 	const parts = [];
 	if (failed.length > 0) parts.push(`${failed.length} failed (${failed.join(", ")})`);
-	else if (undecided.length > 0) parts.push("none failed");
+	if (failedSamples.length > 0) parts.push(`${plural$1(failedSamples.length, "made-up email", "made-up emails")} failed (${failedSamples.map(name).join(", ")})`);
+	if (failed.length === 0 && failedSamples.length === 0 && (undecided.length > 0 || undecidedSamples.length > 0)) parts.push("none failed");
 	if (undecided.length > 0) parts.push(`${undecided.length} undecided (${undecided.join(", ")})`);
-	const rest = undecided.length > 0 ? ` To decide the rest, run \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.` : "";
-	return `Expectations on ${on}: ${parts.length > 0 ? parts.join(", ") : "not passed"}.${rest}`;
+	if (undecidedSamples.length > 0) parts.push(`${plural$1(undecidedSamples.length, "made-up email", "made-up emails")} not judged by this write (${undecidedSamples.map(name).join(", ")})`);
+	const rest = undecided.length > 0 || undecidedSamples.length > 0 ? ` To decide the rest, run \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.` : "";
+	const note = typeof check.note === "string" && check.note.trim() ? ` ${check.note.trim()}` : "";
+	return `Expectations on ${on}: ${parts.length > 0 ? parts.join(", ") : "not passed"}.${rest}${note}`;
 }
 /** The flag that makes a rule write's exit code follow its expectations_check. */
 const FAIL_ON_EXPECTATIONS_FLAG = "fail-on-expectations";
@@ -48230,7 +50371,7 @@ const FAIL_ON_EXPECTATIONS_FLAG = "fail-on-expectations";
 * `passed` as false or as null when nothing failed and something is
 * undecided; any other check that did not pass exits 1.
 */
-function writtenExpectationsOutcome(check, sentExpectations, ruleId) {
+function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "", name = (index) => `saved sample ${index + 1}`) {
 	const test = `\`primitive email-rules test-email-rule --rule-id ${ruleId}\``;
 	if (!isRecord(check)) {
 		if (!sentExpectations) return {};
@@ -48238,52 +50379,115 @@ function writtenExpectationsOutcome(check, sentExpectations, ruleId) {
 			exitCode: 3,
 			error: {
 				code: "expectations_unchecked",
-				message: `The expectations this write sent were not checked on it. Test them with ${test}.`
+				message: `${saved}The expectations this write sent were not checked on it. Test them with ${test}.`
 			}
 		};
 	}
-	const failed = Array.isArray(check.failed) ? check.failed : [];
-	const undecided = Array.isArray(check.undecided) ? check.undecided : [];
+	const failed = [...Array.isArray(check.failed) ? check.failed : [], ...indexList(check.failed_samples).map(name)];
+	const undecidedSamples = indexList(check.undecided_samples);
+	const undecided = [...Array.isArray(check.undecided) ? check.undecided : [], ...undecidedSamples.map(name)];
 	if (failed.length > 0) return {
 		exitCode: 1,
 		error: {
 			code: "expectations_failed",
-			message: `${plural$1(failed.length, "expectation", "expectations")} failed on this write: ${failed.join(", ")}.`
+			message: `${saved}${plural$1(failed.length, "expectation", "expectations")} failed on this write: ${failed.join(", ")}.`
 		}
 	};
 	if (undecided.length > 0) return {
 		exitCode: 3,
 		error: {
 			code: "expectations_undecided",
-			message: `${plural$1(undecided.length, "expectation is", "expectations are")} undecided on this write, which judges them without classifying mail or asking the rule's questions: ${undecided.join(", ")}. Test them with ${test}.`
+			message: `${saved}${plural$1(undecided.length, "expectation is", "expectations are")} undecided on this write, which judges them without classifying mail or asking the rule's questions${undecidedSamples.length > 0 ? ", and leaves made-up emails unjudged" : ""}: ${undecided.join(", ")}. Test them with ${test}.`
 		}
 	};
 	if (check.passed !== true) return {
 		exitCode: 1,
 		error: {
 			code: "expectations_failed",
-			message: "The write's expectations check did not pass."
+			message: `${saved}The write's expectations check did not pass.`
 		}
 	};
 	return {};
 }
+/**
+* update-email-rule's post-save outcome says the write was saved: the server
+* judges a write before saving only when it saves a version or turns the
+* rule active, and refuses with these same codes, saving nothing.
