primcli 3.0.0-preview.6 → 3.0.0-preview.8

package/dist/oclif/index.js

@@ -1,14 +1,14 @@
-import { $ as replyExpectation, $t as createCliApiClient, A as bareAddress, At as connectNextSteps, B as wakeReadCommand, Bt as withFlagSuggestion, C as terminalApprovalIo, Ct as sendWaitClampNotice, D as listenForCopyHotkey, Dt as thrownErrorExitCode, E as formatBrowserLoginInstructions, Et as successfulSendOutcome, F as readThreadContext, Ft as currentMailSessionKey, G as clearReadPendingMail, Gt as isEmailId, H as wakeRelationship, Ht as readCallerMailFor, I as sentInThread, It as detectAgentRuntime, J as recordPendingMail, Jt as ATTACHMENT_WAIT_MAX_MS, K as pendingMailPath, Kt as noFactsMessage, L as serverMuted, Lt as detectRuntimeSession, M as displayAddress, Mt as generatedAgentName, N as formatMailWakeLine, Nt as identitySuggestions, O as openBrowser, P as latestOwnOutbound, Pt as loadSkillLine, Q as readEmailInteraction, Qt as createAuthenticatedCliApiClient, R as serverRelationship, Rt as runtimeSessionVariableList, S as promptLine$2, St as sendOutcomeExitCode, T as canOfferCopyHotkey, Tt as serializeErrorPayload, U as claimPendingMail, Ut as classificationFactLines, V as wakeRecipientField, Vt as emptyEmailListHint, W as clearConsumedPendingMail, Wt as classificationOf, X as interactionHumanLine, Xt as ConnectedAgentKeyRequiredError, Y as removePendingMail, Yt as withAttachmentWait, Z as interactionNextActions, _ as writeErrorWithHints, _t as formatSendFailureSummary, a as createOperationCommand, an as RESTRICTED_ROLE_NOTE, at as apiResultHttpStatus, b as STEP_UP_TOKEN_FLAG_DESCRIPTION, bt as reportSendCommandResult, c as formatErrorPayload, cn as isBuiltInRoleKey, ct as buildThrownSendFailureEnvelope, d as isGrantRefusal, dn as roleKeyText, dt as deriveSendIdempotencyKey, en as refreshStoredCliCredentials, et as replyInteractionWarning, f as parameterFlagName, fn as switchCurrentOrg, ft as excludeSignalReplies, g as takesStepUp, gn as operationManifest, gt as formatPriorRepliesWarning, h as surfaceUnauthorizedHint, hn as setKnownCommands, ht as formatPriorRepliesCheckSkipped, i as TIME_FLAG_DESCRIPTION, in as CliOrgRefusedError, it as SEND_OUTCOME_HELP, j as describeWake, k as explainPendingMailNotFound, kt as cliInvocation, l as hasControlCharacter$1, ln as revokeUserLogin, lt as checkPriorReplies, m as runWithTiming, mn as sanitizeForTerminal, mt as formatDeletedEarlierSendNotice, n as API_ERROR_CODES, nn as resolveCliApiRequestConfig, nt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, o as extractErrorCode, on as credentialsFromUserLogin, ot as assertValidIdempotencyKey, p as readTextFileFlag, pn as routeWarningLines, pt as followUpCommandPrefix, q as readPendingMail, qt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, r as OPERATION_PATH_FLAGS, rn as selectedOrgFromEnv, rt as MAX_SEND_WAIT_TIMEOUT_MS, s as extractErrorPayload, sn as fetchCliOrgs, st as buildFollowUpCommand, t as API_BASE_URL_FLAG_DESCRIPTION, tn as refuseOrgSelectionForProfile, u as headerFlagName, un as roleKeyLabel, ut as classifySendError, v as BROWSER_FLAG_DESCRIPTION, vt as formatSendRecordFailureSummary, w as withApproval, wt as sentHistoryWindowStart, x as approveThenRerunHint, xt as sendIdentityFields, y as STEP_UP_HEADER$1, yt as priorRepliesThatWentOut, zt as formatAlreadySentNotice } from "../api-command-CRjIK1QL.js";
-import { $ as parseFromHeader, $n as startAgentClaim, $t as getSendFrom, A as lateMailReread, An as listWakeSchedules, At as downloadEmailAttachmentArchiveMember, B as ensureSearchReportsReplyState, Bn as resendAgentSignupVerification, Bt as getCreditBalance, C as waitOutRetryAfter, Cn as listRepeatingSends, Ct as createWakeSchedule, D as encodeReceivedAtSearchCursor, Dn as listSentEmails, Dt as deleteRoute, E as cursorFromAcceptedRows, En as listSentAttachmentArchiveMembers, Et as deleteMemory, F as AWAITING_VALUES, Ft as getAccessMode, G as queryUsesAwaiting, Gn as searchEmails, Gt as getFunctionTestRunTrace, H as formatRepliesCell, Hn as rotateKey, Ht as getEmail, I as REPLY_STATE_UNSUPPORTED_CODE, In as redeemCreditCode, It as getAccount, Jn as sendEmail, Jt as getMemory, Kn as searchMemories, Kt as getInboxStatus, L as ReplyStateUnsupportedError, Ln as removeDefaultNetworkMember, Lt as getAgentContactPolicy, M as sinceFromFlags, Mn as pullWebhookEvent, N as sleep$3, Nt as downloadSentAttachmentArchiveMember, O as fetchEmailSearchPage, On as listWakeAuthorizations, Ot as deleteWakeAuthorization, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentByFilename, Q as parseWebhookEvent, Qn as simulateRoute, Qt as getRepeatingSend, R as assertAwaitingFilterRows, Rn as reorderRoutes, S as transientFailure, Sn as listOrganizationPeople, St as createWakeAuthorization, T as collectNewAcceptedEmails, Tn as listRoutes, U as hasReplyState, Un as runWakeSchedule, Ut as getFunction, V as formatAwaitingCell, Vn as revokeCredential, Vt as getDefaultNetworkAgent, W as isAwaitingRejectedError, Wt as getFunctionRouting, X as isEmailReceivedEvent, Xn as setFunctionSecret, Xt as getOutboundStatus, Yn as setFunctionRoute, Yt as getOrgRoutingTopology, Zn as setMemory, Zt as getOwnGrant, _ as describeApiFailure, _n as listFunctionLogs, _t as completeWebhookEvent, a as REPEAT_IDLE_MAX_MINUTES, an as listActivityObjects, ar as updateDefaultNetworkMember, at as automatedRejectedError, b as retryTransient, bn as listKeys, bt as createKey, cn as listAgentNetworks, cr as updateRepeatingSend, d as parseRepeatTick, dn as listDefaultNetworkMembers, dr as updateWakeSchedule, dt as addDefaultNetworkMember, en as getSentEmail, er as startAgentSignup, et as AUTOMATED_FILTER_UNSUPPORTED_CODE, f as preparePresenceAliveEmail, fn as listDomains, fr as verifyAgentClaim, ft as cancelSentEmail, g as WaitDeadlineReached, gn as listEndpoints, gt as cliLogout, hn as listEmails, ht as checkSendability, i as REPEAT_EVERY_MAX_MINUTES, in as leaveOrganization, ir as unsetFunctionRoute, it as assertAutomatedVerdict, j as quoteDslValue, jn as pollCliLogin, jt as downloadEmailAttachmentByFilename, k as filtersFromFlags, kn as listWakeDispatches, kt as deleteWakeSchedule, l as parseInteractionEnvelope, lr as updateRoute, lt as hasAutomatedVerdict, m as repeatStopCommand, mn as listEmailRuleResults, mr as whoami, mt as checkDefaultNetworkContactAdmission, nn as getWakeSchedule, nr as stopRepeatFromEmail, nt as AUTOMATED_VALUES, o as REPEAT_MAX_SENDS_MAX, or as updateFunction, p as prepareSignalEmail, pn as listEmailAttachmentArchiveMembers, pr as verifyAgentSignup, pt as cancelSentEmailByIdempotencyKey, qn as semanticSearch, qt as getKey, rr as testFunction, rt as AutomatedFilterUnsupportedError, s as buildRepeatStopBody, sn as listAgentContacts, sr as updateKey, tn as getThread, tr as startCliLogin, tt as AUTOMATED_FLAG_DESCRIPTION, u as parsePresenceEnvelope, un as listDefaultNetworkAgents, ur as updateWakeAuthorization, ut as isAutomatedRejectedError, vn as listFunctions, vt as createEndpoint, w as SINCE_VALUE_HELP, wn as listRoles, x as retryingOperation, xn as listMailboxAccess, xt as createRoute, y as pauseForTransientFailure, yn as listGroups, yt as createFunction, z as awaitingRejectedError, zn as replyToEmail, zt as getConversation } from "../repeats-Dj_o6c-X-CP0h4alF.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-DTyg-sfS.js";
+import { $ as readEmailInteraction, A as explainPendingMailNotFound, At as cliInvocation, Bt as formatAlreadySentNotice, C as promptLine$2, Ct as sendOutcomeExitCode, D as formatBrowserLoginInstructions, Dt as successfulSendOutcome, E as canOfferCopyHotkey, Et as serializeErrorPayload, F as latestOwnOutbound, Ft as loadSkillLine, G as clearConsumedPendingMail, Gt as classificationFactLines, H as wakeRecipientField, Ht as emptyEmailListHint, I as readThreadContext, It as currentMailSessionKey, J as readPendingMail, Jt as noFactsMessage, K as clearReadPendingMail, Kt as classificationOf, L as sentInThread, Lt as detectAgentRuntime, M as describeWake, N as displayAddress, Nt as generatedAgentName, O as listenForCopyHotkey, Ot as thrownErrorExitCode, P as formatMailWakeLine, Pt as identitySuggestions, Q as interactionNextActions, Qt as ConnectedAgentKeyRequiredError, R as serverMuted, Rt as detectRuntimeSession, S as approveThenRerunHint, St as sendIdentityFields, T as withApproval, Tt as sentHistoryWindowStart, U as wakeRelationship, Ut as mailReach, V as wakeReadCommand, Vt as withFlagSuggestion, W as claimPendingMail, Wt as readCallerMailFor, X as removePendingMail, Xt as ATTACHMENT_WAIT_MAX_MS, Y as recordPendingMail, Yt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Z as interactionHumanLine, Zt as withAttachmentWait, _ as takesStepUp, _n as setKnownCommands, _t as formatPriorRepliesWarning, a as createOperationCommand, an as selectedOrgFromEnv, at as SEND_OUTCOME_HELP, b as STEP_UP_HEADER$1, bt as priorRepliesThatWentOut, c as formatErrorPayload, cn as credentialsFromUserLogin, ct as buildFollowUpCommand, d as isGrantRefusal, dn as revokeUserLogin, dt as classifySendError, en as createAuthenticatedCliApiClient, et as replyExpectation, f as parameterFlagName, fn as roleKeyLabel, ft as deriveSendIdempotencyKey, g as surfaceUnauthorizedHint, gn as sanitizeForTerminal, gt as formatPriorRepliesCheckSkipped, h as runWithTiming, hn as routeWarningLines, ht as formatDeletedEarlierSendNotice, i as TIME_FLAG_DESCRIPTION, in as resolveCliApiRequestConfig, it as MAX_SEND_WAIT_TIMEOUT_MS, j as bareAddress, jt as connectNextSteps, k as openBrowser, l as hasControlCharacter$1, ln as fetchCliOrgs, lt as buildThrownSendFailureEnvelope, m as refusalDetails, mn as switchCurrentOrg, mt as followUpCommandPrefix, n as API_ERROR_CODES, nn as refreshStoredCliCredentials, o as extractErrorCode, on as CliOrgRefusedError, ot as apiResultHttpStatus, p as readTextFileFlag, pn as roleKeyText, pt as excludeSignalReplies, q as pendingMailPath, qt as isEmailId, r as OPERATION_PATH_FLAGS, rn as refuseOrgSelectionForProfile, rt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, s as extractErrorPayload, sn as RESTRICTED_ROLE_NOTE, st as assertValidIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createCliApiClient, tt as replyInteractionWarning, u as headerFlagName, un as isBuiltInRoleKey, ut as checkPriorReplies, v as writeErrorWithHints, vn as operationManifest, vt as formatSendFailureSummary, w as terminalApprovalIo, wt as sendWaitClampNotice, x as STEP_UP_TOKEN_FLAG_DESCRIPTION, xt as reportSendCommandResult, y as BROWSER_FLAG_DESCRIPTION, yt as formatSendRecordFailureSummary, z as serverRelationship, zt as runtimeSessionVariableList } from "../api-command-TUwewvqZ.js";
+import { $ as parseFromHeader, $n as startAgentClaim, $t as getSendFrom, A as lateMailReread, An as listWakeSchedules, At as downloadEmailAttachmentArchiveMember, B as ensureSearchReportsReplyState, Bn as resendAgentSignupVerification, Bt as getCreditBalance, C as waitOutRetryAfter, Cn as listRepeatingSends, Ct as createWakeSchedule, D as encodeReceivedAtSearchCursor, Dn as listSentEmails, Dt as deleteRoute, E as cursorFromAcceptedRows, En as listSentAttachmentArchiveMembers, Et as deleteMemory, F as AWAITING_VALUES, Ft as getAccessMode, G as queryUsesAwaiting, Gn as searchEmails, Gt as getFunctionTestRunTrace, H as formatRepliesCell, Hn as rotateKey, Ht as getEmail, I as REPLY_STATE_UNSUPPORTED_CODE, In as redeemCreditCode, It as getAccount, Jn as sendEmail, Jt as getMemory, Kn as searchMemories, Kt as getInboxStatus, L as ReplyStateUnsupportedError, Ln as removeDefaultNetworkMember, Lt as getAgentContactPolicy, M as sinceFromFlags, Mn as pullWebhookEvent, N as sleep$3, Nt as downloadSentAttachmentArchiveMember, O as fetchEmailSearchPage, On as listWakeAuthorizations, Ot as deleteWakeAuthorization, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentByFilename, Q as parseWebhookEvent, Qn as simulateRoute, Qt as getRepeatingSend, R as assertAwaitingFilterRows, Rn as reorderRoutes, S as transientFailure, Sn as listOrganizationPeople, St as createWakeAuthorization, T as collectNewAcceptedEmails, Tn as listRoutes, U as hasReplyState, Un as runWakeSchedule, Ut as getFunction, V as formatAwaitingCell, Vn as revokeCredential, Vt as getDefaultNetworkAgent, W as isAwaitingRejectedError, Wt as getFunctionRouting, X as isEmailReceivedEvent, Xn as setFunctionSecret, Xt as getOutboundStatus, Yn as setFunctionRoute, Yt as getOrgRoutingTopology, Zn as setMemory, Zt as getOwnGrant, _ as describeApiFailure, _n as listFunctionLogs, _t as completeWebhookEvent, a as REPEAT_IDLE_MAX_MINUTES, an as listActivityObjects, ar as updateDefaultNetworkMember, at as automatedRejectedError, b as retryTransient, bn as listKeys, bt as createKey, cn as listAgentNetworks, cr as updateRepeatingSend, d as parseRepeatTick, dn as listDefaultNetworkMembers, dr as updateWakeSchedule, dt as addDefaultNetworkMember, en as getSentEmail, er as startAgentSignup, et as AUTOMATED_FILTER_UNSUPPORTED_CODE, f as preparePresenceAliveEmail, fn as listDomains, fr as verifyAgentClaim, ft as cancelSentEmail, g as WaitDeadlineReached, gn as listEndpoints, gt as cliLogout, hn as listEmails, ht as checkSendability, i as REPEAT_EVERY_MAX_MINUTES, in as leaveOrganization, ir as unsetFunctionRoute, it as assertAutomatedVerdict, j as quoteDslValue, jn as pollCliLogin, jt as downloadEmailAttachmentByFilename, k as filtersFromFlags, kn as listWakeDispatches, kt as deleteWakeSchedule, l as parseInteractionEnvelope, lr as updateRoute, lt as hasAutomatedVerdict, m as repeatStopCommand, mn as listEmailRuleResults, mr as whoami, mt as checkDefaultNetworkContactAdmission, nn as getWakeSchedule, nr as stopRepeatFromEmail, nt as AUTOMATED_VALUES, o as REPEAT_MAX_SENDS_MAX, or as updateFunction, p as prepareSignalEmail, pn as listEmailAttachmentArchiveMembers, pr as verifyAgentSignup, pt as cancelSentEmailByIdempotencyKey, qn as semanticSearch, qt as getKey, rr as testFunction, rt as AutomatedFilterUnsupportedError, s as buildRepeatStopBody, sn as listAgentContacts, sr as updateKey, tn as getThread, tr as startCliLogin, tt as AUTOMATED_FLAG_DESCRIPTION, u as parsePresenceEnvelope, un as listDefaultNetworkAgents, ur as updateWakeAuthorization, ut as isAutomatedRejectedError, vn as listFunctions, vt as createEndpoint, w as SINCE_VALUE_HELP, wn as listRoles, x as retryingOperation, xn as listMailboxAccess, xt as createRoute, y as pauseForTransientFailure, yn as listGroups, yt as createFunction, z as awaitingRejectedError, zn as replyToEmail, zt as getConversation } from "../repeats-Dj_o6c-X-DNbrLjEF.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-CeIflLIX.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-3H-rNH8v.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-CvqdlWuX.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-DNnNhhFr.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-Dd3P8Q-m.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CPxRPbHK.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-DZQemE9I.js";
+import { a as thrownErrorBody, i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-ch756TXV.js";
 import { a as backgroundListenStatus, c as runBackgroundListen, d as stopBackgroundListen, f as verifyBackgroundListenTarget, o as backgroundListenToken, r as backgroundListenConfiguration, u as startBackgroundListen } from "../listen-background-DyBYca28.js";
-import { i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-DWrJMakZ.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
 import { n as createConfig, t as createClient } from "../client.gen-6rZvmHfx.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
@@ -5317,7 +5317,7 @@ const openapiDocument = {
 						} }
 					},
 					"503": {
-						"description": "Local receiving is unavailable",
+						"description": "Local receiving is unavailable (pull_unavailable), or the subscription was too busy to claim from in time (service_unavailable): nothing was claimed, so retry the pull after Retry-After",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					}
 				},
@@ -21978,7 +21978,7 @@ const openapiDocument = {
 		"/email-rules/compile": { "post": {
 			"operationId": "compileEmailRule",
 			"summary": "Compile a rule description",
-			"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default), so a warning can say when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to five yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22107,7 +22107,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids (with the expected emails), 1 to 100 expected emails none in both lists, and a tree that is valid for the column contract. evaluation_scope, scope_selection and kind go only with tree. A saved rule whose current version no longer renders answers details.reason version_not_renderable; email_ids that with its saved expectations name over 200 emails, too_many_emails.",
+					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids (with the expected emails), 1 to 100 expected emails none in both lists (or only expect.samples, up to 20), and a tree that is valid for the column contract. evaluation_scope, scope_selection and kind go only with tree. A saved rule whose current version no longer renders answers details.reason version_not_renderable; email_ids that with its saved expectations name over 200 emails, too_many_emails.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -22178,6 +22178,111 @@ const openapiDocument = {
 				}
 			}]
 		} },
+		"/email-rules/look-alikes": { "post": {
+			"operationId": "generateLookAlikes",
+			"summary": "Write look-alike emails a rule should not match",
+			"description": "Writes made-up emails that come close to what a grant rule describes but are private (a personal medical bill, pay for named people, a personal purchase, personal banking or tax, or another near case), and reports what the rule decides for each, as test-sample would. failed means the rule matched it, so it would be shared. Nothing is stored and no mail is read. Keep the ones it must never match with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/GenerateLookAlikesRequest" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Write look-alike emails a rule should not match",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/GenerateLookAlikesResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"400": {