+*/
+const SAVED_UNJUDGED = "The write was saved: the server judges a write before saving only when it saves a version or turns the rule active, so not this one. ";
+/** What a written do_not_share rule's report says first. */
+const BLOCKS_SHARING = "This rule blocks sharing (kind do_not_share): while it is active, no rule shares an email it matches.";
+/** A do_not_share rule's protection_note, as a line, or undefined. */
+function protectionLine(rule) {
+	if (!isRecord(rule)) return void 0;
+	const note = rule.protection_note;
+	return typeof note === "string" && note.trim() ? `Protection: ${note.trim()}` : void 0;
+}
+/** What a restore_version write saved, as its answer says. */
+function restoredLine(restored, currentVersion) {
+	if (!isRecord(restored) || typeof restored.version !== "number") return void 0;
+	const note = typeof restored.note === "string" && restored.note.trim() ? ` ${restored.note.trim()}` : "";
+	const as = typeof currentVersion === "number" ? `as version ${currentVersion}, now current` : "as the current version";
+	return `Saved version ${restored.version} again ${as}.${note}`;
+}
+/**
+* Who an update that saved a version reaches, as its answer counts them: the
+* keys listing the rule, the webhooks those keys own, and the shares the
+* write ended.
+*/
+function affectsLine(affects) {
+	if (!isRecord(affects)) return void 0;
+	const count = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+	const keys = count(affects.keys);
+	const endpoints = count(affects.endpoints);
+	const shares = count(affects.shares_ended);
+	if (keys === void 0 || endpoints === void 0 || shares === void 0) return void 0;
+	return `This version reaches ${plural$1(keys, "API key", "API keys")} listing the rule and ${plural$1(endpoints, "webhook", "webhooks")} those keys own; it ended ${plural$1(shares, "share", "shares")}. The rule keeps its state.`;
+}
+/** The rule's author, by name and email where the answer gives them. */
+function authorLine(author) {
+	if (!isRecord(author) || typeof author.user_id !== "string") return void 0;
+	const name = typeof author.name === "string" && author.name.trim() ? author.name.trim() : null;
+	const email = typeof author.email === "string" && author.email.trim() ? author.email.trim() : null;
+	if (name && email) return `Author: ${name} <${email}>`;
+	if (name || email) return `Author: ${name ?? email}`;
+	return `Author: user ${author.user_id} (name and email not shown to you)`;
+}
 /** The stderr report of a rule written by create-email-rule or update-email-rule. */
 function writtenEmailRuleReport(data, request) {
 	if (!isRecord(data)) return { lines: [] };
 	const rule = data;
 	const ruleId = typeof rule.id === "string" ? rule.id : "<rule-id>";
 	const lines = scopeWarningLines(rule.scope_warnings);
-	if (rule.kind === "do_not_share") lines.unshift(`This rule blocks sharing (kind do_not_share): while it is active, no rule shares an email it matches.${typeof rule.state === "string" && rule.state !== "active" ? " It blocks nothing until it is active." : ""}`);
-	const sentExpectations = isRecord(request.body) && isRecord(request.body.expectations);
-	const checked = expectationsCheckLine(rule.expectations_check, ruleId);
+	if (rule.kind === "do_not_share") {
+		const note = protectionLine(rule);
+		lines.unshift(...note ? [BLOCKS_SHARING, note] : [`${BLOCKS_SHARING}${typeof rule.state === "string" && rule.state !== "active" ? " It blocks nothing until it is active." : ""}`]);
+	}
+	const restored = restoredLine(rule.restored_from, rule.current_version);
+	if (restored) lines.push(restored);
+	const reach = affectsLine(rule.affects);
+	if (reach) lines.push(reach);
+	const sentExpectations = sentExpectationsIn(request.body);
+	const name = writtenSampleNamer(request.body, request.flags, rule.expectation_samples);
+	const checked = expectationsCheckLine(rule.expectations_check, ruleId, name);
 	if (checked) lines.push(checked);
 	else if (sentExpectations) lines.push(`Expectations were not checked on this write. Test them with \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.`);
 	if (request.flags?.["fail-on-expectations"] !== true) return { lines };
 	return {
 		lines,
-		...writtenExpectationsOutcome(rule.expectations_check, sentExpectations, ruleId)
+		...writtenExpectationsOutcome(rule.expectations_check, sentExpectations, ruleId, isUpdate(request) ? SAVED_UNJUDGED : "", name)
 	};
 }
+/** Whether a rule write sent expectations: emails by id, or made-up emails to save or add. */
+function sentExpectationsIn(body) {
+	if (!isRecord(body)) return false;
+	const some = (value) => Array.isArray(value) && value.length > 0;
+	return isRecord(body.expectations) || some(body.expectation_samples) || some(body.add_expectation_samples);
+}
+/** Whether a rule write is an update: it names the rule in its path. */
+function isUpdate(request) {
+	return typeof request.path?.id === "string";
+}
 /**
 * A rule write's exit code when its report cannot be built, under
 * --fail-on-expectations: 1 for a check that is there and did not pass, and 3
@@ -48291,7 +50495,7 @@ function writtenEmailRuleReport(data, request) {
 */
 function writtenFallbackExitCode(data, request) {
 	if (request.flags["fail-on-expectations"] !== true) return void 0;
-	return writtenExpectationsOutcome(isRecord(data) ? data.expectations_check : void 0, isRecord(request.body) && isRecord(request.body.expectations), "<rule-id>").exitCode;
+	return writtenExpectationsOutcome(isRecord(data) ? data.expectations_check : void 0, sentExpectationsIn(request.body), "<rule-id>").exitCode;
 }
 /** The stderr report of get-email-rule-scope. */
 function emailRuleScopeReport(data) {
@@ -48350,9 +50554,156 @@ function versionMovedHint(payload, ruleId) {
 	const read = `Read it again with \`primitive email-rules get-email-rule ${id}\` and reapply your change to what it shows`;
 	return current === void 0 ? `Hint: the rule's version is not the if_version you sent, so nothing was saved, and the answer did not give its current version. ${read}.` : `Hint: the rule's current version is ${current}, not the if_version you sent, so nothing was saved. ${read}, then retry with --if-version ${current}.`;
 }
-/** A write's --fail-on-expectations, the same on create and update. */
-const FAIL_ON_EXPECTATIONS_HELP = "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). Without it the command exits 0 whatever the check says.";
+/** The read-again advice every conflict ends with. */
+function readAgain(id) {
+	return `Read it again with \`primitive email-rules get-email-rule ${id}\` and send the write again`;
+}
+/**
+* The hint for update-email-rule's refusals: an email_rule_conflict by its
+* details.reason (version_moved, revision_moved, expectations_moved,
+* rule_changed), and the expectations guard's expectations_failed,
+* expectations_undecided and no_expectations. Nothing was saved in any of
+* them.