+					"description": "validation_error: give exactly one of tree, rule_id and request_id, and a tree valid for the column contract; details.reason do_not_share for a do-not-share rule, no_address when no sign-in address was found and no to given, version_not_renderable for a saved version or a request's rule that no longer fits.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_scope_not_readable: scope_selection names something you cannot read.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: rule_id names no rule you can see (details.reason rule_not_found), or request_id no rule request you can see (request_not_found).",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"409": {
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree or a request, you). email_rule_request_not_pending: request_id names a request already decided.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"422": {
+					"description": "email_rule_look_alikes_not_written: the model declined, ran out of room or time, or wrote none that fit (details.reason refused, truncated, deadline or invalid).",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				},
+				"503": {
+					"description": "email_rule_compiler_unavailable: the model, or the classifier that decides each, is not available or could not be reached.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				}
+			},
+			"x-primitive-permission": ["mail:read"],
+			"parameters": [{
+				"name": "Idempotency-Key",
+				"in": "header",
+				"required": false,
+				"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 255
+				}
+			}]
+		} },
 		"/email-rules/test-sample": { "post": {
 			"operationId": "testEmailRuleOnSample",
 			"summary": "Test a rule against a made-up email",
@@ -22279,7 +22384,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRule",
 				"summary": "Create a rule",
-				"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated). You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated), or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -22375,7 +22480,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "listEmailRules",
 				"summary": "List rules",
-				"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule). With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule) and current_version, but not the version's text: read that under current from GET /email-rules/{id}. With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [
@@ -22498,7 +22603,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEmailRule",
 				"summary": "Read a rule",
-				"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. The current version's text (english, tree, explanation, assumptions, warnings) is under current, and current_version is its number. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22613,7 +22718,7 @@ const openapiDocument = {
 			"patch": {
 				"operationId": "updateEmailRule",
 				"summary": "Change a rule",
-				"description": "Renames the rule, saves a new version (english and tree together, with an explanation or one the server writes; earlier versions stay), changes its state (draft is off; observe; active), whose mail it runs over (evaluation_scope, with scope_selection when selected) or its saved expectations (each saved version and new set is judged in expectations_check). Anyone but its author who sees it may only disable it (state draft), and while it is shared only if they manage members from the dashboard. Without evaluation_scope the scope stays; a scope change saves a new version with the same conditions, and what was granted stays. A shared rule keeps its scope; a kind never changes. Send if_version, the current_version you read, so a write never replaces a version saved since. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Renames the rule, saves a new version (english and tree together, with an explanation or one the server writes; earlier versions stay) or an earlier one again (restore_version), changes its state (draft is off; observe; active), whose mail it runs over (evaluation_scope, with scope_selection when selected) or its saved expectations (each saved version and new set is judged in expectations_check). Anyone but its author who sees it may only disable it (state draft), and while it is shared only if they manage members from the dashboard. Without evaluation_scope the scope stays; a scope change saves a new version with the same conditions, and what was granted stays. A shared rule keeps its scope; a kind never changes. A saved version takes effect at once (an active rule stays active); affects counts what it reaches. Send if_version, the current_version you read, so a write never replaces a version saved since, or if_revision to refuse it after any update. Without if_expectations_pass a version is saved even when its expectations_check fails. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22646,17 +22751,8 @@ const openapiDocument = {
 						}
 					},
 					"400": {
-						"description": "Invalid request parameters",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "validation_error",
-									"message": "Invalid domain format"
-								}
-							}
-						} }
+						"description": "validation_error: invalid body or tree (details.errors), too large (too_large), a version that no longer renders (version_not_renderable), restore_version names the current version (already_current), or over 20 made-up emails (too_many_expectation_samples). no_expectations: if_expectations_pass with no expectations to judge; nothing was saved.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"401": {
 						"description": "Invalid or missing API key",
@@ -22678,24 +22774,15 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden with details.reason rule_shared: the rule is shared with another member, so only its author, or someone who manages members from the dashboard, can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read.",
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden (rule_shared): the rule is shared, so only its author or a member manager can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read. grant_forbidden (mail_depth): if_expectations_pass needs content access to mail when it judges emails by id.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
-						"description": "Resource not found",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "not_found",
-									"message": "Resource not found"
-								}
-							}
-						} }
+						"description": "not_found: no such rule you can see, or restore_version names no version of it (details.reason version_not_found).",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"409": {
-						"description": "email_rule_conflict: the rule changed while saving, or (details.reason version_moved, with details.current_version) its current version differs from if_version; read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope.",
+						"description": "email_rule_conflict: the rule changed (details.reason version_moved with current_version, revision_moved with current_revision, expectations_moved or rule_changed); read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope. expectations_failed or expectations_undecided (if_expectations_pass): nothing was saved; details carries current_version, state and expectations_check.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -23713,7 +23800,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEmailRuleRequest",
 				"summary": "Read a rule request",
-				"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -24090,7 +24177,7 @@ const openapiDocument = {
 		"/email-rule-requests/{id}/accept": { "post": {
 			"operationId": "acceptEmailRuleRequest",
 			"summary": "Accept a rule request",
-			"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Made-up emails sent in expectation_samples are kept on the rule this writes, where GET /v1/email-rules/{id} lists them. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24127,7 +24214,7 @@ const openapiDocument = {
 					}] } } }
 				},
 				"400": {
-					"description": "validation_error: a changed rule needs english and tree together, and a tree that is valid for the column contract. The rule as asked is checked the same way, and must be changed first if it no longer passes.",
+					"description": "validation_error: a changed rule needs english and tree together, and a tree that is valid for the column contract. The rule as asked is checked the same way, and must be changed first if it no longer passes. Made-up emails in expectation_samples are checked as on a rule write (at most 20, each within the sample bounds). Nothing is accepted.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -32286,7 +32373,7 @@ const openapiDocument = {
 			"summary": "Revoke a credential",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true and revoked 0, to a caller who could have revoked it; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
+			"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked by the person who holds it, whatever it reaches, or by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. Revoking an API key also revokes the keys it replaced in its rotation that are still in their overlap and that you may revoke (predecessors_revoked_count; predecessors_left counts the rest), so its webhooks stop at once; the keys that replaced it carry its work on. Revoking a key already revoked does the same for those keys. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from, each saying whether anything still acts for it (still_acting, with the key in acting_key_id) and, for a webhook, whether it is still delivering. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true, to a caller who could have revoked it, and revoked counts only the keys it replaced that were revoked now; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session_or_cli" },
 			"parameters": [{
 				"name": "Primitive-Step-Up",
@@ -33400,7 +33487,7 @@ const openapiDocument = {
 			"summary": "Rotate an API key",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 			"x-primitive-person-only": {
 				"access": "step_up",
 				"step_up_purpose": "keys.create",
@@ -33567,7 +33654,7 @@ const openapiDocument = {
 				"summary": "Change an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. The one exception is suspending a key (suspended true with no other change; expected_grant_ref may accompany it), which the person who holds it may do whatever the key reaches, calling as themself rather than through another app; lifting a suspension is a change like any other. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 				"x-primitive-person-only": {
 					"access": "step_up",
 					"step_up_purpose": "keys.create",
@@ -37383,7 +37470,7 @@ const openapiDocument = {
 		"/access-suspensions/{id}/decision": { "post": {
 			"operationId": "decideSuspension",
 			"summary": "Decide a suspension",
-			"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
+			"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it needs the decider to cover it, and so does revoking an API key unless the decider holds it and decides as themself rather than through another app (revoking an uncovered key someone else holds is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
 			"tags": ["Roles and members"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -39307,6 +39394,7 @@ const openapiDocument = {
 									"email_rule_author_unresolvable",
 									"email_rule_compiler_unavailable",
 									"email_rule_conflict",
+									"email_rule_look_alikes_not_written",
 									"email_rule_not_compiled",
 									"email_rule_request_limit",
 									"email_rule_request_not_pending",
@@ -39320,6 +39408,8 @@ const openapiDocument = {
 									"email_rule_share_limit",
 									"embedding_provider_unavailable",
 									"entitlement",
+									"expectations_failed",
+									"expectations_undecided",
 									"expired",
 									"feature_not_enabled",
 									"fresh_send_not_authorized",
@@ -39394,6 +39484,7 @@ const openapiDocument = {
 									"network_view_denied",
 									"no_code",
 									"no_endpoint",
+									"no_expectations",
 									"no_mail_read",
 									"not_a_template_install",
 									"not_available",
@@ -39445,6 +39536,7 @@ const openapiDocument = {
 									"semantic_search_not_enabled",
 									"send_failed",
 									"sender_not_authorized",
+									"sending_ip_warmup_cap",
 									"sent_email_tail_unavailable",
 									"sent_mail_search_unavailable",
 									"shopping_binding_conflict",
@@ -46240,12 +46332,12 @@ const openapiDocument = {
 					},
 					"retry_scheduled": {
 						"type": ["boolean", "null"],
-						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will."
+						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. A rule-granted delivery is retried on a schedule of its own, to the same endpoint, deciding it afresh: on its latest attempt true while another attempt is to come (the delivery's next_attempt_at says when); null while an attempt is under way (read it again shortly), while it waits on an owner who cannot receive mail or on a held endpoint (checked again hourly, and sent once that clears), when it is past its 7-day limit, or when that could not be read just now; and false otherwise, including once the endpoint is off or already has the email. Null on every attempt of a delivery retried or settled on a schedule of its own that this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will."
 					},
 					"next_attempt_at": {
 						"type": ["string", "null"],
 						"format": "date-time",
-						"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled."
+						"description": "When the next automatic attempt of a rule-granted delivery is due: set on its latest attempt while retry_scheduled is true. The attempt runs at the first retry pass at or after this time (one runs every few minutes), so a time already past means it is due now. Null otherwise, and on every delivery that is not rule-granted, whose retries are passes for the email with no time reported (whether one is coming is retry_scheduled)."
 					}
 				},
 				"required": [
@@ -49452,6 +49544,22 @@ const openapiDocument = {
 					"questions"
 				]
 			},
+			"EmailRuleBreadth": {
+				"type": "object",
+				"properties": {
+					"checked": {
+						"type": "integer",
+						"minimum": 0,
+						"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+					},
+					"matched": {
+						"type": "integer",
+						"minimum": 0,
+						"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+					}
+				},
+				"required": ["checked", "matched"]
+			},
 			"CompileEmailRuleRequest": {
 				"type": "object",
 				"properties": {
@@ -49480,7 +49588,7 @@ const openapiDocument = {
 					"tree": { "$ref": "#/components/schemas/EmailRuleTree" },
 					"explanation": {
 						"type": "string",
-						"description": "What the rule matches, in plain English."
+						"description": "What the rule matches, in plain English: only which emails, not what it grants or shares, which follows from its state, its scope and the keys, webhooks and people it reaches. The compiler leaves out a sentence that plainly says what the rule hands over."
 					},
 					"assumptions": {
 						"type": "array",
@@ -49490,12 +49598,16 @@ const openapiDocument = {
 					"warnings": {
 						"type": "array",
 						"items": { "type": "string" },
-						"description": "Parts of the description the column contract cannot express, and how the rule handles them. When the rule reads automated or from_mailing_list, it also has a note on what that column reads and what it misses. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
+						"description": "Parts of the description the column contract cannot express, and how the rule handles them. It also has notes on reading automated, from_mailing_list or sender_relationship, a sender address the description does not give, and a grant worded as a prohibition. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
 					},
 					"compiled_by": {
 						"type": "string",
 						"description": "An opaque name for the version of the rule compiler that produced the rule, such as rule-compiler-v1. Send it back as compiled_by when you save the rule."
 					},
+					"breadth": {
+						"description": "How many of your recent emails its conditions hold for, counted over your own mailboxes whatever scope you save it with, warning or not. Null when not counted in full: a rule with questions, headers-only access, no test of it possible as you, or a count that failed or ran out of time. Writes ignore it, so a compile answer (without include_sql) can be sent back unchanged.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
 					"sql": {
 						"description": "Present only when include_sql was true.",
 						"type": "object",
@@ -49547,6 +49659,67 @@ const openapiDocument = {
 					"message"
 				]
 			},
+			"EmailRuleSampleJudgment": {
+				"type": "object",
+				"properties": {
+					"index": {
+						"type": "integer",
+						"minimum": 0
+					},
+					"sample_id": {
+						"type": ["string", "null"],
+						"format": "uuid"
+					},
+					"label": { "type": ["string", "null"] },
+					"expected": {
+						"type": "string",
+						"enum": ["match", "no_match"]
+					},
+					"outcome": {
+						"type": "string",
+						"enum": [
+							"matched",
+							"near_miss",
+							"no_match",
+							"not_decided"
+						]
+					},
+					"status": {
+						"type": "string",
+						"enum": [
+							"passed",
+							"failed",
+							"undecided"
+						]
+					},
+					"question_answers": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"question": { "type": "string" },
+								"answer": { "type": ["boolean", "null"] },
+								"probability": { "type": ["number", "null"] },
+								"error_class": { "type": "string" }
+							},
+							"required": [
+								"question",
+								"answer",
+								"probability"
+							]
+						}
+					}
+				},
+				"required": [
+					"index",
+					"sample_id",
+					"label",
+					"expected",
+					"outcome",
+					"status",
+					"question_answers"
+				]
+			},
 			"EmailRuleTreeInput": {
 				"type": "object",
 				"properties": {
@@ -49604,6 +49777,107 @@ const openapiDocument = {
 				"additionalProperties": false,
 				"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
 			},
+			"EmailRuleExpectationSampleInput": {
+				"type": "object",
+				"properties": {
+					"expected": {
+						"type": "string",
+						"enum": ["match", "no_match"]
+					},
+					"label": {
+						"type": ["string", "null"],
+						"minLength": 1,
+						"maxLength": 200,
+						"pattern": "^[^\\u0000]*$",
+						"description": "What the email stands for, such as a personal medical bill."
+					},
+					"email": { "$ref": "#/components/schemas/EmailRuleSavedSampleEmail" },
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"created_at": { "type": "string" }
+				},
+				"required": ["expected", "email"],
+				"additionalProperties": false
+			},
+			"EmailRuleSavedSampleEmail": {
+				"type": "object",
+				"properties": {
+					"from": {
+						"type": "object",
+						"properties": {
+							"address": {
+								"type": "string",
+								"maxLength": 254,
+								"format": "email",
+								"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+							},
+							"name": {
+								"type": "string",
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$"
+							}
+						},
+						"required": ["address"]
+					},
+					"to": {
+						"minItems": 1,
+						"maxItems": 10,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"maxLength": 254,
+							"format": "email",
+							"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+						}
+					},
+					"cc": {
+						"maxItems": 10,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"maxLength": 254,
+							"format": "email",
+							"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+						}
+					},
+					"subject": {
+						"type": "string",
+						"maxLength": 998,
+						"pattern": "^[^\\u0000]*$"
+					},
+					"text": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 4e3,
+						"pattern": "^[^\\u0000]*$"
+					},
+					"attachment_types": {
+						"maxItems": 10,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 255,
+							"pattern": "^[^\\u0000]*$"
+						}
+					},
+					"automated": { "type": "boolean" },
+					"from_mailing_list": { "type": "boolean" },
+					"spam_score": {
+						"type": "number",
+						"minimum": -1e3,
+						"maximum": 1e3
+					}
+				},
+				"required": [
+					"from",
+					"to",
+					"text"
+				],
+				"description": "A made-up email, as POST /email-rules/test-sample takes it."
+			},
 			"TestEmailRuleRequest": {
 				"type": "object",
 				"properties": {
@@ -49663,10 +49937,15 @@ const openapiDocument = {
 									"type": "string",
 									"format": "uuid"
 								}
+							},
+							"samples": {
+								"maxItems": 20,
+								"type": "array",
+								"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" }
 							}
 						},
 						"additionalProperties": false,
-						"description": "Emails the rule must match and must not, at most 100 in all, always tested whatever their age: added to email_ids, or to the recent window, which gives up a place for each. The answer's expectations judge each."
+						"description": "Emails the rule must match and must not (at most 100), always tested whatever their age, and made-up emails (samples, at most 20). Given, it replaces a saved rule's own."
 					}
 				},
 				"additionalProperties": false
@@ -50023,7 +50302,7 @@ const openapiDocument = {
 						"items": { "$ref": "#/components/schemas/EmailRuleScopeWarning" }
 					},
 					"expectations": {
-						"description": "Present when expect was given, or for a saved rule with saved expectations.",
+						"description": "Present when expect was given, or for a saved rule with saved expectations or made-up emails.",
 						"type": "object",
 						"properties": {
 							"passed": {
@@ -50093,6 +50372,11 @@ const openapiDocument = {
 									]
 								},
 								"description": "match first, then no_match, each in the order given (saved expectations by email id)."
+							},
+							"samples": {
+								"description": "Made-up emails judged (expect.samples, or a saved rule's), in order; counts include them.",
+								"type": "array",
+								"items": { "$ref": "#/components/schemas/EmailRuleSampleJudgment" }
 							}
 						},
 						"required": [
@@ -50111,6 +50395,244 @@ const openapiDocument = {
 					"results"
 				]
 			},
+			"EmailRuleLookAlike": {
+				"type": "object",
+				"properties": {
+					"kind": {
+						"type": "string",
+						"enum": [
+							"medical",
+							"payroll",
+							"personal_purchase",
+							"bank_tax",
+							"other"
+						]
+					},
+					"why": {
+						"type": "string",
+						"description": "Why the rule should not match it."
+					},
+					"email": {
+						"type": "object",
+						"properties": {
+							"from": {
+								"type": "object",
+								"properties": {
+									"address": { "type": "string" },
+									"name": { "type": "string" }
+								},
+								"required": ["address"]
+							},
+							"to": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"cc": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"subject": { "type": "string" },
+							"text": { "type": "string" },
+							"attachment_types": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"automated": { "type": "boolean" },
+							"from_mailing_list": { "type": "boolean" }
+						},
+						"required": [
+							"from",
+							"to",
+							"cc",
+							"subject",
+							"text",
+							"attachment_types",
+							"automated",
+							"from_mailing_list"
+						],
+						"description": "A made-up email, as test-sample takes it."
+					},
+					"outcome": {
+						"type": "string",
+						"enum": [
+							"matched",
+							"near_miss",
+							"no_match",
+							"not_decided"
+						]
+					},
+					"status": {
+						"type": "string",
+						"enum": [
+							"passed",
+							"failed",
+							"undecided"
+						],
+						"description": "failed: the rule matched it, so it would be shared. undecided: the rule reads a spam score, which it cannot carry, whatever it decided; or not matched on something it could not decide (not classified, a fact or answer missing, or not reached in time)."
+					},
+					"question_answers": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"question": { "type": "string" },
+								"answer": { "type": ["boolean", "null"] },
+								"probability": { "type": ["number", "null"] },
+								"error_class": { "type": "string" }
+							},
+							"required": [
+								"question",
+								"answer",
+								"probability"
+							]
+						}
+					}
+				},
+				"required": [
+					"kind",
+					"why",
+					"email",
+					"outcome",
+					"status",
+					"question_answers"
+				]
+			},
+			"GenerateLookAlikesRequest": {
+				"type": "object",
+				"properties": {
+					"tree": {
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give tree or rule_id, not both.",
+						"$ref": "#/components/schemas/EmailRuleTreeInput"
+					},
+					"english": {
+						"description": "What the tree is meant to match; without it, the tree is described in words.",
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 2e3
+					},
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those mail:share_own lets you share). author: all you can read, inboxes added later included. selected: what scope_selection names."
+					},
+					"scope_selection": { "$ref": "#/components/schemas/EmailRuleScopeSelection" },
+					"rule_id": {
+						"description": "A saved rule you can see: its current version and words.",
+						"type": "string",
+						"format": "uuid"
+					},
+					"request_id": {
+						"description": "A rule request you can see: its rule as asked.",
+						"type": "string",
+						"format": "uuid"
+					},
+					"kind": {
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
+					"count": {
+						"description": "How many, 1 to 8; 6 by default.",
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 8
+					},
+					"kinds": {
+						"description": "Which kinds, taken in turn; all by default, the private ones first.",
+						"minItems": 1,
+						"maxItems": 5,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"enum": [
+								"medical",
+								"payroll",
+								"personal_purchase",
+								"bank_tax",
+								"other"
+							]
+						}
+					},
+					"to": {
+						"description": "The mailbox they arrive in; by default the rule author's (a request's target's) sign-in address when you may see it, else yours.",
+						"type": "string",
+						"maxLength": 254,
+						"format": "email",
+						"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+					}
+				},
+				"additionalProperties": false
+			},
+			"GenerateLookAlikesResult": {
+				"type": "object",
+				"properties": {
+					"rule": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": ["string", "null"],
+								"format": "uuid"
+							},
+							"version": {
+								"type": ["integer", "null"],
+								"exclusiveMinimum": 0
+							},
+							"vocabulary": { "type": "string" }
+						},
+						"required": [
+							"id",
+							"version",
+							"vocabulary"
+						]
+					},
+					"look_alikes": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleLookAlike" }
+					},
+					"counts": {
+						"type": "object",
+						"properties": {
+							"passed": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"failed": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"undecided": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"dropped": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Asked for but not returned: not written, outside the sample bounds, or of a kind not asked for."
+							}
+						},
+						"required": [
+							"passed",
+							"failed",
+							"undecided",
+							"dropped"
+						]
+					},
+					"note": {
+						"type": "string",
+						"description": "That the emails are made up and were never sent or stored."
+					}
+				},
+				"required": [
+					"rule",
+					"look_alikes",
+					"counts",
+					"note"
+				]
+			},
 			"TestEmailRuleOnSampleRequest": {
 				"type": "object",
 				"properties": {
@@ -50402,6 +50924,10 @@ const openapiDocument = {
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -50419,10 +50945,19 @@ const openapiDocument = {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"revision": {
+						"description": "Moves on by one with every update. Send it as if_revision.",
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
 					"author_user_id": {
 						"type": "string",
 						"format": "uuid"
 					},
+					"author": {
+						"description": "Who wrote it: author_user_id with their name and sign-in email.",
+						"$ref": "#/components/schemas/EmailRuleAuthor"
+					},
 					"is_author": {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -50435,14 +50970,22 @@ const openapiDocument = {
 						"type": "string",
 						"format": "date-time"
 					},
-					"current": { "anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }] },
+					"current": {
+						"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }]
+					},
 					"scope_warnings": {
 						"description": "Names in scope_selection that match nothing this organization receives mail at (a typo, or an inbox not yet in use). Present only when there are some.",
 						"type": "array",
 						"items": { "$ref": "#/components/schemas/EmailRuleScopeWarning" }
 					},
+					"expectation_samples": {
+						"description": "Its saved made-up emails, when this write set or added some.",
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSample" }
+					},
 					"expectations_check": {
-						"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest.",
+						"description": "After a write that saved a version or changed its expectations or made-up emails, if it has some: the emails by id judged on that version from stored classifications without asking its questions, and any made-up emails listed as undecided. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed), and after a write that changed only made-up emails on a rule with emails by id. Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
 						"type": "object",
 						"properties": {
 							"version": {
@@ -50454,7 +50997,7 @@ const openapiDocument = {
 								"type": ["boolean", "null"]
 							},
 							"decided": {
-								"description": "Whether every expectation was judged (undecided is empty). Absent from a server that predates it.",
+								"description": "Whether every expectation was judged (undecided and undecided_samples are empty). Absent from a server that predates it.",
 								"type": "boolean"
 							},
 							"failed": {
@@ -50470,6 +51013,26 @@ const openapiDocument = {
 									"type": "string",
 									"format": "uuid"
 								}
+							},
+							"failed_samples": {
+								"description": "Made-up emails that failed, by index in the set judged (saved oldest first, then added; or as sent).",
+								"type": "array",
+								"items": {
+									"type": "integer",
+									"minimum": 0
+								}
+							},
+							"undecided_samples": {
+								"description": "Made-up emails not decided, by index. Only a write sent with if_expectations_pass that saves a version or activates the rule judges them.",
+								"type": "array",
+								"items": {
+									"type": "integer",
+									"minimum": 0
+								}
+							},
+							"note": {
+								"description": "On an update that saved a version that did not pass, or a do_not_share rule created active: that it was saved anyway, is current, and whether it is live.",
+								"type": "string"
 							}
 						},
 						"required": [
@@ -50478,6 +51041,41 @@ const openapiDocument = {
 							"failed",
 							"undecided"
 						]
+					},
+					"restored_from": {
+						"description": "When this write saved an earlier version again (restore_version): which, and that the scope is not part of a version.",
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "integer",
+								"exclusiveMinimum": 0
+							},
+							"note": { "type": "string" }
+						},
+						"required": ["version", "note"]
+					},
+					"affects": {
+						"description": "After an update that saved a version: API keys listing the rule, the webhooks they own, and shares this write ended. The rule keeps its state. Absent if not read.",
+						"type": "object",
+						"properties": {
+							"keys": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"endpoints": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"shares_ended": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"required": [
+							"keys",
+							"endpoints",
+							"shares_ended"
+						]
 					}
 				},
 				"required": [
@@ -50506,6 +51104,28 @@ const openapiDocument = {
 				},
 				"required": ["addresses", "domains"]
 			},
+			"EmailRuleAuthor": {
+				"type": "object",
+				"properties": {
+					"user_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"name": {
+						"description": "Their name; null unless you can list members or this is you, and when they have none set.",
+						"type": ["string", "null"]
+					},
+					"email": {
+						"description": "Sign-in email; null unless you can list member emails or this is you.",
+						"type": ["string", "null"]
+					}
+				},
+				"required": [
+					"user_id",
+					"name",
+					"email"
+				]
+			},
 			"EmailRuleVersion": {
 				"type": "object",
 				"properties": {
@@ -50562,6 +51182,32 @@ const openapiDocument = {
 					"created_at"
 				]
 			},
+			"EmailRuleExpectationSample": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"expected": {
+						"type": "string",
+						"enum": ["match", "no_match"]
+					},
+					"label": { "type": ["string", "null"] },
+					"email": { "$ref": "#/components/schemas/EmailRuleSavedSampleEmail" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"expected",
+					"label",
+					"email",
+					"created_at"
+				]
+			},
 			"CreateEmailRuleRequest": {
 				"type": "object",
 				"properties": {
@@ -50577,9 +51223,13 @@ const openapiDocument = {
 						"enum": ["grant", "do_not_share"]
 					},
 					"state": {
-						"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated.",
+						"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated; active only for a do_not_share rule.",
 						"type": "string",
-						"enum": ["draft", "observe"]
+						"enum": [
+							"draft",
+							"observe",
+							"active"
+						]
 					},
 					"evaluation_scope": {
 						"type": "string",
@@ -50614,6 +51264,13 @@ const openapiDocument = {
 						"additionalProperties": false,
 						"description": "Emails it must match and must not (at most 100): a test by rule_id judges them unless expect is given, and each version it saves is checked against them."
 					},
+					"expectation_samples": {
+						"description": "Made-up emails it must match or not (at most 20).",
+						"minItems": 1,
+						"maxItems": 20,
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" }
+					},
 					"english": {
 						"type": "string",
 						"minLength": 1,
@@ -50655,6 +51312,10 @@ const openapiDocument = {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 64
+					},
+					"breadth": {
+						"description": "Ignored (the compile answer's breadth).",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					}
 				},
 				"required": [
@@ -50686,6 +51347,10 @@ const openapiDocument = {
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -50703,10 +51368,19 @@ const openapiDocument = {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"revision": {
+						"description": "Moves on by one with every update. Send it as if_revision.",
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
 					"author_user_id": {
 						"type": "string",
 						"format": "uuid"
 					},
+					"author": {
+						"description": "Who wrote it: author_user_id with their name and sign-in email.",
+						"$ref": "#/components/schemas/EmailRuleAuthor"
+					},
 					"is_author": {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -50771,6 +51445,10 @@ const openapiDocument = {
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -50788,10 +51466,19 @@ const openapiDocument = {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"revision": {
+						"description": "Moves on by one with every update. Send it as if_revision.",
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
 					"author_user_id": {
 						"type": "string",
 						"format": "uuid"
 					},
+					"author": {
+						"description": "Who wrote it: author_user_id with their name and sign-in email.",
+						"$ref": "#/components/schemas/EmailRuleAuthor"
+					},
 					"is_author": {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -50804,7 +51491,10 @@ const openapiDocument = {
 						"type": "string",
 						"format": "date-time"
 					},
-					"current": { "anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }] },
+					"current": {
+						"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }]
+					},
 					"expectations": {
 						"description": "Its saved expectations, each list by email id.",
 						"type": "object",
@@ -50825,6 +51515,11 @@ const openapiDocument = {
 							}
 						},
 						"required": ["match", "no_match"]
+					},
+					"expectation_samples": {
+						"description": "Its saved made-up emails, oldest first.",
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSample" }
 					}
 				},
 				"required": [
@@ -50900,6 +51595,10 @@ const openapiDocument = {
 						"minLength": 1,
 						"maxLength": 64
 					},
+					"breadth": {
+						"description": "Ignored (the compile answer's breadth).",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
 					"evaluation_scope": {
 						"type": "string",
 						"enum": [
@@ -50911,7 +51610,7 @@ const openapiDocument = {
 					},
 					"scope_selection": { "$ref": "#/components/schemas/EmailRuleScopeSelection" },
 					"if_version": {
-						"description": "The current_version you read. If the rule's now differs, nothing changes: 409 email_rule_conflict, details.reason version_moved and details.current_version. Send it with a new version so a concurrent edit is never replaced unseen. It guards versions only: a change to expectations alone saves none.",
+						"description": "The current_version you read: if it has moved, nothing is saved (409 email_rule_conflict, version_moved). It guards versions only; if_revision guards every update.",
 						"type": "integer",
 						"minimum": 1
 					},
@@ -50937,6 +51636,35 @@ const openapiDocument = {
 						},
 						"additionalProperties": false,
 						"description": "Replaces its saved expectations (author only); null removes them."