+*/
+function updateEmailRuleErrorHint(code, payload, ruleId, body, flags) {
+	const id = typeof ruleId === "string" && ruleId ? ruleId : "<rule-id>";
+	const details = errorDetails(payload);
+	const guarded = isRecord(body) && body.if_expectations_pass === true;
+	if (code === "email_rule_conflict") switch (details.reason) {
+		case "version_moved": return versionMovedHint(payload, ruleId);
+		case "revision_moved": {
+			const current = typeof details.current_revision === "number" ? details.current_revision : void 0;
+			return current === void 0 ? `Hint: the rule was updated since the if_revision you sent, so nothing was saved. ${readAgain(id)} with --if-revision set to its revision.` : `Hint: the rule is now at revision ${current}, not the if_revision you sent, so nothing was saved. ${readAgain(id)}, reapplying your change to what it shows, with --if-revision ${current}.`;
+		}
+		case "expectations_moved": return `Hint: the rule's saved expectations changed while this write was checked against them, so nothing was saved. ${readAgain(id)}.`;
+		case "rule_changed": return guarded ? `Hint: the rule changed after this write was judged against its expectations and before it was saved, so saving it would have gone unchecked; nothing was saved. ${readAgain(id)}.` : `Hint: the rule changed while this write was being saved, so nothing was saved. ${readAgain(id)}.`;
+		default: return;
+	}
+	if (code === "expectations_failed" || code === "expectations_undecided") {
+		const check = isRecord(details.expectations_check) ? details.expectations_check : {};
+		const failed = Array.isArray(check.failed) ? check.failed : [];
+		const undecided = Array.isArray(check.undecided) ? check.undecided : [];
+		const name = writtenSampleNamer(body, flags);
+		const failedAll = [...failed, ...indexList(check.failed_samples).map(name)];
+		const undecidedSamples = indexList(check.undecided_samples);
+		const undecidedAll = [...undecided, ...undecidedSamples.map(name)];
+		const parts = [...failedAll.length > 0 ? [`failed: ${failedAll.join(", ")}`] : [], ...undecidedAll.length > 0 ? [`undecided: ${undecidedAll.join(", ")}`] : []];
+		const addedOrder = isRecord(body) && Array.isArray(body.add_expectation_samples) && indexList(check.failed_samples).length + undecidedSamples.length > 0 ? " Made-up emails are numbered from 1: the rule's saved ones first, then those this write adds." : "";
+		const which = parts.length > 0 ? ` Expectations ${parts.join("; ")}.${addedOrder}` : "";
+		const reason = String(details.reason);
+		const samplesMayStay = undecidedSamplesMayStay(undecidedSamples.length, reason);
+		const byReason = reason !== "none" && Object.hasOwn(UNDECIDED_NEXT_STEP, reason) ? UNDECIDED_NEXT_STEP[reason] : UNDECIDED_NEXT_STEP.none;
+		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved.${which}${code === "expectations_failed" ? "" : samplesMayStay ? `${undecided.length > 0 ? ` ${byReason}` : ""} ${UNDECIDED_SAMPLES_NEXT_STEP} ${refusedSampleTest(body, id)}` : ` ${byReason}`} The command exits ${updateEmailRuleErrorExitCode(payload) ?? 1}.`;
+	}
+	if (code === "no_expectations") return "Hint: nothing was saved. Give the rule expectations with --expectations-file or made-up emails with --expectation-samples-file or --add-expectation-samples-file (in this write or before it), or send the write without if_expectations_pass (--fail-on-expectations or --if-expectations-pass).";
+}
+/** The reasons a guard's undecided judgment can be decided by sending the write again. */
+const RETRYABLE_REASONS = /* @__PURE__ */ new Set([
+	"deadline",
+	"error",
+	"client_gone"
+]);
+/**
+* A made-up email can stay undecided: one that reads a spam score it does
+* not carry, or whose classification failed or left out a fact the rule
+* needs, decides the same way every time.