+					},
+					"expectation_samples": {
+						"maxItems": 20,
+						"type": ["array", "null"],
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" },
+						"description": "Replaces its saved made-up emails (author only); null or [] removes them."
+					},
+					"add_expectation_samples": {
+						"description": "Adds made-up emails to those saved (author only), up to 20 in all.",
+						"minItems": 1,
+						"maxItems": 20,
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" }
+					},
+					"if_revision": {
+						"description": "The revision you read: if the rule was updated since, nothing is saved (409 email_rule_conflict, revision_moved).",
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 2147483647
+					},
+					"if_expectations_pass": {
+						"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; undecided: 409 expectations_undecided (both with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
+						"type": "boolean"
+					},
+					"restore_version": {
+						"description": "Save version n again as the next version (author only): its english, tree, explanation, assumptions, warnings and compiled_by. A version carries no scope: the rule keeps its own unless evaluation_scope is sent. 404 version_not_found; 400 already_current or version_not_renderable. Not with a version's own fields.",
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 2147483647
 					}
 				},
 				"additionalProperties": false
@@ -51543,6 +52271,10 @@ const openapiDocument = {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 64
+					},
+					"breadth": {
+						"description": "Ignored (the compile answer's breadth).",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					}
 				},
 				"required": [
@@ -51621,6 +52353,14 @@ const openapiDocument = {
 						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 						"type": ["string", "null"]
 					},
+					"edited_on_accept": {
+						"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+						"type": ["boolean", "null"]
+					},
+					"notice": {
+						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"type": ["string", "null"]
+					},
 					"target_can_accept": {
 						"description": "Whether the member asked can accept it now under their role. Null unless you can list members and their roles (members:read), or when it could not be read.",
 						"type": ["boolean", "null"]
@@ -51778,6 +52518,14 @@ const openapiDocument = {
 					"decline_reason": {
 						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 						"type": ["string", "null"]
+					},
+					"edited_on_accept": {
+						"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+						"type": ["boolean", "null"]
+					},
+					"notice": {
+						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"type": ["string", "null"]
 					}
 				},
 				"required": [
@@ -51846,6 +52594,10 @@ const openapiDocument = {
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -51863,10 +52615,19 @@ const openapiDocument = {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"revision": {
+						"description": "Moves on by one with every update. Send it as if_revision.",
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
 					"author_user_id": {
 						"type": "string",
 						"format": "uuid"
 					},
+					"author": {
+						"description": "Who wrote it: author_user_id with their name and sign-in email.",
+						"$ref": "#/components/schemas/EmailRuleAuthor"
+					},
 					"is_author": {
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it; others who see it may only disable or delete it (while shared, only if they manage members)."
@@ -51879,7 +52640,10 @@ const openapiDocument = {
 						"type": "string",
 						"format": "date-time"
 					},
-					"current": { "anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }] }
+					"current": {
+						"description": "Its current version: its text (english, tree, explanation, assumptions, warnings) and who compiled it. current_version is its number. GET /email-rules lists rules without it.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleVersion" }, { "type": "null" }]
+					}
 				},
 				"required": [
 					"id",
@@ -52102,6 +52866,17 @@ const openapiDocument = {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 64
+					},
+					"breadth": {
+						"description": "Ignored (the compile answer's breadth).",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"expectation_samples": {
+						"description": "Made-up emails the rule must match or not, such as look-alikes it must never match, kept on the rule this accept writes.",
+						"minItems": 1,
+						"maxItems": 20,
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" }
 					}
 				},
 				"additionalProperties": false
@@ -52111,7 +52886,11 @@ const openapiDocument = {
 				"properties": {
 					"request": { "$ref": "#/components/schemas/EmailRuleRequest" },
 					"rule": { "$ref": "#/components/schemas/EmailRuleWithVersion" },
-					"share": { "$ref": "#/components/schemas/EmailRuleShare" }
+					"share": { "$ref": "#/components/schemas/EmailRuleShare" },
+					"notice": {
+						"description": "What is now shared, in words.",
+						"type": "string"
+					}
 				},
 				"required": [
 					"request",
@@ -54350,11 +55129,11 @@ const openapiDocument = {
 						"description": "Whether this is the latest attempt of its delivery: the one recorded last, where a record of no attempt (a rule skip or a held send, attempt_count 0) is latest only when no attempt was made. A retry is recorded as a new attempt with its own id and attempt_count (not always higher than the one before), so an earlier attempt never changes: follow the latest one, or read attempts on any of them."
 					},
 					"retry_scheduled": {
-						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. A rule-granted delivery is retried on a schedule of its own, to the same endpoint, deciding it afresh: on its latest attempt true while another attempt is to come (the delivery's next_attempt_at says when); null while an attempt is under way (read it again shortly), while it waits on an owner who cannot receive mail or on a held endpoint (checked again hourly, and sent once that clears), when it is past its 7-day limit, or when that could not be read just now; and false otherwise, including once the endpoint is off or already has the email. Null on every attempt of a delivery retried or settled on a schedule of its own that this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
 						"type": ["boolean", "null"]
 					},
 					"next_attempt_at": {
-						"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled.",
+						"description": "When the next automatic attempt of a rule-granted delivery is due: set on its latest attempt while retry_scheduled is true. The attempt runs at the first retry pass at or after this time (one runs every few minutes), so a time already past means it is due now. Null otherwise, and on every delivery that is not rule-granted, whose retries are passes for the email with no time reported (whether one is coming is retry_scheduled).",
 						"type": ["string", "null"]
 					},
 					"attempts": {
@@ -54384,7 +55163,7 @@ const openapiDocument = {
 									"type": ["string", "null"]
 								},
 								"retry_scheduled": {
-									"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+									"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. A rule-granted delivery is retried on a schedule of its own, to the same endpoint, deciding it afresh: on its latest attempt true while another attempt is to come (the delivery's next_attempt_at says when); null while an attempt is under way (read it again shortly), while it waits on an owner who cannot receive mail or on a held endpoint (checked again hourly, and sent once that clears), when it is past its 7-day limit, or when that could not be read just now; and false otherwise, including once the endpoint is off or already has the email. Null on every attempt of a delivery retried or settled on a schedule of its own that this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
 									"type": ["boolean", "null"]
 								}
 							},
@@ -56284,7 +57063,7 @@ const openapiDocument = {
 						}
 					},
 					"already_revoked": {
-						"description": "true when the API key was already revoked, so nothing changed and revoked is 0. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
+						"description": "true when the API key was already revoked. revoked then counts only the keys it replaced that were revoked now. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
 						"type": "boolean"
 					},
 					"keep_failed": {
@@ -56317,6 +57096,18 @@ const openapiDocument = {
 								"org_owned": {
 									"type": "boolean",
 									"description": "true: the organization owns it, and it keeps working. false: the credential owns it itself, as with everything a third-party app or agent delegate made, a webhook made with a narrowed API key, or a wake schedule made with a key that does not cover super_admin. It keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to or kept it. Revoking a third-party app or agent delegate turns these off, except that a block filter it made keeps blocking, within the reach the app had, unless the person revoking chose to stop it."
+								},
+								"still_acting": {
+									"description": "For an API key: whether anything still acts for it after this revoke (the organization, a key of the same rotation that still works, or whoever took it over). Null when that could not be read.",
+									"type": ["boolean", "null"]
+								},
+								"acting_key_id": {
+									"description": "For an API key: the key that still acts for it, shown to a caller who may read the organization's API keys. Null otherwise, and when no key does.",
+									"type": ["string", "null"]
+								},
+								"delivering": {
+									"description": "For an API key's webhook: whether it is still sent received mail, as GET /v1/endpoints/{id} delivery.delivering says. Null when that could not be read.",
+									"type": ["boolean", "null"]
 								}
 							},
 							"required": [
@@ -56327,6 +57118,28 @@ const openapiDocument = {
 							],
 							"additionalProperties": {}
 						}
+					},
+					"predecessors_revoked_count": {
+						"description": "For an API key: how many keys it replaced in its rotation, still in their overlap, were revoked with it. Keys that replaced it never are.",
+						"type": "integer",
+						"minimum": -9007199254740991,
+						"maximum": 9007199254740991
+					},
+					"predecessors_left": {
+						"description": "For an API key: how many such keys were left working because you may not revoke them. They work until their overlap ends.",
+						"type": "integer",
+						"minimum": -9007199254740991,
+						"maximum": 9007199254740991
+					},
+					"predecessors_revoked": {
+						"description": "The ids of the keys counted in predecessors_revoked_count, to a caller who may read the organization's API keys.",
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"predecessors_not_revoked": {
+						"description": "The ids of the keys counted in predecessors_left, to a caller who may read the organization's API keys.",
+						"type": "array",
+						"items": { "type": "string" }
 					}
 				},
 				"required": [
@@ -65178,7 +65991,9 @@ function unauthorizedRefusal(errorPayload, authFailureContext) {
 * Anything else, including an organization-wide key, an agent_delegate and
 * a person with no member address they may send from, gets no default: the
 * command refuses, lists what the credential may send from, and asks for
-* --from. The From is never an address guessed from the organization's
+* --from. A credential whose grant has no mail:send is refused by that
+* permission instead (MissingSendPermissionError), with no --from hint. The
+* From is never an address guessed from the organization's
 * domains, such as agent@ at the first verified one. A failed answer from an
 * API that has it refuses rather than fall back.
 */
@@ -65236,6 +66051,57 @@ const SEND_FROM_SOURCES = {
 	member_address: "member_address",
 	granted_address: "granted_address"
 };
+/**
+* The refusal of a send by a credential whose grant has no mail:send, in the
+* shape the send route itself refuses it with (code grant_forbidden, details
+* naming the permission), so a script can branch on it. It names what the
+* credential lacks first, then what would fix it, never --from.
+*/
+var MissingSendPermissionError = class extends Errors.CLIError {
+	details = {
+		permission: "mail:send",
+		reason: "permission_missing"
+	};
+	constructor(missing) {
+		super(missingSendPermissionMessage(missing), {
+			code: "grant_forbidden",
+			exit: 1
+		});
+	}
+};
+function missingSendPermissionMessage(missing) {
+	const parts = [`${KEY_CREDENTIAL_KINDS.has(missing.credentialKind ?? "") ? "This key" : "This credential"} has no mail:send, so it cannot send new mail from any address; --from does not change that.`];
+	if (missing.replies) parts.push("It can still reply to mail it received.");
+	parts.push(missing.credentialKind === "org_key" && missing.keyId ? `To send, add the permission to the key (a member who manages keys runs \`primitive keys update ${missing.keyId} --add mail:send\`), or use a credential that holds mail:send.` : PERSON_CREDENTIAL_KINDS.has(missing.credentialKind ?? "") ? "To send, ask an organization admin for a role that includes mail:send." : "To send, use a credential that holds mail:send.");
+	return parts.join(" ");
+}
+/**
+* The credential's own grant when it has no mail:send, outright or over a
+* reach of its own (as the API decides whether a caller may send), or null
+* when it has it or the grant cannot be read: then nothing is claimed.
+*/
+async function missingSendPermission(apiClient) {
+	let own;
+	try {
+		own = await getOwnGrant({
+			client: apiClient.client,
+			responseStyle: "fields"
+		});
+	} catch {
+		return null;
+	}
+	if (!own || own.error) return null;
+	const data = own.data?.data;
+	const grant = data?.grant;
+	if (!grant || !Array.isArray(grant.permissions)) return null;
+	const holds = (permission) => grant.permissions.includes(permission) || grant.scoped_permissions !== null && typeof grant.scoped_permissions === "object" && Object.hasOwn(grant.scoped_permissions, permission);
+	if (holds("mail:send")) return null;
+	return {
+		credentialKind: typeof grant.credential_kind === "string" ? grant.credential_kind : null,
+		keyId: typeof data?.key_id === "string" ? data.key_id : null,
+		replies: holds("mail:reply")
+	};
+}
 function errorDetail(error) {
 	return error instanceof Error ? error.message : String(error);
 }
@@ -65292,6 +66158,10 @@ async function sendFromAnswer(apiClient, authFailureContext, purpose) {
 	const addresses = data.addresses.map((entry) => entry && typeof entry === "object" ? entry.address : void 0).filter((address) => typeof address === "string");
 	const domains = Array.isArray(data.domains) ? data.domains.filter((domain) => typeof domain === "string") : [];
 	if (purpose === "reply" && addresses.length === 0 && domains.length === 0) return void 0;
+	if (addresses.length === 0 && domains.length === 0) {
+		const missing = await missingSendPermission(apiClient);
+		if (missing) throw new MissingSendPermissionError(missing);
+	}
 	const parts = [typeof data.reason === "string" && data.reason.trim() ? data.reason.trim().replace(/\.?$/, ".") : "This credential has no single address to send from, so --from has no default."];
 	if (addresses.length > 0) parts.push(`Addresses you may send from: ${addresses.join(", ")}.`);
 	if (domains.length > 0) parts.push(`${addresses.length > 0 ? "Also any" : "Any"} address at: ${domains.join(", ")}.`);
@@ -66106,7 +66976,7 @@ var ChatCommand = class ChatCommand extends Command {
 			env: "PRIMITIVE_API_BASE_URL",
 			hidden: true
 		}),
-		from: Flags.string({ description: "Sender address. Defaults to the selected connected profile's pinned address; on your own login, to your member address when you may send from it; with a key whose grant names exactly one address, to that address. Otherwise the command asks for --from. A connected profile rejects another sender." }),
+		from: Flags.string({ description: "Sender address. Defaults to the selected connected profile's pinned address; on your own login, to your member address when you may send from it; with a key whose grant names exactly one address, to that address. Otherwise the command asks for --from, except that a credential without mail:send is refused by that permission. A connected profile rejects another sender." }),
 		subject: Flags.string({
 			description: "Advanced email transport override. Usually omit; chat threading does not depend on the subject.",
 			hidden: true
@@ -66186,7 +67056,7 @@ var ChatCommand = class ChatCommand extends Command {
 			}
 			const outcome = phase === "sending" || error instanceof UncertainChatSendError ? "uncertain" : "not_sent";
 			if (flags.json) this.log(JSON.stringify(buildChatSendFailureEnvelope({
-				error: { message: detail },
+				error: thrownErrorBody(error),
 				exitCode: outcome === "not_sent" ? thrownErrorExitCode(error) : void 0,
 				idempotencyKey: this.chatProgress.idempotencyKey,
 				noun,
@@ -66976,15 +67846,12 @@ var ChatReplyCommand = class ChatReplyCommand extends Command {
 		try {
 			await this.runReply(args, flags);
 		} catch (error) {
-			if (flags.json && !this.delegatedToChat) {
-				const detail = error instanceof Error ? error.message : String(error);
-				this.log(JSON.stringify(buildChatSendFailureEnvelope({
-					error: { message: detail },
-					exitCode: thrownErrorExitCode(error),
-					noun: "Reply",
-					outcome: "not_sent"
-				}), null, 2));
-			}
+			if (flags.json && !this.delegatedToChat) this.log(JSON.stringify(buildChatSendFailureEnvelope({
+				error: thrownErrorBody(error),
+				exitCode: thrownErrorExitCode(error),
+				noun: "Reply",
+				outcome: "not_sent"
+			}), null, 2));
 			throw error;
 		}
 	}
@@ -68435,7 +69302,9 @@ const ID_DESCRIPTION = "The id of the received email (from `primitive emails lis
 /**
 * `primitive emails facts <id>`: what the classifier read from one received
 * email, every fact as email rule conditions read it, from the email's rule
-* results (GET /emails/{id}/rule-results).