+*/
+const UNDECIDED_SAMPLES_NEXT_STEP = "A made-up email undecided for no reason given may stay so (a spam score it does not carry, a fact its classification left out, or a failed classification), so sending the write again may not decide it.";
+/**
+* How to see why a refused write's made-up emails are undecided: only
+* test-email-rule-on-sample answers with what a made-up email lacked. Test
+* the tree this write sent (or the version it restores), else the rule, on
+* each. Nothing was saved, so a test by rule id would see neither.
+*/
+function refusedSampleTest(body, ruleId) {
+	const onSample = "`primitive email-rules test-email-rule-on-sample`";
+	if (isRecord(body) && isRecord(body.tree)) return `To see why, test the tree this write sent on each with ${onSample}.`;
+	if (isRecord(body) && typeof body.restore_version === "number") return `To see why, test version ${body.restore_version}'s tree (\`primitive email-rules list-email-rule-versions ${ruleId} --versions ${body.restore_version}\`) on each with ${onSample}.`;
+	return `To see why, test rule ${ruleId} on each with ${onSample}${isRecord(body) && Array.isArray(body.expectation_samples) ? "" : ` (\`primitive email-rules get-email-rule ${ruleId}\` lists its saved ones)`}.`;
+}
+/** What to do about an undecided judgment, by details.reason ("none": no reason given). */
+const UNDECIDED_NEXT_STEP = {
+	none: "Some could not be decided yet (mail not classified yet, or a question not answered yet); send the write again later.",
+	deadline: "The judgment ran out of time; send the write again.",
+	error: "The judgment could not finish; send the write again.",
+	client_gone: "The request ended before the write was saved; send it again.",
+	author_unresolvable: "The rule cannot run as its author over the mail it would cover (details.author_reason), so sending the write again will not decide them."
+};
+/**
+* update-email-rule's exit code for the expectations guard's refusals: 1 when
+* one failed, or when they may not be decided by trying again (the rule
+* cannot run as its author, or a made-up email is undecided for no reason
+* the answer gives); 3 when trying again later can decide them.
+*/
+function updateEmailRuleErrorExitCode(payload) {
+	const code = isRecord(payload) ? payload.code : void 0;
+	if (code === "expectations_failed") return 1;
+	if (code !== "expectations_undecided") return void 0;
+	const details = errorDetails(payload);
+	if (details.reason === "author_unresolvable") return 1;
+	return undecidedSamplesMayStay(indexList((isRecord(details.expectations_check) ? details.expectations_check : {}).undecided_samples).length, String(details.reason)) ? 1 : 3;
+}
+/**
+* Whether a guard's undecided made-up emails may stay undecided: some are,
+* and the answer gives no reason that sending the write again can change
+* (author_unresolvable has its own advice and exit code).
+*/
+function undecidedSamplesMayStay(count, reason) {
+	return count > 0 && !RETRYABLE_REASONS.has(reason) && reason !== "author_unresolvable";
+}
+/** The stderr report of compile-email-rule: how many recent emails it holds for. */
+function compileEmailRuleReport(data) {
+	if (!isRecord(data)) return { lines: [] };
+	const lines = (Array.isArray(data.warnings) ? data.warnings : []).filter((warning) => typeof warning === "string" && warning.trim() !== "").map((warning) => `Warning: ${warning.trim()}`);
+	const breadth = data.breadth;
+	if (isRecord(breadth) && typeof breadth.checked === "number" && typeof breadth.matched === "number") lines.push(`Breadth: its conditions hold for ${breadth.matched} of ${plural$1(breadth.checked, "recent email", "recent emails")} checked in your own mailboxes, whatever scope you save it with.`);
+	return { lines };
+}
+/** The stderr report of get-email-rule: who wrote it, and its revision. */
+function getEmailRuleReport(data) {
+	if (!isRecord(data)) return { lines: [] };
+	const lines = [];
+	const author = authorLine(data.author);
+	if (author) lines.push(author);
+	const protection = protectionLine(data);
+	if (protection) lines.push(protection);
+	if (typeof data.revision === "number") lines.push(`Revision ${data.revision}: pass --if-revision ${data.revision} to update-email-rule so a change made since is never replaced unseen.`);
+	return { lines };
+}
+/** The stderr report of list-email-rules: the protective rules that protect nothing yet, or less than they seem. */
+function listEmailRulesReport(data) {
+	const rules = Array.isArray(data) ? data : [];
+	const lines = [];
+	for (const rule of rules) {
+		if (!isRecord(rule)) continue;
+		const note = typeof rule.protection_note === "string" ? rule.protection_note.trim() : "";