+* results (GET /emails/{id}/rule-results). A credential that may not read
+* rule results gets the facts as written, from the email read
+* (GET /emails/{id}, `understanding`).
 */
 var EmailsFactsCommand = class EmailsFactsCommand extends Command {
 	static summary = "Show what the classifier read from an email";
@@ -68443,7 +69312,7 @@ var EmailsFactsCommand = class EmailsFactsCommand extends Command {
 
 Use it to see why an email rule did or did not match, alongside \`primitive email-rules list-email-rule-results --email-id <id>\`, which this reads. An email with no classification (not classified yet, never to be, or content that cannot be read) prints a message saying so on stderr and nothing on stdout. With --json, prints the classification object, or null when there is none.
 
-Needs the email rules feature, and a member's own credential with their full access (not an API key, agent key or narrowed token).`;
+Needs the email rules feature. Rule results are read with a member's own credential with their full access. An API key, agent key or narrowed token cannot read them, so for one of those the command reads the facts from the email itself instead (\`understanding.facts\` of \`primitive emails get <id> --json\`), as the classifier wrote them, and says so on stderr (in \`warnings\` with --json). Those differ from what rule conditions read in two ways: conditions read a multi fact's options lowercased, and read a fact the classifier left out as null, where \`understanding.facts\` leaves it out.`;
 	static examples = ["<%= config.bin %> emails facts 3f0e1c2a-8b7d-4c6e-9a1b-2d3e4f5a6b7c", "<%= config.bin %> emails facts --id 3f0e1c2a-8b7d-4c6e-9a1b-2d3e4f5a6b7c --json"];
 	static args = { id: Args.string({
 		description: ID_DESCRIPTION,
@@ -68451,7 +69320,7 @@ Needs the email rules feature, and a member's own credential with their full acc
 	}) };
 	static flags = {
 		id: Flags.string({ description: ID_DESCRIPTION }),
-		json: Flags.boolean({ description: "Print the classification object as one JSON document on stdout (null when the email has none), and nothing on stderr. A failure prints the error with exit_code." }),
+		json: Flags.boolean({ description: "Print the classification object as one JSON document on stdout (null when the email has none), and nothing on stderr. When the facts come from the email itself, the note saying so is in its warnings. A failure prints the error with exit_code." }),
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -68484,6 +69353,14 @@ Needs the email rules feature, and a member's own credential with their full acc
 			});
 			if (result.error) {
 				const payload = extractErrorPayload(result.error);
+				if (refusesRuleResultsToCredential(payload)) {
+					await this.printFactsFromEmail(id, Boolean(flags.json), {
+						apiClient,
+						auth,
+						baseUrlOverridden
+					});
+					return;
+				}
 				writeErrorWithHints(payload, result.response);
 				surfaceUnauthorizedHint({
 					auth,
@@ -68508,7 +69385,80 @@ Needs the email rules feature, and a member's own credential with their full acc
 			this.log(lines.join("\n"));
 		});
 	}
+	/**
+	* The facts as `emails get` reads them, for a credential that may not read
+	* rule results: the email's understanding, when it is ready.
+	*/
+	async printFactsFromEmail(id, json, client) {
+		const read = await getEmail({
+			client: client.apiClient.client,
+			path: { id },
+			responseStyle: "fields"
+		});
+		if (read.error) {
+			const payload = extractErrorPayload(read.error);
+			process.stderr.write("This credential cannot read email rule results, and reading the facts from the email itself failed:\n");
+			writeErrorWithHints(payload, read.response);
+			surfaceUnauthorizedHint({
+				auth: client.auth,
+				baseUrlOverridden: client.baseUrlOverridden,
+				configDir: this.config.configDir,
+				payload
+			});
+			process.exitCode = 1;
+			return;
+		}
+		const understanding = read.data?.data?.understanding;
+		const classification = classificationFromUnderstanding(understanding);
+		if (classification) process.stderr.write(`${understandingNote(id)}\n`);
+		if (json) {
+			this.log(JSON.stringify(classification, null, 2));
+			return;
+		}
+		const lines = classification ? classificationFactLines(classification) : [];
+		if (lines.length === 0) {
+			process.stderr.write(`${classification ? "This email's classification has no facts." : noUnderstandingMessage(understanding)}\n`);
+			return;
+		}
+		this.log(lines.join("\n"));
+	}
 };
+/** The refusals of rule results to a credential that is not a member's own, unnarrowed one. */
+const NOT_A_RULE_READER = /* @__PURE__ */ new Set(["rule_author_credential", "narrowed_credential"]);
+/** Whether rule results were refused only because of the kind of credential. */
+function refusesRuleResultsToCredential(payload) {
+	if (extractErrorCode(payload) !== "forbidden") return false;
+	const { reason } = refusalDetails(payload);
+	return typeof reason === "string" && NOT_A_RULE_READER.has(reason);
+}
+/**
+* The email's `understanding` as the classification rule results show
+* (id, vocabulary, classified_at, facts), when it is ready; otherwise null.
+*/
+function classificationFromUnderstanding(understanding) {
+	if (!isRecord$1(understanding) || understanding.status !== "ready") return null;
+	return {
+		id: understanding.classification_id ?? null,
+		vocabulary: understanding.vocabulary ?? null,
+		classified_at: understanding.classified_at ?? null,
+		facts: isRecord$1(understanding.facts) ? understanding.facts : {}
+	};
+}
+/** Where facts read from the email came from, and how they differ. */
+function understandingNote(id) {
+	return `This credential cannot read email rule results, so these facts come from the email itself (\`primitive emails get ${id} --json\`, understanding.facts), as the classifier wrote them. Rule conditions read a multi fact's options lowercased, and a fact left out here reads null to them.`;
+}
+/** Why an email read gave no facts to show. */
+function noUnderstandingMessage(understanding) {
+	const status = isRecord$1(understanding) ? understanding.status : void 0;
+	if (status === "pending") return "No classification for this email yet: it has not been classified. Recent mail can take a while, so try again later.";
+	if (status === "unavailable") return "No classification to show for this email: it was not classified in time, its content was discarded first, or its facts are too large to include.";
+	if (typeof status === "string") return `No classification to show: the email's understanding is ${status}.`;
+	return "No classification to show: the email read carries no facts. Its content may be withheld, discarded or failed to parse, this credential may not read message content, or the facts could not be read just now, so try again.";
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 // src/oclif/repeat-message.ts
 const UUID$5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** The server-verified repeat marker on an email read, if any. */
@@ -71015,8 +71965,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.6";
-const CLI_VERSION_RANGE = "^3.0.0-preview.6";
+const SDK_VERSION_RANGE = "^3.0.0-preview.8";
+const CLI_VERSION_RANGE = "^3.0.0-preview.8";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -72848,7 +73798,8 @@ const INBOX_NEXT_EXIT_CODE_HELP = `Exit codes:
 const SCAN_PAGE_SIZE = 100;
 const DEFAULT_WAIT_TIMEOUT_SECONDS = 300;
 const MAX_LONG_POLL_SECONDS$1 = 30;
-const EPOCH_CURSOR = "1970-01-01T00:00:00.000000Z|00000000-0000-4000-8000-000000000000";
+const TIME_CURSOR_ID = "00000000-0000-4000-8000-000000000000";
+const EPOCH_CURSOR = `1970-01-01T00:00:00.000000Z|${TIME_CURSOR_ID}`;
 /** An API call failed; carries the error payload for printing. */
 var InboxNextApiError = class extends Error {
 	surface;
@@ -73090,18 +74041,43 @@ async function countAutomatedAwaiting(params) {
 		capped: page.totalCapped
 	};
 }
+/** Pages of the forward tail `baselineCursor` reads to catch up, at most. */
+const BASELINE_CATCH_UP_PAGES = 5;
 /**
-* The wake-up cursor for --wait: the newest email's position, read
-* BEFORE the first state check. Anything that becomes visible after it
-* is returned by the long-poll, so there is no gap between "checked,
-* nothing awaits" and "started waiting". Built from the newest row the
-* way the API documents bootstrapping `since`; no client clock involved.
+* The wake-up cursor for --wait (and for `primitive wait`): the end of the
+* forward tail, the position of the email made visible most recently, read
+* BEFORE the first state check. Anything that becomes visible after it is
+* returned by the long-poll, so there is no gap between "checked, nothing
+* awaits" and "started waiting". Taken from the server's answers alone, with
+* no client clock involved.
+*
+* The tail orders and cursors on when an email became visible, which the
+* API stamps when it accepts the email: after the created_at a list row
+* carries, and to the microsecond where that created_at is truncated to the
+* millisecond. So a cursor built from the newest row's created_at sits
+* before that row on the tail, and the tail would hand it back, with any
+* older email made visible after it, as new mail. From that cursor the tail
+* is read forward without waiting until it is caught up, and the position it
+* gives is the baseline. The read stops after BASELINE_CATCH_UP_PAGES pages;
+* mail past that would still be handed back, which needs more than that many
+* pages of mail made visible after the newest row's created_at.
 */
 async function baselineCursor(params) {
-	const newest = (await listPage(params.api ?? DEFAULT_API, params.apiClient, { limit: 1 })).rows[0];
+	const api = params.api ?? DEFAULT_API;
+	const newest = (await listPage(api, params.apiClient, { limit: 1 })).rows[0];
 	const createdAt = str$1(newest?.created_at);
 	const id = str$1(newest?.id);
-	return createdAt && id ? `${createdAt}|${id}` : EPOCH_CURSOR;
+	let cursor = createdAt && id ? `${createdAt}|${id}` : EPOCH_CURSOR;
+	for (let read = 0; read < BASELINE_CATCH_UP_PAGES; read += 1) {
+		const tail = await listPage(api, params.apiClient, {
+			limit: SCAN_PAGE_SIZE,
+			since: cursor
+		});
+		if (tail.rows.length === 0 || !tail.cursor) break;
+		cursor = tail.cursor;
+		if (tail.rows.length < SCAN_PAGE_SIZE) break;
+	}
+	return cursor;
 }
 /**
 * Hold one long-poll on the forward tail. Returns the advanced cursor
@@ -73743,6 +74719,498 @@ var InboxSetupCommand = class InboxSetupCommand extends Command {
 		});
 	}
 };
+// src/oclif/commands/whoami.ts
+/**
+* `GET /whoami` with its grant query parameters. A server without grants
+* ignores them and answers without `grant` or `check`.
+*/
+async function fetchCallerIdentity(client, query, options = {}) {
+	const result = await client.get({
+		...options.fetch ? { fetch: options.fetch } : {},
+		...options.signal ? { signal: options.signal } : {},
+		query,
+		responseStyle: "fields",
+		security: [{
+			scheme: "bearer",
+			type: "http"
+		}],
+		url: "/whoami"
+	});
+	if (result.error) return {
+		identity: null,
+		error: result.error
+	};
+	return {
+		identity: result.data?.data ?? null,
+		error: null
+	};
+}
+/** How many rule ids the Grant line names before it says how many more. */
+const GRANT_LINE_RULES = 3;
+/** Rule ids for the Grant line: the first few, then how many more. */
+function ruleIdList(rules) {
+	const shown = rules.slice(0, GRANT_LINE_RULES);
+	const rest = rules.length - shown.length;
+	const all = rest > 0 ? [...shown, `${rest} more`] : shown;
+	return all.length <= 1 ? all[0] ?? "" : `${all.slice(0, -1).join(", ")} and ${all[all.length - 1]}`;
+}
+/**
+* The mail a grant reaches, for the Grant line. A key cannot read email
+* rules, so a scope that lists them names them by id. A rule grants mail it
+* matches as the mail arrives, while the rule is active, and the key reads it
+* only while the rule stays active.
+*/
+function grantScopeText(scope) {
+	if (scope === void 0) return "all mail in the organization";
+	const reach = mailReach(scope);
+	switch (reach.kind) {
+		case "org": return "all mail in the organization";
+		case "unreadable": return "a mail scope the server could not read, so no mail";
+		case "none": return "no mail through its grant, which names no mailbox, domain or email rule";
+		case "rules_only":
+		case "mailboxes": {
+			if (reach.rules.length === 0) return "a narrowed mail scope";
+			const granted = reach.rules.length === 1 ? `mail that email rule ${ruleIdList(reach.rules)} granted, while it stays active` : `mail that email rules ${ruleIdList(reach.rules)} granted, while each stays active`;
+			const more = reach.rules.length > GRANT_LINE_RULES ? " (`primitive whoami --json --grant` lists every rule)" : "";
+			return reach.kind === "mailboxes" ? `a narrowed mail scope, plus ${granted}${more}` : `${granted}${more}`;
+		}
+		default: return "a narrowed mail scope";
+	}
+}
+function formatGrant(grant, keyId = null) {
+	const what = grant.template ? `template ${grant.template}` : `${grant.grant_type ?? "grant"} with ${grant.permissions.length} permissions`;
+	const credential = keyId ? `${grant.credential_kind}, key id ${keyId}` : grant.credential_kind;
+	const lines = [`Grant: ${what}, ${grantScopeText(grant.mail_scope)} (${credential})`];
+	if (grant.expires_at) lines.push(`Credential expires: ${grant.expires_at}`);
+	return lines;
+}
+/** Lines describing the caller's organization, role and grant. */
+function formatGrantLines(identity, options = {}) {
+	const lines = [];
+	const org = options.orgName ? `${options.orgName} (${identity.org_id})` : identity.org_id;
+	lines.push(`Organization: ${org}`);
+	if (isPersonIdentity(identity)) lines.push(identity.role === "member" ? "Built-in role: member (also shown for a template or custom role that does not fully include member; the Grant line is what this login can do)" : isBuiltInRoleKey(identity.role) ? `Built-in role: ${identity.role}` : `Role key: ${identity.role}`);
+	const grant = identity.grant;
+	if (grant) lines.push(...formatGrant(grant, identity.key_id));
+	if (options.userLogin) lines.push("Signed in as yourself. Switch organizations with `primitive org use <org>`.");
+	return lines;
+}
+function formatPermissionCheck(check) {
+	if (check.allow) return `${check.permission}: allowed`;
+	return `${check.permission}: not allowed${check.reason ? ` (${check.reason})` : ""}`;
+}
+/** Whether GET /whoami answered for an API key. */
+function isKeyIdentity(identity) {
+	return Boolean(identity.key_id) || identity.auth_method === "api_key";
+}
+/** Whether GET /whoami answered for a person's own session or OAuth login. */
+const PERSON_AUTH_METHODS = /* @__PURE__ */ new Set([
+	"oauth",
+	"session",
+	"dashboard_bridge"
+]);
+function isPersonIdentity(identity) {
+	return !isKeyIdentity(identity) && typeof identity.auth_method === "string" && PERSON_AUTH_METHODS.has(identity.auth_method);
+}
+/** What the summary's first line says about who is calling. */
+function identityLine(identity) {
+	if (!identity || identity.member_address === void 0) return "Authenticated";
+	if (identity.member_address) return `Authenticated as ${identity.member_address.address} (your member address)`;
+	if (isKeyIdentity(identity)) return "Authenticated (API keys have no member address)";
+	if (!isPersonIdentity(identity)) return "Authenticated (this credential has no member address)";
+	return `Authenticated (you have no member address in this organization${identity.member_address_suggestion ? `; \`primitive account provision-member-address --address ${identity.member_address_suggestion}\` sets one` : ""})`;
+}
+function formatWhoamiSummary(account, managedInboxDomain, orgName = null, identity = null) {
+	const lines = [
+		identityLine(identity),
+		orgName ? `Organization: ${orgName} (${account.id})` : `Organization id: ${account.id}`,
+		...account.email ? [`Account email: ${account.email} (the email the account was opened with)`] : [],
+		`Plan: ${account.plan}`
+	];
+	if (managedInboxDomain) lines.push(`Managed inbox: any-local-part@${managedInboxDomain}`);
+	return lines.join("\n");
+}
+/** `GET /whoami/grant`, which any credential may ask about itself. */
+async function fetchOwnGrant(client) {
+	try {
+		const result = await getOwnGrant({
+			client,
+			responseStyle: "fields"
+		});
+		if (result.error) return null;
+		return result.data?.data ?? null;
+	} catch {
+		return null;
+	}
+}
+/** The summary for a valid credential whose grant cannot read the account. */
+function formatOwnGrantSummary(own, orgName) {
+	return [
+		"Authenticated. This credential cannot read the account (it lacks org:read).",
+		orgName ? `Organization: ${orgName} (${own.org_id})` : `Organization id: ${own.org_id}`,
+		...own.grant ? formatGrant(own.grant, own.key_id) : []
+	].join("\n");
+}
+var WhoamiCommand = class WhoamiCommand extends Command {
+	static description = `Print the account currently authenticated by saved OAuth credentials or an explicit API key. For account credentials this is a live credentials smoke test. Use account whoami for the authenticated caller, their assigned member address and an address suggestion; account provision-member-address --address <email> saves your chosen personal address.