+		if (!note) continue;
+		const id = typeof rule.id === "string" ? rule.id : "<rule-id>";
+		const name = typeof rule.name === "string" ? rule.name : "no name";
+		lines.push(`Protection of ${id} (${name}): ${note}`);
+	}
+	return { lines };
+}
+/** create-email-rule's --fail-on-expectations: the exit code follows the check made after saving. */
+const FAIL_ON_EXPECTATIONS_HELP = "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). A create does not judge made-up emails, so with some it exits 3. Without it the command exits 0 whatever the check says.";
+/** update-email-rule's --fail-on-expectations: the server refuses the write. */
+const UPDATE_FAIL_ON_EXPECTATIONS_HELP = "Refuse the write unless the rule, as this write would leave it, passes its expectations. It sends if_expectations_pass (over any in --body-file or --raw-body), so the server judges a new version, a restored one, a new scope or turning the rule active before saving, on its emails by id and its made-up emails, and saves nothing when one failed (exit 1), one is undecided (exit 3, or 1 when the rule cannot run as its author or a made-up email is undecided for no reason the answer gives) or the rule has none (exit 1). It can take as long as a test of the rule; the command waits for it. Judging needs a credential that reads the mail's content. A write the server does not judge (one changing only expectations, say) is saved, and the exit code then follows the answer's expectations_check, as on create. With --json, a refused write's document holds the API's error alone; a saved write's holds the rule.";
+/** What a samples file flag reads. */
+const SAMPLES_FILE_SHAPE = "A JSON file of made-up emails the rule must match or not: an array such as [{\"expected\": \"no_match\", \"label\": \"a personal bill\", \"email\": {...}}], with email as test-email-rule-on-sample takes it (text up to 4,000 characters, at most 10 each of to, cc and attachment_types), like the one generate-look-alikes --samples-file writes, or a generate-look-alikes answer saved as it printed it.";
 const EXPECTATION_FLAG_NOTE = "Replaces any expect in --body-file or --raw-body. The answer reports them in expectations (passed, counts, results) and the exit code follows it; see --help-full.";
+/**
+* update-email-rule's --fail-on-expectations sends if_expectations_pass, over
+* any in the body. Asking for it while turning it off is refused.
+*/
+function expectationsGuardBodyFields(flags) {
+	if (flags["fail-on-expectations"] !== true) return [];
+	if (flags["if-expectations-pass"] === false) throw usageError("--fail-on-expectations asks the server to judge the write before saving it; it cannot be combined with --no-if-expectations-pass.");
+	return [{
+		flag: `--${FAIL_ON_EXPECTATIONS_FLAG}`,
+		property: "if_expectations_pass",
+		value: true
+	}];
+}
 const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	testEmailRule: {
 		flags: {
@@ -48367,9 +50718,11 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 				exclusive: ["expect-file"]
 			}),
 			"expect-file": Flags.string({
-				description: "A JSON file holding the request's expect, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}. Not with --expect-match or --expect-no-match.",
+				description: "A JSON file holding the emails the request's expect names by id, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}; made-up emails go in --expect-samples-file. Not with --expect-match or --expect-no-match.",
 				exclusive: ["expect-match", "expect-no-match"]
-			})
+			}),
+			[EXPECT_SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expect.samples (at most 20), beside any emails by id; the answer judges each in expectations.samples (index from 0 over those sent), and the report names each by its number in the file. Like any expect, it replaces a saved rule's own expectations and samples for this test. ${EXPECTATION_FLAG_NOTE}` }),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([EXPECT_SAMPLES_FILE_FLAG]) })
 		},
 		bodyFields: expectBodyFields,
 		bodyProperties: ["expect"],
@@ -48382,23 +50735,67 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	createEmailRule: {
 		flags: {
 			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check (passed, decided, failed, undecided); the report test-email-rule answers with is named expectations instead." }),
+			[SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expectation_samples (at most 20), over any in --body-file or --raw-body. A create does not judge them; test-email-rule --rule-id does.` }),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG]) }),