+
+  With PRIMITIVE_AGENT_PROFILE selected, print the saved connected-agent identity offline, with no API call. The first line is the agent's email address alone; --json adds address, profile and source (session_hook when the selected profile is this Claude Code session's own agent exported by the session start hook, env otherwise). This does not verify live authentication, app pairing, or listener readiness. Inspect the receiver separately: the output names the command for the profile's receiver mode (agent connect --status for Claude hook and poll receivers, listen --status --notify-session for a native listener).
+
+  The default output is a concise human summary. Pass --json for the full /account response or the explicit offline connected-agent identity envelope.`;
+	static summary = "Print the live account or saved connected-agent identity";
+	static examples = [
+		"<%= config.bin %> whoami",
+		"<%= config.bin %> whoami --api-key prim_...",
+		"<%= config.bin %> whoami --json | jq .id",
+		"PRIMITIVE_AGENT_PROFILE=work <%= config.bin %> whoami --json"
+	];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		json: Flags.boolean({ description: "Print the account JSON response, or the saved connected identity marked verification: offline. Never prints credentials." }),
+		grant: Flags.boolean({ description: "With --json, add `grant`: the organization, role and grant of this credential. The summary shows them when the server reports them; only a person's own login has a role line." }),
+		check: Flags.string({ description: "Ask whether this credential may use a permission, such as mail:send. Prints the decision and exits 1 when it is not allowed. Nothing is enforced by asking." }),
+		resource: Flags.string({
+			description: "With --check, the resource to check against, as function:<id>, domain:<id>, endpoint:<id> or route:<id>.",
+			dependsOn: ["check"]
+		}),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(WhoamiCommand);
+		await runWithTiming(flags.time, async () => {
+			const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+				apiKey: flags["api-key"],
+				apiBaseUrl: flags["api-base-url"],
+				configDir: this.config.configDir
+			});
+			if (auth.connectedAgent && flags.check !== void 0) throw new Errors.CLIError("--check needs a live account credential. A selected connected-agent profile is shown offline; rerun with `PRIMITIVE_AGENT_PROFILE=` in front of the command to check the member login.", { exit: 1 });
+			if (auth.connectedAgent) {
+				const identity = auth.connectedAgent;
+				const statusCommand = `${cliInvocation(process.argv[1])} agent connect --profile ${identity.profileName} --status --json`;
+				const receiver = receiverStatusCommand(this.config.configDir, identity.profileName);
+				const guidance = `Saved identity only. Live authentication, app pairing, and receiving readiness are not verified. Inspect the ${receiver.mode === "external" ? "Claude hook receiver" : receiver.mode === "poll" ? "poll receiver" : "receiver"} with \`${receiver.command}\`.`;
+				const source = agentIdentitySource(identity);
+				const selectedBy = source === "session_hook" ? `this Claude Code session's start hook (PRIMITIVE_AGENT_PROFILE=${identity.profileName})` : `PRIMITIVE_AGENT_PROFILE=${identity.profileName}`;
+				this.log(flags.json ? JSON.stringify({
+					address: identity.agentAddress,
+					profile: identity.profileName,
+					source,
+					auth_method: "agent_connection",
+					verification: "offline",
+					identity,
+					status_command: statusCommand,
+					guidance
+				}, null, 2) : `${identity.agentAddress}\nSelected by: ${selectedBy}. Prefix a command with \`PRIMITIVE_AGENT_PROFILE=\` to run it as the member login instead.\nSaved connected-agent profile: ${identity.profileName}\nAgent address: ${identity.agentAddress}\nOwner personal address (send reports here): ${identity.ownerMemberAddress ?? "unknown; reply to the member who wrote to you"}\nControl address (setup and presence only): ${identity.ownerAddress}\nAPI origin: ${identity.apiBaseUrl}\n${guidance}\nSaved profile status: ${statusCommand}`);
+				return;
+			}
+			if (isConnectedChatCredential(auth.apiKey)) throw new Errors.CLIError("This connection credential cannot inspect an account. Select its saved profile with PRIMITIVE_AGENT_PROFILE to inspect the connected identity offline.", { exit: 1 });
+			if (flags.check !== void 0) {
+				const check = flags.check.trim();
+				if (!/^[a-z][a-z0-9_.]*:[a-z][a-z0-9_]*$/.test(check)) throw new Errors.CLIError(`--check ${JSON.stringify(flags.check)} is not a permission. Permissions look like \`mail:send\`.`, { exit: 2 });
+				const { identity, error } = await fetchCallerIdentity(apiClient.client, {
+					check,
+					...flags.resource ? { resource: flags.resource.trim() } : {}
+				});
+				if (error) {
+					const errorPayload = extractErrorPayload(error);
+					writeErrorWithHints(errorPayload);
+					surfaceUnauthorizedHint({
+						auth,
+						baseUrlOverridden,
+						configDir: this.config.configDir,
+						payload: errorPayload
+					});
+					process.exitCode = 1;
+					return;
+				}
+				const decision = identity?.check;
+				if (!decision) throw new Errors.CLIError("This Primitive server does not answer permission checks.", { exit: 1 });
+				this.log(flags.json ? JSON.stringify(decision, null, 2) : formatPermissionCheck(decision));
+				if (!decision.allow) process.exitCode = 1;
+				return;
+			}
+			const result = await getAccount({
+				client: apiClient.client,
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const errorPayload = extractErrorPayload(result.error);
+				const own = isGrantRefusal(errorPayload) ? await fetchOwnGrant(apiClient.client) : null;
+				if (own) {
+					const orgName = auth.credentials?.org_id === own.org_id ? auth.credentials.org_name ?? null : null;
+					this.log(flags.json ? JSON.stringify({
+						account: null,
+						...own,
+						org_name: orgName
+					}, null, 2) : formatOwnGrantSummary(own, orgName));
+					return;
+				}
+				writeErrorWithHints(errorPayload);
+				surfaceUnauthorizedHint({
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir,
+					payload: errorPayload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			const account = result.data?.data;
+			if (!account) {
+				process.stderr.write("Server returned an empty account body; this should not happen for a valid key.\n");
+				throw new Errors.CLIError("unexpected empty response");
+			}
+			let managedInboxDomain = null;
+			try {
+				const domainsResult = await listDomains({
+					client: apiClient.client,
+					responseStyle: "fields"
+				});
+				if (!domainsResult.error) managedInboxDomain = (domainsResult.data?.data ?? []).find((row) => row.verified && row.managed_zone !== null)?.domain ?? null;
+			} catch {}
+			const orgName = auth.credentials?.org_id === account.id ? auth.credentials.org_name ?? null : null;
+			const session = guardedSession(void 0, process.env);
+			let registration = null;
+			try {
+				registration = session ? failedSessionRegistration(this.config.configDir, session) : null;
+			} catch {
+				registration = null;
+			}
+			let identity = null;
+			if (!flags.json || flags.grant) try {
+				identity = (await fetchCallerIdentity(apiClient.client, { include: "grant" })).identity;
+			} catch {
+				identity = null;
+			}
+			if (flags.json) {
+				this.log(JSON.stringify({
+					...account,
+					managed_inbox_domain: managedInboxDomain,
+					org_name: orgName,
+					...registration ? { session_registration: registration } : {},
+					...flags.grant ? {
+						grant: identity?.grant ?? null,
+						org_id: identity?.org_id ?? null,
+						role: identity?.role ?? null
+					} : {}
+				}, null, 2));
+				return;
+			}
+			const summary = [formatWhoamiSummary(account, managedInboxDomain, orgName, identity)];
+			if (identity?.grant) summary.push(...formatGrantLines(identity, {
+				orgName: auth.credentials?.org_name ?? null,
+				userLogin: auth.credentials?.auth_method === "user_grant"
+			}).filter((line) => !line.startsWith("Organization:")));
+			this.log(summary.join("\n"));
+			if (registration) this.log(registrationSummaryLine(registration));
+		});
+	}
+};
+// src/oclif/key-permissions.ts
+const KEY_PERMISSION_AREAS = [
+	{
+		label: "Mail",
+		permissions: [
+			"mail:read",
+			"changes:read",
+			"mail.search:semantic",
+			"mail:send",
+			"mail:send_batch",
+			"mail:reply",
+			"mail:signal",
+			"mail.state:write",
+			"mail:delete",
+			"mail.compat:use"
+		]
+	},
+	{
+		label: "Raw mail",
+		permissions: ["mail.raw:read"]
+	},
+	{
+		label: "Scheduled and repeating sends",
+		permissions: ["sent:manage", "sent:cancel"]
+	},
+	{
+		label: "Thread mutes",
+		permissions: ["threads:mute"]
+	},
+	{
+		label: "App sync state",
+		permissions: ["mail_sync:manage"]
+	},
+	{
+		label: "Endpoints and webhooks",
+		permissions: [
+			"webhooks:read",
+			"endpoints:manage",
+			"endpoints.pull:manage",
+			"webhooks:replay"
+		]
+	},
+	{
+		label: "Recipient routes",
+		permissions: ["routes:manage"]
+	},
+	{
+		label: "Filters",
+		permissions: ["filters:manage"]
+	},
+	{
+		label: "Domains",
+		permissions: ["domains:read", "domains:manage"]
+	},
+	{
+		label: "Account",
+		permissions: [
+			"org:read",
+			"account:manage",
+			"account:claim",
+			"credentials:revoke_self"
+		]
+	},
+	{
+		label: "Own activity",
+		permissions: ["activity:read_self"]
+	},
+	{
+		label: "Webhook signing secret",
+		permissions: ["webhook_secret:read", "webhook_secret:manage"]
+	},
+	{
+		label: "Functions",
+		permissions: [
+			"functions:read",
+			"functions:manage",
+			"functions:deploy",
+			"github:manage",
+			"templates:install"
+		]
+	},
+	{
+		label: "Secrets",
+		permissions: ["secrets:manage"]
+	},
+	{
+		label: "Contacts",
+		permissions: [
+			"contacts:read",
+			"contacts:write",
+			"contacts:delete",
+			"agent_contacts:manage"
+		]
+	},
+	{
+		label: "Address notes",
+		permissions: [
+			"notes:read",
+			"notes:write",
+			"notes:delete"
+		]
+	},
+	{
+		label: "Memories",
+		permissions: ["memories:read", "memories:write"]
+	},
+	{
+		label: "Payloads",
+		permissions: ["payloads:read", "payloads:write"]
+	},
+	{
+		label: "Interactions",
+		permissions: [
+			"interactions:read",
+			"interactions:send",
+			"interactions:advance"
+		]
+	},
+	{
+		label: "Wake",
+		permissions: ["wake:manage"]
+	},
+	{
+		label: "Credits",
+		permissions: ["credits:read", "credits:redeem"]
+	},
+	{
+		label: "Push devices",
+		permissions: ["push_devices:manage"]
+	}
+];
+/** Held only by a key that reaches every mailbox (--all-mailboxes). */
+const EVERY_MAILBOX_KEY_PERMISSIONS = ["members:read"];
+/** The permissions a key can hold, by area, for --help-full. */
+function keyPermissionsHelp() {
+	return `Permissions a key can hold, by area, as this CLI version lists them (the API decides, and a key never holds more than you do): ${KEY_PERMISSION_AREAS.map((area) => `${area.label}: ${area.permissions.join(", ")}.`).join(" ")} Only a key that reaches every mailbox (--all-mailboxes) can also hold ${EVERY_MAILBOX_KEY_PERMISSIONS.join(", ")}.`;
+}
+/** How long the refusal hint waits on the permission check. */
+const CHECK_TIMEOUT_MS = 5e3;
+/**
+* The permission a refusal says cannot be granted to a key, or null for any
+* other refusal.
+*/
+function ungrantablePermission(payload) {
+	const error = extractErrorPayload(payload);
+	if (extractErrorCode(error) !== "validation_error") return null;
+	const message = error && typeof error === "object" ? error.message : void 0;
+	if (typeof message !== "string") return null;
+	return /^(.+) cannot be granted to a key$/.exec(message.trim())?.[1] ?? null;
+}
+/**
+* Whether the API knows `name` as a permission at all: GET /whoami?check
+* answers a check for any permission it knows and refuses any other name
+* with "unknown permission". Null when the answer says neither, or does not
+* come in time: the hint never holds the command up for longer than that.
+*/
+async function isKnownPermission(client, name) {
+	let timer;
+	const late = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(null), CHECK_TIMEOUT_MS);
+	});
+	try {
+		return await Promise.race([checkPermission(client, name), late]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+async function checkPermission(client, name) {
+	try {
+		const { identity, error } = await fetchCallerIdentity(client, { check: name }, {
+			fetch: (input, init) => globalThis.fetch(input, init),
+			signal: AbortSignal.timeout(CHECK_TIMEOUT_MS)
+		});
+		if (error) {
+			const payload = extractErrorPayload(error);
+			const message = payload && typeof payload === "object" ? payload.message : void 0;
+			return extractErrorCode(payload) === "validation_error" && typeof message === "string" && message.startsWith("unknown permission") ? false : null;
+		}
+		return identity?.check ? true : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The hint after "<name> cannot be granted to a key": whether the name is
+* not a permission at all or is one a key cannot hold, then what a key can
+* hold, as this CLI lists it. `asked` is the permissions the command asked
+* for, when the request also carried others (an update sends the key's own
+* permissions too), so a refusal of one the key already holds says so.
+*/
+async function ungrantablePermissionHint(client, name, asked) {
+	const known = await isKnownPermission(client, name);
+	const what = known === false ? `${name} is not a permission.` : known === true ? `${name} is a permission, but an API key cannot hold it.` : `${name} is not a permission an API key can hold.`;
+	if (asked && !asked.includes(name)) return `Hint: ${what} The key already holds it, so this change cannot keep it: take it off with --remove ${name}.`;
+	if (KEY_PERMISSION_AREAS.some((area) => area.permissions.includes(name)) || EVERY_MAILBOX_KEY_PERMISSIONS.includes(name)) return `Hint: ${what} This CLI's list of the permissions a key can hold still names it, so the list is older than the API's: update the CLI.`;
+	return `Hint: ${what} As this CLI version lists them, a key can hold ${KEY_PERMISSION_AREAS.flatMap((area) => area.permissions).join(", ")}, and, only when it reaches every mailbox, ${EVERY_MAILBOX_KEY_PERMISSIONS.join(", ")}. \`primitive keys create --help-full\` lists them by area.`;
+}
 // src/oclif/commands/keys.ts
 const STORE_SECRET_NOTICE = "Store this key now. It is shown only once, and the CLI does not save it.";
 const HELD_REQUEST_NOTICE = "A request already held open with this key, such as a long poll or a wait, ends once because the key's permissions changed. Run it again to use the new permissions.";
@@ -73873,11 +75341,12 @@ function describePermissions(grant) {
 	const permissions = grant.permissions ?? [];
 	return permissions.length > 0 ? permissions.join(", ") : "none";
 }
-function formatKeyRows(rows) {
-	if (rows.length === 0) return "No API keys.";
+function formatKeyRows(rows, options = {}) {
+	if (rows.length === 0) return options.includeRevoked ? "No API keys, revoked or not." : "No API keys. Revoked keys are left out; pass --include-revoked to list them too.";
 	return rows.map((row) => {
-		const suspended = row.suspended ? " [suspended]" : "";
-		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}`;
+		const suspended = row.suspended && row.status !== "revoked" ? " [suspended]" : "";
+		const revoked = row.status === "revoked" ? ` [revoked${row.revoked_at ? ` ${row.revoked_at}` : ""}]` : "";
+		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}${revoked}`;
 	}).join("\n");
 }
 function formatKeyDetail(key) {
@@ -74131,9 +75600,11 @@ async function authenticate(command, flags) {
 	});
 }
 /** Print a refusal and set a failing exit code. */
-function reportKeysError(command, outcome, auth, json) {
+async function reportKeysError(command, outcome, auth, json, askedPermissions) {
 	if (json) process.stderr.write(`${JSON.stringify(outcome.payload)}\n`);
 	else writeErrorWithHints(outcome.payload);
+	const ungrantable = ungrantablePermission(outcome.payload);
+	if (ungrantable) process.stderr.write(`${await ungrantablePermissionHint(auth.apiClient.client, ungrantable, askedPermissions)}\n`);
 	if (outcome.stepUpUrl) process.stderr.write(approveThenRerunHint(outcome.stepUpUrl));
 	surfaceUnauthorizedHint({
 		auth: auth.auth,
@@ -74149,26 +75620,37 @@ function writeWarnings(warnings) {
 var KeysListCommand = class KeysListCommand extends Command {
 	static description = `List the organization's API keys with their permissions, mail scope, expiry and last use. Only metadata is shown, never a secret.