 			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: FAIL_ON_EXPECTATIONS_HELP })
 		},
-		bodyFields: expectationsBodyFields(false),
-		bodyProperties: ["expectations"],
+		bodyFields: (flags) => [...expectationsBodyFields(false)(flags), ...samplesBodyFields(false)(flags)],
+		bodyProperties: ["expectations", "expectation_samples"],
 		fallbackExitCode: writtenFallbackExitCode,
 		report: writtenEmailRuleReport
 	},
 	updateEmailRule: {
 		flags: {
 			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}, replacing its saved expectations; a file holding null removes them. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check (passed, decided, failed, undecided); the report test-email-rule answers with is named expectations instead." }),
-			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: FAIL_ON_EXPECTATIONS_HELP })
+			[SAMPLES_FILE_FLAG]: Flags.string({
+				description: `${SAMPLES_FILE_SHAPE} They replace the rule's saved ones, and a file holding [] removes them. Sets expectation_samples, over any in --body-file or --raw-body. Not with --${ADD_SAMPLES_FILE_FLAG}. The write judges them only with --${FAIL_ON_EXPECTATIONS_FLAG}, and only when it saves a version or turns the rule active.`,
+				exclusive: [ADD_SAMPLES_FILE_FLAG]
+			}),
+			[ADD_SAMPLES_FILE_FLAG]: Flags.string({
+				description: `${SAMPLES_FILE_SHAPE} They are added to the rule's saved ones, 20 at most in all. Sets add_expectation_samples, over any in --body-file or --raw-body. Not with --${SAMPLES_FILE_FLAG}. The write judges them only with --${FAIL_ON_EXPECTATIONS_FLAG}, and only when it saves a version or turns the rule active.`,
+				exclusive: [SAMPLES_FILE_FLAG]
+			}),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG, ADD_SAMPLES_FILE_FLAG]) }),
+			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: UPDATE_FAIL_ON_EXPECTATIONS_HELP })
 		},
-		bodyFields: expectationsBodyFields(true),
-		bodyProperties: ["expectations"],
+		bodyFields: (flags) => [
+			...expectationsBodyFields(true)(flags),
+			...samplesBodyFields(true)(flags),
+			...expectationsGuardBodyFields(flags)
+		],
+		bodyProperties: [
+			"expectations",
+			"expectation_samples",
+			"add_expectation_samples"
+		],
+		errorExitCode: updateEmailRuleErrorExitCode,
 		fallbackExitCode: writtenFallbackExitCode,
 		report: writtenEmailRuleReport
 	},
+	generateLookAlikes: {
+		flags: { [LOOK_ALIKES_SAMPLES_FILE_FLAG]: Flags.string({ description: `Also write the look-alikes to this JSON file as made-up emails the rule must not match, a JSON array numbered from 1 in the order the report prints them. Save the ones you choose with create-email-rule --${SAMPLES_FILE_FLAG}, update-email-rule --${ADD_SAMPLES_FILE_FLAG} or, for a request, accept-email-rule-request --${SAMPLES_FILE_FLAG}, with --pick; test an edited rule on them with test-email-rule --${EXPECT_SAMPLES_FILE_FLAG}. Replaces the file if it exists, once the call succeeds; when no look-alikes came back it leaves the file as it was and exits 1.` }) },
+		report: lookAlikesReport
+	},
+	acceptEmailRuleRequest: {
+		flags: {
+			[SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expectation_samples (at most 20), over any in --body-file or --raw-body: they are kept on the rule this accept writes, such as the look-alikes of the request it must never match.` }),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG]) })
+		},
+		bodyFields: samplesBodyFields(false),
+		bodyProperties: ["expectation_samples"]
+	},
+	compileEmailRule: {
+		flags: {},
+		report: compileEmailRuleReport
+	},
+	getEmailRule: {
+		flags: {},
+		report: getEmailRuleReport
+	},
+	listEmailRules: {
+		flags: {},
+		report: listEmailRulesReport
+	},
 	getEmailRuleScope: {
 		flags: {},
 		report: emailRuleScopeReport
@@ -49625,7 +52022,6 @@ function serializeErrorPayload(payload) {
 * outcome is unknown.
 */
 function buildThrownSendFailureEnvelope(params) {
-	const message = params.error instanceof Error ? params.error.message : String(params.error);
 	const outcome = params.requestStarted ? "uncertain" : "not_sent";
 	return {
 		outcome,
@@ -49637,7 +52033,7 @@ function buildThrownSendFailureEnvelope(params) {
 		}),
 		sent: null,
 		http_status: null,
-		error: { message },
+		error: thrownErrorBody(params.error),
 		follow_up_commands: params.requestStarted && params.attemptStartedAtIso ? buildSendCommandFollowUps({
 			attemptStartedAtIso: params.attemptStartedAtIso,
 			idempotencyKey: params.idempotencyKey,
@@ -50530,7 +52926,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-3H-rNH8v.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-DNnNhhFr.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)
@@ -51637,7 +54033,7 @@ const OPERATION_ERROR_HINTS = {
 	inviteOrganizationMember: (code, body, payload) => inviteRefusalHint(code, body, payload),
 	createEndpoint: (code, body, payload) => createEndpointRuleRequestHint(code, body, payload),
 	updateEndpoint: (code, body, payload) => updateEndpointRuleRequestHint(code, body, payload),
-	updateEmailRule: (code, _body, payload, path) => code === "email_rule_conflict" ? versionMovedHint(payload, path?.id) : void 0,
+	updateEmailRule: (code, body, payload, path, flags) => updateEmailRuleErrorHint(code, payload, path?.id, body, flags),
 	verifyDomain: (code, _body, payload) => code === "dns_verification_failed" ? domainVerificationFailedHint(payload) : void 0,
 	addDomain: (code, body) => {
 		if (code === "mail_relay_unavailable") return MAIL_RELAY_UNAVAILABLE_MESSAGE;
@@ -51840,7 +54236,7 @@ function createOperationCommand(operation) {
 				}) : await callOperation();
 				if (result.error) {
 					const errorPayload = extractErrorPayload(result.error);
-					const operationErrorHint = OPERATION_ERROR_HINTS[operation.sdkName]?.(extractErrorCode(errorPayload), body, errorPayload, collectValues(operation.pathParams, parsedFlags, operation.sdkName));
+					const operationErrorHint = OPERATION_ERROR_HINTS[operation.sdkName]?.(extractErrorCode(errorPayload), body, errorPayload, collectValues(operation.pathParams, parsedFlags, operation.sdkName), parsedFlags);
 					writeErrorWithHints(errorPayload, result.response, { codeHint: !(operationErrorHint && OPERATION_ERROR_HINTS_REPLACING_CODE_HINT.has(operation.sdkName)) });
 					if (operationErrorHint) process.stderr.write(`${operationErrorHint}\n`);
 					if (stepUpUrl) process.stderr.write(approveThenRerunHint(stepUpUrl));
@@ -51867,7 +54263,7 @@ function createOperationCommand(operation) {
 						}
 					});
 					if (operation.sdkName === "getEmail" && extractErrorCode(errorPayload) === "not_found" && typeof parsedFlags.id === "string") await explainPendingMailNotFound(this.config.configDir, parsedFlags.id);
-					process.exitCode = 1;
+					process.exitCode = extension?.errorExitCode?.(errorPayload) || 1;
 					return;
 				}
 				if (operation.binaryResponse) {
@@ -52005,4 +54401,4 @@ const EMPTY_RESULT_HINTS = {
 function canonicalizeCliReferences(description) {
 	return description.replaceAll("`primitive emails:latest`", "`primitive emails latest`").replaceAll("`primitive describe emails:get-email | jq '.responseSchema.properties'`", "`primitive describe emails:get | jq '.responseSchema.properties'`");
 }
-export { replyExpectation as $, createCliApiClient as $t, bareAddress$1 as A, connectNextSteps as At, wakeReadCommand as B, withFlagSuggestion as Bt, terminalApprovalIo as C, sendWaitClampNotice as Ct, listenForCopyHotkey as D, thrownErrorExitCode as Dt, formatBrowserLoginInstructions as E, successfulSendOutcome as Et, readThreadContext as F, currentMailSessionKey as Ft, clearReadPendingMail as G, isEmailId as Gt, wakeRelationship as H, readCallerMailFor as Ht, sentInThread as I, detectAgentRuntime as It, recordPendingMail as J, ATTACHMENT_WAIT_MAX_MS as Jt, pendingMailPath as K, noFactsMessage as Kt, serverMuted as L, detectRuntimeSession as Lt, displayAddress as M, generatedAgentName as Mt, formatMailWakeLine as N, identitySuggestions as Nt, openBrowser as O, DEFAULT_ENROLL_NAME as Ot, latestOwnOutbound as P, loadSkillLine as Pt, readEmailInteraction as Q, createAuthenticatedCliApiClient as Qt, serverRelationship as R, runtimeSessionVariableList as Rt, promptLine as S, sendOutcomeExitCode as St, canOfferCopyHotkey as T, serializeErrorPayload as Tt, claimPendingMail as U, classificationFactLines as Ut, wakeRecipientField as V, emptyEmailListHint as Vt, clearConsumedPendingMail as W, classificationOf as Wt, interactionHumanLine as X, ConnectedAgentKeyRequiredError as Xt, removePendingMail as Y, withAttachmentWait as Yt, interactionNextActions as Z, SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE as Zt, writeErrorWithHints as _, formatSendFailureSummary as _t, createOperationCommand as a, RESTRICTED_ROLE_NOTE as an, apiResultHttpStatus as at, STEP_UP_TOKEN_FLAG_DESCRIPTION as b, reportSendCommandResult as bt, formatErrorPayload as c, isBuiltInRoleKey as cn, buildThrownSendFailureEnvelope as ct, isGrantRefusal as d, roleKeyText as dn, deriveSendIdempotencyKey as dt, refreshStoredCliCredentials as en, replyInteractionWarning as et, parameterFlagName as f, switchCurrentOrg as fn, excludeSignalReplies as ft, takesStepUp as g, operationManifest as gn, formatPriorRepliesWarning as gt, surfaceUnauthorizedHint as h, setKnownCommands as hn, formatPriorRepliesCheckSkipped as ht, TIME_FLAG_DESCRIPTION