 
-  You see your own keys, and every key if your role may read them all, as in the dashboard.`;
+  You see your own keys, and every key if your role may read them all, as in the dashboard.
+
+  Revoked keys are left out unless you pass --include-revoked, which lists them too, each marked [revoked] with when it was revoked. With --json, a revoked key has status "revoked", revoked_at and revoked_by. That confirms a revocation without having noted the key ids beforehand.`;
 	static summary = "List API keys";
-	static examples = ["<%= config.bin %> keys list", "<%= config.bin %> keys list --json"];
+	static examples = [
+		"<%= config.bin %> keys list",
+		"<%= config.bin %> keys list --json",
+		"<%= config.bin %> keys list --include-revoked"
+	];
 	static flags = {
 		"api-key": API_KEY_FLAG$1,
 		"api-base-url": API_BASE_URL_FLAG$2,
+		"include-revoked": Flags.boolean({ description: "List revoked keys too, each marked [revoked] with when it was revoked." }),
 		json: Flags.boolean({ description: "Print the keys as JSON." })
 	};
 	async run() {
 		const { flags } = await this.parse(KeysListCommand);
+		const includeRevoked = flags["include-revoked"] === true;
 		const auth = await authenticate(this, flags);
 		const items = [];
 		let cursor;
 		for (let page = 0; page < LIST_PAGE_LIMIT; page += 1) {
 			const result = await call(listKeys({
 				client: auth.apiClient.client,
-				...cursor ? { query: { cursor } } : {}
+				query: {
+					cursor,
+					include_revoked: includeRevoked ? "true" : void 0
+				}
 			}));
 			if (!result.ok) {
-				reportKeysError(this, result, auth, Boolean(flags.json));
+				await reportKeysError(this, result, auth, Boolean(flags.json));
 				return;
 			}
 			items.push(...result.data.items);
@@ -74179,7 +75661,7 @@ var KeysListCommand = class KeysListCommand extends Command {
 			this.log(JSON.stringify(items, null, 2));
 			return;
 		}
-		this.log(formatKeyRows(items));
+		this.log(formatKeyRows(items, { includeRevoked }));
 	}
 };
 var KeysGetCommand = class KeysGetCommand extends Command {
@@ -74203,7 +75685,7 @@ var KeysGetCommand = class KeysGetCommand extends Command {
 			path: { id: args.id }
 		}));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
 		this.log(flags.json ? JSON.stringify(result.data, null, 2) : formatKeyDetail(result.data));
@@ -74229,7 +75711,9 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 
   The secret is printed once, on its own line on stdout (in the JSON with --json). Store it right away: it is not shown again and the CLI does not save it.
 
-  A key limited to email rules (--rule, repeatable) reaches only the mail those rules match. Give it mail:read with --permission, or use --preset own_addresses_read_only.`;
+  A key limited to email rules (--rule, repeatable) reaches only the mail those rules match. Give it mail:read with --permission, or use --preset own_addresses_read_only.
+
+  ${keyPermissionsHelp()}`;
 	static summary = "Create an API key";
 	static examples = [
 		"<%= config.bin %> keys create --name reader --preset read_only",
@@ -74246,7 +75730,7 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 			options: [...KEY_PRESETS]
 		}),
 		permission: Flags.string({
-			description: "A permission the key holds (repeatable, or comma-separated), for a custom key.",
+			description: "A permission the key holds (repeatable, or comma-separated), for a custom key. See --help-full for the permissions a key can hold.",
 			multiple: true
 		}),
 		address: Flags.string({
@@ -74301,7 +75785,7 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 			}
 		})), approvalIo(flags));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
 		const key = result.data;
@@ -74372,7 +75856,7 @@ var KeysRotateCommand = class KeysRotateCommand extends Command {
 			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
 		})), approvalIo(flags));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
 		const rotated = result.data;
@@ -74382,7 +75866,7 @@ var KeysRotateCommand = class KeysRotateCommand extends Command {
 var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 	static description = `Change an API key's permissions, email rules, name or expiry. It keeps its id and secret.
 
-  --add and --remove take permissions (repeatable, or comma-separated). --add-rule and --remove-rule add email rules to the key or take them off, and keep its other rules. --rule replaces every rule the key has with the ones given, so pass all the rules it should keep; it cannot be combined with --add-rule or --remove-rule. --expires-at gives it a new expiry: a later one extends it, within your organization's credential policy, and is how to keep a key working past its expiry (rotating keeps the expiry). --no-expiry removes it where the policy allows. An expired key cannot be extended. Everything else about the key stays as it is, and the output lists any rules a change took off.
+  --add and --remove take permissions (repeatable, or comma-separated); \`primitive keys create --help-full\` lists the permissions a key can hold. --add-rule and --remove-rule add email rules to the key or take them off, and keep its other rules. --rule replaces every rule the key has with the ones given, so pass all the rules it should keep; it cannot be combined with --add-rule or --remove-rule. --expires-at gives it a new expiry: a later one extends it, within your organization's credential policy, and is how to keep a key working past its expiry (rotating keeps the expiry). --no-expiry removes it where the policy allows. An expired key cannot be extended. Everything else about the key stays as it is, and the output lists any rules a change took off.
 
   The change runs directly; if your organization requires approval, the command prints the approval link and takes --step-up-token, as for a new key. A key never holds more than you do.
 
@@ -74412,7 +75896,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 			multiple: true
 		}),
 		rule: Flags.string({
-			description: "An email rule id the key reaches (repeatable, or comma-separated). Replaces every rule the key has: pass all the rules it should keep, or use --add-rule and --remove-rule.",
+			description: "Replaces the key's rules with these email rule ids. Pass every rule it should keep (repeatable, or comma-separated), or use --add-rule and --remove-rule, which keep its other rules.",
 			multiple: true,
 			exclusive: ["add-rule", "remove-rule"]
 		}),
@@ -74470,7 +75954,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 				path: { id: args.id }
 			}));
 			if (!current.ok) {
-				reportKeysError(this, current, auth, Boolean(flags.json));
+				await reportKeysError(this, current, auth, Boolean(flags.json));
 				return;
 			}
 			if (current.data.status === "revoked") this.error(`Key ${args.id} is revoked, so it cannot be changed.`, { exit: 1 });
@@ -74511,7 +75995,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
 		})), approvalIo(flags));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json), add);
 			return;
 		}
 		const grantChanged = result.data.changed.includes("grant");
@@ -74554,8 +76038,82 @@ function standingSummary(standing) {
 	const kept = standing.length - keyOwned;
 	return `${[...kept > 0 ? [`${kept} item(s) the organization owns keep working.`] : [], ...keyOwned > 0 ? [`${keyOwned} item(s) the key owned itself or carried on for the keys it was rotated from, such as its own webhooks, which keep working only while someone can still act for them, such as a key of the same rotation that still works.`] : []].join(" ")} Review them with --json.`;
 }
+/** How many standing objects the summary lists one by one. */
+const STANDING_LIST_LIMIT = 10;
+const STANDING_KIND_LABELS = {
+	endpoint: "webhook",
+	function_trigger: "Function trigger",
+	pull_subscription: "pull subscription",
+	recipient_route: "route",
+	filter_rule: "filter",
+	wake_schedule: "wake schedule"
+};
+/** Whether a revoke answer says, per item, what still acts for it or delivers. */
+function reportsCascade(standing) {
+	return standing.some((item) => "still_acting" in item || "delivering" in item);
+}
+/**
+* A standing object's label. A Function trigger's label is only "function" and
+* an unnamed pull subscription's only "pull", so those carry their id; a
+* webhook's URL loses its query and fragment, which can hold a token.
+*/
+function standingLabel(item) {
+	const id = typeof item.id === "string" ? item.id : String(item.id);
+	const label = typeof item.label === "string" && item.label ? item.label : id;
+	if (item.kind === "function_trigger") return id;
+	if (item.kind === "pull_subscription") return label === id || label === "pull" ? id : `${label} (${id})`;
+	if (item.kind === "endpoint") {
+		const cut = label.search(/[?#]/);
+		return cut >= 0 ? `${label.slice(0, cut)}?...` : label;
+	}
+	return label;
+}
+/** One standing object, with who still acts for it and whether it delivers. */
+function standingLine(item, leftWorking) {
+	const kind = typeof item.kind === "string" ? STANDING_KIND_LABELS[item.kind] ?? item.kind : "item";
+	let acting;
+	if (item.org_owned !== false) acting = "the organization owns it, so revoking does not stop it";
+	else if (item.still_acting === true) {
+		const by = typeof item.acting_key_id === "string" && item.acting_key_id ? item.acting_key_id : null;
+		acting = !by ? "owned by the revoked key; someone still acts for it, so it keeps working while they do" : leftWorking.has(by) ? `owned by the revoked key; key ${by} still acts for it until that key's overlap ends` : `owned by the revoked key; key ${by} still acts for it, so it keeps working while that key does`;
+	} else if (item.still_acting === false) acting = "owned by the revoked key; nothing acts for it, so it does not work";
+	else if (item.still_acting === null) acting = "owned by the revoked key; whether anything still acts for it could not be read, and it works only while something does";
+	else acting = "owned by the revoked key; it keeps working only while someone can still act for it";
+	const delivering = item.delivering === true ? "; still delivering received mail" : item.delivering === false ? "; not delivering received mail" : item.delivering === null ? "; whether it still delivers could not be read" : "";
+	return `  ${kind} ${standingLabel(item)}: ${acting}${delivering}.`;
+}
+/**
+* What a revoke did beyond the key itself, from the answer: the keys it
+* replaced that were revoked with it or left working, and, for each item the
+* key set up or owns, whether anything still acts for it and whether it still
+* delivers. Lines, empty when the answer has none of these. An answer from a
+* server that does not report them per item falls back to standingSummary.
+*/
+function revokeCascadeLines(data) {
+	if (!data || typeof data !== "object") return [];
+	const answer = data;
+	const lines = [];
+	const ids = (value) => Array.isArray(value) ? value.filter((id) => typeof id === "string") : [];
+	const named = (list) => list.length > 0 ? `: ${list.join(", ")}` : "";
+	const revoked = answer.predecessors_revoked_count;
+	if (typeof revoked === "number" && revoked > 0) lines.push(`Also revoked ${revoked === 1 ? "1 key" : `${revoked} keys`} it replaced, still in ${revoked === 1 ? "its" : "their"} rotation overlap${named(ids(answer.predecessors_revoked))}.`);
+	const left = answer.predecessors_left;
+	if (typeof left === "number" && left > 0) lines.push(`${left === 1 ? "1 key" : `${left} keys`} it replaced ${left === 1 ? "is" : "are"} left working until ${left === 1 ? "its" : "their"} overlap ends, because you may not revoke ${left === 1 ? "it" : "them"}${named(ids(answer.predecessors_not_revoked))}; what ${left === 1 ? "it acts" : "they act"} for keeps working until then.`);
+	const leftWorking = new Set(ids(answer.predecessors_not_revoked));
+	const standing = Array.isArray(answer.standing_objects) ? answer.standing_objects.filter((item) => item !== null && typeof item === "object") : [];
+	if (standing.length > 0 && reportsCascade(standing)) {
+		lines.push("What it set up, owns or carried on for the keys it replaced (revoking deletes none of it):");
+		for (const item of standing.slice(0, STANDING_LIST_LIMIT)) lines.push(standingLine(item, leftWorking));
+		const more = standing.length - STANDING_LIST_LIMIT;
+		if (more > 0) lines.push(`  ${more} more; --json lists them all.`);
+	} else {
+		const summary = standingSummary(answer.standing_objects);
+		if (summary) lines.push(summary);
+	}
+	return lines;
+}
 var KeysRevokeCommand = class KeysRevokeCommand extends Command {
-	static description = `Revoke an API key. It stops working at once. What the organization owns keeps working; what the key itself owns, such as its own webhooks, keeps working only while someone can still act for it, such as a key of the same rotation that still works. What it set up or owns is listed for review.
+	static description = `Revoke an API key. It stops working at once. What the organization owns keeps working; what the key itself owns, such as its own webhooks, keeps working only while someone can still act for it, such as a key of the same rotation that still works. What it set up or owns is listed for review, each with whether anything still acts for it and, for a webhook, whether it still delivers received mail. Keys it replaced that are still in their rotation overlap are revoked with it, except any you may not revoke; the output counts both, and names them and the key acting for each item when you may read the organization's keys.
 
   Asks for confirmation first; pass --yes to skip the prompt in scripts. Revoking runs directly. If your organization requires approval, the command prints the approval link, opens it where it can and waits for the one-time token; in a script, approve and run it again with --step-up-token.`;
 	static summary = "Revoke an API key";
@@ -74597,16 +76155,17 @@ var KeysRevokeCommand = class KeysRevokeCommand extends Command {
 			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
 		})), approvalIo(flags));
 		if (!result.ok) {
-			reportKeysError(this, result, auth, Boolean(flags.json));
+			await reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
 		if (flags.json) {
 			this.log(JSON.stringify(result.data, null, 2));
 			return;
 		}
-		this.log(result.data.already_revoked === true ? `Key ${args.id} was already revoked; nothing changed.` : `Revoked key ${args.id}.`);
-		const summary = standingSummary(result.data.standing_objects);
-		if (summary) this.log(summary);
+		const replaced = result.data.predecessors_revoked_count;
+		const alsoRevoked = typeof replaced === "number" && replaced > 0;
+		this.log(result.data.already_revoked === true ? alsoRevoked ? `Key ${args.id} was already revoked.` : `Key ${args.id} was already revoked; nothing changed.` : `Revoked key ${args.id}.`);
+		for (const line of revokeCascadeLines(result.data)) this.log(line);
 	}
 };
 const hash = (value) => createHash("sha256").update(value).digest("hex");
@@ -83161,7 +84720,9 @@ var SendCommand = class SendCommand extends Command {
   \`primitive account whoami\` reports) when you may send from it; a key
   whose grant names exactly one address sends from that address. Otherwise
   there is no default: the command lists the addresses you may send from
-  and asks for --from. Without --json, stderr names the From it used.
+  and asks for --from. A credential without mail:send is refused with
+  grant_forbidden naming mail:send instead, since no --from would help.
+  Without --json, stderr names the From it used.
   --subject defaults to the first line of the body when omitted.
   --attachment attaches a file; repeat it to attach multiple files.
   --header adds a custom header such as "X-Campaign-Id: spring-sale";
@@ -83216,7 +84777,7 @@ var SendCommand = class SendCommand extends Command {
 			description: "Recipient address (e.g. alice@example.com).",
 			required: true
 		}),
-		from: Flags.string({ description: "Sender address. Without it: a connected agent's own address, your member address on your own login, or a key's one granted address; otherwise the command asks for --from." }),
+		from: Flags.string({ description: "Sender address. Without it: a connected agent's own address, your member address on your own login, or a key's one granted address; otherwise the command asks for --from, except that a credential without mail:send is refused by that permission." }),
 		subject: Flags.string({ description: "Subject line. Defaults to the first line of --body / --html when omitted." }),
 		body: Flags.string({ description: "Plain-text message body. Either --body or --html (or both) is required." }),
 		"body-file": Flags.string({ description: "Read the plain-text message body from a UTF-8 file. This does not attach the file; use --attachment for file attachments. Mutually exclusive with --body and --body-stdin." }),
@@ -84625,6 +86186,11 @@ const WAIT_EXIT_CODES = {
 const MAX_LONG_POLL_SECONDS = 30;
 const TAIL_PAGE_SIZE = 100;
 const EXISTING_PAGE_SIZE = 50;
+/**
+* Pages of mail made visible since the start that are read before the
+* long-poll; any more are walked by the long-poll itself.
+*/
+const SINCE_START_PAGES = 5;
 const PRINTED_BODY_CHARS = 1200;
 const JSON_TEXT_CHARS = 4e3;
 /**
@@ -84765,9 +86331,20 @@ async function firstMatch(api, apiClient, rows, filters, seen) {
 	}
 	return null;
 }
-function arrivedSince(row, threshold) {
-	const at = Date.parse(str(row.created_at) ?? str(row.received_at) ?? "");
-	return Number.isFinite(at) && at >= threshold;
+/**
+* The forward-tail cursor for an instant, on the client clock: the tail
+* returns what became visible after it.
+*/
+function tailCursorAt(at) {
+	return `${new Date(at).toISOString().replace(/Z$/, "000Z")}|${TIME_CURSOR_ID}`;
+}
+/**
+* Whether tail cursor `a` sorts before `b`. A cursor's time is microseconds
+* from the tail and milliseconds from a list row, so it is padded first.
+*/
+function cursorBefore(a, b) {
+	const pad = (cursor) => cursor.replace(/(\.\d{3})Z\|/, "$1000Z|");
+	return pad(a) < pad(b);
 }
 /**
 * Block until an email matching `filters` arrives (or, with
@@ -84795,11 +86372,21 @@ async function tailForEmail(api, params) {
 		apiClient,
 		api
 	});
-	const recent = await listRows(api, apiClient, { limit: EXISTING_PAGE_SIZE });
-	const early = await firstMatch(api, apiClient, recent.rows.filter((row) => arrivedSince(row, params.startedAt)).reverse(), filters, seen);
-	if (early) return early;
+	let fromStart = tailCursorAt(params.startedAt);
+	let caughtUp = false;
+	for (let read = 0; read < SINCE_START_PAGES && !caughtUp; read += 1) {
+		const page = await listRows(api, apiClient, {
+			limit: TAIL_PAGE_SIZE,
+			since: fromStart
+		});
+		const early = await firstMatch(api, apiClient, page.rows, filters, seen);
+		if (early) return early;
+		if (page.rows.length < TAIL_PAGE_SIZE || !page.cursor) caughtUp = true;
+		else fromStart = page.cursor;
+	}
+	if (!caughtUp && cursorBefore(fromStart, since)) since = fromStart;
 	if (params.includeExisting) {
-		const found = await firstMatch(api, apiClient, recent.rows, filters, seen);
+		const found = await firstMatch(api, apiClient, (await listRows(api, apiClient, { limit: EXISTING_PAGE_SIZE })).rows, filters, seen);
 		if (found) return found;
 	}
 	for (;;) {
@@ -85592,265 +87179,6 @@ var WakeSchedulesUpdateCommand = class WakeSchedulesUpdateCommand extends Comman
 		});
 	}
 };
-// src/oclif/commands/whoami.ts
-/**
-* `GET /whoami` with its grant query parameters. A server without grants
-* ignores them and answers without `grant` or `check`.
-*/
-async function fetchCallerIdentity(client, query) {
-	const result = await client.get({
-		query,
-		responseStyle: "fields",
-		security: [{
-			scheme: "bearer",
-			type: "http"
-		}],
-		url: "/whoami"
-	});
-	if (result.error) return {
-		identity: null,
-		error: result.error
-	};
-	return {
-		identity: result.data?.data ?? null,
-		error: null
-	};
-}
-function formatGrant(grant) {
-	const lines = [`Grant: ${grant.template ? `template ${grant.template}` : `${grant.grant_type ?? "grant"} with ${grant.permissions.length} permissions`}, ${grant.mail_scope === "org" || grant.mail_scope === void 0 ? "all mail in the organization" : "a narrowed mail scope"} (${grant.credential_kind})`];
-	if (grant.expires_at) lines.push(`Credential expires: ${grant.expires_at}`);
-	return lines;
-}
-/** Lines describing the caller's organization, role and grant. */
-function formatGrantLines(identity, options = {}) {
-	const lines = [];
-	const org = options.orgName ? `${options.orgName} (${identity.org_id})` : identity.org_id;
-	lines.push(`Organization: ${org}`);
-	if (isPersonIdentity(identity)) lines.push(identity.role === "member" ? "Built-in role: member (also shown for a template or custom role that does not fully include member; the Grant line is what this login can do)" : isBuiltInRoleKey(identity.role) ? `Built-in role: ${identity.role}` : `Role key: ${identity.role}`);
-	const grant = identity.grant;
-	if (grant) lines.push(...formatGrant(grant));
-	if (options.userLogin) lines.push("Signed in as yourself. Switch organizations with `primitive org use <org>`.");
-	return lines;
-}
-function formatPermissionCheck(check) {
-	if (check.allow) return `${check.permission}: allowed`;
-	return `${check.permission}: not allowed${check.reason ? ` (${check.reason})` : ""}`;
-}
-/** Whether GET /whoami answered for an API key. */
-function isKeyIdentity(identity) {
-	return Boolean(identity.key_id) || identity.auth_method === "api_key";
-}
-/** Whether GET /whoami answered for a person's own session or OAuth login. */
-const PERSON_AUTH_METHODS = /* @__PURE__ */ new Set([
-	"oauth",
-	"session",
-	"dashboard_bridge"
-]);
-function isPersonIdentity(identity) {
-	return !isKeyIdentity(identity) && typeof identity.auth_method === "string" && PERSON_AUTH_METHODS.has(identity.auth_method);
-}
-/** What the summary's first line says about who is calling. */
-function identityLine(identity) {
-	if (!identity || identity.member_address === void 0) return "Authenticated";
-	if (identity.member_address) return `Authenticated as ${identity.member_address.address} (your member address)`;
-	if (isKeyIdentity(identity)) return "Authenticated (API keys have no member address)";
-	if (!isPersonIdentity(identity)) return "Authenticated (this credential has no member address)";
-	return `Authenticated (you have no member address in this organization${identity.member_address_suggestion ? `; \`primitive account provision-member-address --address ${identity.member_address_suggestion}\` sets one` : ""})`;
-}
-function formatWhoamiSummary(account, managedInboxDomain, orgName = null, identity = null) {
-	const lines = [
-		identityLine(identity),
-		orgName ? `Organization: ${orgName} (${account.id})` : `Organization id: ${account.id}`,
-		...account.email ? [`Account email: ${account.email} (the email the account was opened with)`] : [],
-		`Plan: ${account.plan}`
-	];
-	if (managedInboxDomain) lines.push(`Managed inbox: any-local-part@${managedInboxDomain}`);
-	return lines.join("\n");
-}
-/** `GET /whoami/grant`, which any credential may ask about itself. */
-async function fetchOwnGrant(client) {
-	try {
-		const result = await getOwnGrant({
-			client,
-			responseStyle: "fields"
-		});
-		if (result.error) return null;
-		return result.data?.data ?? null;
-	} catch {
-		return null;
-	}
-}
-/** The summary for a valid credential whose grant cannot read the account. */
-function formatOwnGrantSummary(own, orgName) {
-	return [
-		"Authenticated. This credential cannot read the account (it lacks org:read).",
-		orgName ? `Organization: ${orgName} (${own.org_id})` : `Organization id: ${own.org_id}`,
-		...own.grant ? formatGrant(own.grant) : []
-	].join("\n");
-}
-var WhoamiCommand = class WhoamiCommand extends Command {
-	static description = `Print the account currently authenticated by saved OAuth credentials or an explicit API key. For account credentials this is a live credentials smoke test. Use account whoami for the authenticated caller, their assigned member address and an address suggestion; account provision-member-address --address <email> saves your chosen personal address.
-
-  With PRIMITIVE_AGENT_PROFILE selected, print the saved connected-agent identity offline, with no API call. The first line is the agent's email address alone; --json adds address, profile and source (session_hook when the selected profile is this Claude Code session's own agent exported by the session start hook, env otherwise). This does not verify live authentication, app pairing, or listener readiness. Inspect the receiver separately: the output names the command for the profile's receiver mode (agent connect --status for Claude hook and poll receivers, listen --status --notify-session for a native listener).
-
-  The default output is a concise human summary. Pass --json for the full /account response or the explicit offline connected-agent identity envelope.`;
-	static summary = "Print the live account or saved connected-agent identity";
-	static examples = [
-		"<%= config.bin %> whoami",
-		"<%= config.bin %> whoami --api-key prim_...",
-		"<%= config.bin %> whoami --json | jq .id",
-		"PRIMITIVE_AGENT_PROFILE=work <%= config.bin %> whoami --json"
-	];
-	static flags = {
-		"api-key": Flags.string({
-			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
-			env: "PRIMITIVE_API_KEY"
-		}),
-		"api-base-url": Flags.string({
-			description: API_BASE_URL_FLAG_DESCRIPTION,
-			env: "PRIMITIVE_API_BASE_URL",
-			hidden: true
-		}),
-		json: Flags.boolean({ description: "Print the account JSON response, or the saved connected identity marked verification: offline. Never prints credentials." }),
-		grant: Flags.boolean({ description: "With --json, add `grant`: the organization, role and grant of this credential. The summary shows them when the server reports them; only a person's own login has a role line." }),
-		check: Flags.string({ description: "Ask whether this credential may use a permission, such as mail:send. Prints the decision and exits 1 when it is not allowed. Nothing is enforced by asking." }),
-		resource: Flags.string({
-			description: "With --check, the resource to check against, as function:<id>, domain:<id>, endpoint:<id> or route:<id>.",
-			dependsOn: ["check"]
-		}),
-		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
-	};
-	async run() {
-		const { flags } = await this.parse(WhoamiCommand);
-		await runWithTiming(flags.time, async () => {
-			const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
-				apiKey: flags["api-key"],
-				apiBaseUrl: flags["api-base-url"],
-				configDir: this.config.configDir
-			});
-			if (auth.connectedAgent && flags.check !== void 0) throw new Errors.CLIError("--check needs a live account credential. A selected connected-agent profile is shown offline; rerun with `PRIMITIVE_AGENT_PROFILE=` in front of the command to check the member login.", { exit: 1 });
-			if (auth.connectedAgent) {
-				const identity = auth.connectedAgent;
-				const statusCommand = `${cliInvocation(process.argv[1])} agent connect --profile ${identity.profileName} --status --json`;
-				const receiver = receiverStatusCommand(this.config.configDir, identity.profileName);
-				const guidance = `Saved identity only. Live authentication, app pairing, and receiving readiness are not verified. Inspect the ${receiver.mode === "external" ? "Claude hook receiver" : receiver.mode === "poll" ? "poll receiver" : "receiver"} with \`${receiver.command}\`.`;
-				const source = agentIdentitySource(identity);
-				const selectedBy = source === "session_hook" ? `this Claude Code session's start hook (PRIMITIVE_AGENT_PROFILE=${identity.profileName})` : `PRIMITIVE_AGENT_PROFILE=${identity.profileName}`;
-				this.log(flags.json ? JSON.stringify({
-					address: identity.agentAddress,
-					profile: identity.profileName,
-					source,
-					auth_method: "agent_connection",
-					verification: "offline",
-					identity,
-					status_command: statusCommand,
-					guidance
-				}, null, 2) : `${identity.agentAddress}\nSelected by: ${selectedBy}. Prefix a command with \`PRIMITIVE_AGENT_PROFILE=\` to run it as the member login instead.\nSaved connected-agent profile: ${identity.profileName}\nAgent address: ${identity.agentAddress}\nOwner personal address (send reports here): ${identity.ownerMemberAddress ?? "unknown; reply to the member who wrote to you"}\nControl address (setup and presence only): ${identity.ownerAddress}\nAPI origin: ${identity.apiBaseUrl}\n${guidance}\nSaved profile status: ${statusCommand}`);
-				return;
-			}
-			if (isConnectedChatCredential(auth.apiKey)) throw new Errors.CLIError("This connection credential cannot inspect an account. Select its saved profile with PRIMITIVE_AGENT_PROFILE to inspect the connected identity offline.", { exit: 1 });
-			if (flags.check !== void 0) {
-				const check = flags.check.trim();
-				if (!/^[a-z][a-z0-9_.]*:[a-z][a-z0-9_]*$/.test(check)) throw new Errors.CLIError(`--check ${JSON.stringify(flags.check)} is not a permission. Permissions look like \`mail:send\`.`, { exit: 2 });
-				const { identity, error } = await fetchCallerIdentity(apiClient.client, {
-					check,
-					...flags.resource ? { resource: flags.resource.trim() } : {}
-				});
-				if (error) {
-					const errorPayload = extractErrorPayload(error);
-					writeErrorWithHints(errorPayload);
-					surfaceUnauthorizedHint({
-						auth,
-						baseUrlOverridden,
-						configDir: this.config.configDir,
-						payload: errorPayload
-					});
-					process.exitCode = 1;
-					return;
-				}
-				const decision = identity?.check;
-				if (!decision) throw new Errors.CLIError("This Primitive server does not answer permission checks.", { exit: 1 });
-				this.log(flags.json ? JSON.stringify(decision, null, 2) : formatPermissionCheck(decision));
-				if (!decision.allow) process.exitCode = 1;
-				return;
-			}
-			const result = await getAccount({
-				client: apiClient.client,
-				responseStyle: "fields"
-			});
-			if (result.error) {
-				const errorPayload = extractErrorPayload(result.error);
-				const own = isGrantRefusal(errorPayload) ? await fetchOwnGrant(apiClient.client) : null;
-				if (own) {
-					const orgName = auth.credentials?.org_id === own.org_id ? auth.credentials.org_name ?? null : null;
-					this.log(flags.json ? JSON.stringify({
-						account: null,
-						...own,
-						org_name: orgName
-					}, null, 2) : formatOwnGrantSummary(own, orgName));
-					return;
-				}
-				writeErrorWithHints(errorPayload);
-				surfaceUnauthorizedHint({
-					auth,
-					baseUrlOverridden,
-					configDir: this.config.configDir,
-					payload: errorPayload
-				});
-				process.exitCode = 1;
-				return;
-			}
-			const account = result.data?.data;
-			if (!account) {
-				process.stderr.write("Server returned an empty account body; this should not happen for a valid key.\n");
-				throw new Errors.CLIError("unexpected empty response");
-			}
-			let managedInboxDomain = null;
-			try {
-				const domainsResult = await listDomains({
-					client: apiClient.client,
-					responseStyle: "fields"
-				});
-				if (!domainsResult.error) managedInboxDomain = (domainsResult.data?.data ?? []).find((row) => row.verified && row.managed_zone !== null)?.domain ?? null;
-			} catch {}
-			const orgName = auth.credentials?.org_id === account.id ? auth.credentials.org_name ?? null : null;
-			const session = guardedSession(void 0, process.env);
-			let registration = null;
-			try {
-				registration = session ? failedSessionRegistration(this.config.configDir, session) : null;
-			} catch {
-				registration = null;
-			}
-			let identity = null;
-			if (!flags.json || flags.grant) try {
-				identity = (await fetchCallerIdentity(apiClient.client, { include: "grant" })).identity;
-			} catch {
-				identity = null;
-			}
-			if (flags.json) {
-				this.log(JSON.stringify({
-					...account,
-					managed_inbox_domain: managedInboxDomain,
-					org_name: orgName,
-					...registration ? { session_registration: registration } : {},
-					...flags.grant ? {
-						grant: identity?.grant ?? null,
-						org_id: identity?.org_id ?? null,
-						role: identity?.role ?? null
-					} : {}
-				}, null, 2));
-				return;
-			}
-			const summary = [formatWhoamiSummary(account, managedInboxDomain, orgName, identity)];
-			if (identity?.grant) summary.push(...formatGrantLines(identity, {
-				orgName: auth.credentials?.org_name ?? null,
-				userLogin: auth.credentials?.auth_method === "user_grant"
-			}).filter((line) => !line.startsWith("Organization:")));
-			this.log(summary.join("\n"));
-			if (registration) this.log(registrationSummaryLine(registration));
-		});
-	}
-};
 // src/oclif/fish-completion.ts
 function fishEscape(value) {
 	return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");