as i, CliOrgRefusedError as in, SEND_OUTCOME_HELP as it, describeWake as j, defaultConnectionName as jt, explainPendingMailNotFound as k, cliInvocation as kt, hasControlCharacter as l, revokeUserLogin as ln, checkPriorReplies as lt, runWithTiming as m, sanitizeForTerminal as mn, formatDeletedEarlierSendNotice as mt, API_ERROR_CODES as n, resolveCliApiRequestConfig as nn, IDEMPOTENCY_KEY_FLAG_DESCRIPTION as nt, extractErrorCode as o, credentialsFromUserLogin as on, assertValidIdempotencyKey as ot, readTextFileFlag as p, routeWarningLines as pn, followUpCommandPrefix as pt, readPendingMail as q, ATTACHMENT_WAIT_FLAG_DESCRIPTION as qt, OPERATION_PATH_FLAGS as r, selectedOrgFromEnv as rn, MAX_SEND_WAIT_TIMEOUT_MS as rt, extractErrorPayload as s, fetchCliOrgs as sn, buildFollowUpCommand as st, API_BASE_URL_FLAG_DESCRIPTION as t, refuseOrgSelectionForProfile as tn, wakeInteractionSentence as tt, headerFlagName as u, roleKeyLabel as un, classifySendError as ut, BROWSER_FLAG_DESCRIPTION as v, formatSendRecordFailureSummary as vt, withApproval as w, sentHistoryWindowStart as wt, approveThenRerunHint as x, sendIdentityFields as xt, STEP_UP_HEADER as y, priorRepliesThatWentOut as yt, skillFirstLine as z, formatAlreadySentNotice as zt };
+export { readEmailInteraction as $, SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE as $t, explainPendingMailNotFound as A, cliInvocation as At, skillFirstLine as B, formatAlreadySentNotice as Bt, promptLine as C, sendOutcomeExitCode as Ct, formatBrowserLoginInstructions as D, successfulSendOutcome as Dt, canOfferCopyHotkey as E, serializeErrorPayload as Et, latestOwnOutbound as F, loadSkillLine as Ft, clearConsumedPendingMail as G, classificationFactLines as Gt, wakeRecipientField as H, emptyEmailListHint as Ht, readThreadContext as I, currentMailSessionKey as It, readPendingMail as J, noFactsMessage as Jt, clearReadPendingMail as K, classificationOf as Kt, sentInThread as L, detectAgentRuntime as Lt, describeWake as M, defaultConnectionName as Mt, displayAddress as N, generatedAgentName as Nt, listenForCopyHotkey as O, thrownErrorExitCode as Ot, formatMailWakeLine as P, identitySuggestions as Pt, interactionNextActions as Q, ConnectedAgentKeyRequiredError as Qt, serverMuted as R, detectRuntimeSession as Rt, approveThenRerunHint as S, sendIdentityFields as St, withApproval as T, sentHistoryWindowStart as Tt, wakeRelationship as U, mailReach as Ut, wakeReadCommand as V, withFlagSuggestion as Vt, claimPendingMail as W, readCallerMailFor as Wt, removePendingMail as X, ATTACHMENT_WAIT_MAX_MS as Xt, recordPendingMail as Y, ATTACHMENT_WAIT_FLAG_DESCRIPTION as Yt, interactionHumanLine as Z, withAttachmentWait as Zt, takesStepUp as _, setKnownCommands as _n, formatPriorRepliesWarning as _t, createOperationCommand as a, selectedOrgFromEnv as an, SEND_OUTCOME_HELP as at, STEP_UP_HEADER as b, priorRepliesThatWentOut as bt, formatErrorPayload as c, credentialsFromUserLogin as cn, buildFollowUpCommand as ct, isGrantRefusal as d, revokeUserLogin as dn, classifySendError as dt, createAuthenticatedCliApiClient as en, replyExpectation as et, parameterFlagName as f, roleKeyLabel as fn, deriveSendIdempotencyKey as ft, surfaceUnauthorizedHint as g, sanitizeForTerminal as gn, formatPriorRepliesCheckSkipped as gt, runWithTiming as h, routeWarningLines as hn, formatDeletedEarlierSendNotice as ht, TIME_FLAG_DESCRIPTION as i, resolveCliApiRequestConfig as in, MAX_SEND_WAIT_TIMEOUT_MS as it, bareAddress$1 as j, connectNextSteps as jt, openBrowser as k, DEFAULT_ENROLL_NAME as kt, hasControlCharacter as l, fetchCliOrgs as ln, buildThrownSendFailureEnvelope as lt, refusalDetails as m, switchCurrentOrg as mn, followUpCommandPrefix as mt, API_ERROR_CODES as n, refreshStoredCliCredentials as nn, wakeInteractionSentence as nt, extractErrorCode as o, CliOrgRefusedError as on, apiResultHttpStatus as ot, readTextFileFlag as p, roleKeyText as pn, excludeSignalReplies as pt, pendingMailPath as q, isEmailId as qt, OPERATION_PATH_FLAGS as r, refuseOrgSelectionForProfile as rn, IDEMPOTENCY_KEY_FLAG_DESCRIPTION as rt, extractErrorPayload as s, RESTRICTED_ROLE_NOTE as sn, assertValidIdempotencyKey as st, API_BASE_URL_FLAG_DESCRIPTION as t, createCliApiClient as tn, replyInteractionWarning as tt, headerFlagName as u, isBuiltInRoleKey as un, checkPriorReplies as ut, writeErrorWithHints as v, operationManifest as vn, formatSendFailureSummary as vt, terminalApprovalIo as w, sendWaitClampNotice as wt, STEP_UP_TOKEN_FLAG_DESCRIPTION as x, reportSendCommandResult as xt, BROWSER_FLAG_DESCRIPTION as y, formatSendRecordFailureSummary as yt, serverRelationship as z, runtimeSessionVariableList as zt };