primcli 3.0.0-preview.7 → 3.0.0-preview.8

package/dist/{api-command-BXYpylbG.js → api-command-TUwewvqZ.js}

@@ -1,4 +1,4 @@
-import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-C6tOKAqk.js";
+import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-DNbrLjEF.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
 import { a as thrownErrorBody } from "./json-output-ch756TXV.js";
@@ -10557,7 +10557,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "revoke-credential",
-		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true and revoked 0, to a caller who could have revoked it; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
+		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked by the person who holds it, whatever it reaches, or by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. Revoking an API key also revokes the keys it replaced in its rotation that are still in their overlap and that you may revoke (predecessors_revoked_count; predecessors_left counts the rest), so its webhooks stop at once; the keys that replaced it carry its work on. Revoking a key already revoked does the same for those keys. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from, each saying whether anything still acts for it (still_acting, with the key in acting_key_id) and, for a webhook, whether it is still delivering. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true, to a caller who could have revoked it, and revoked counts only the keys it replaced that were revoked now; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "revokeCredential",
@@ -10670,7 +10670,7 @@ const operationManifest = [
 					}
 				},
 				"already_revoked": {
-					"description": "true when the API key was already revoked, so nothing changed and revoked is 0. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
+					"description": "true when the API key was already revoked. revoked then counts only the keys it replaced that were revoked now. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
 					"type": "boolean"
 				},
 				"keep_failed": {
@@ -10703,6 +10703,18 @@ const operationManifest = [
 							"org_owned": {
 								"type": "boolean",
 								"description": "true: the organization owns it, and it keeps working. false: the credential owns it itself, as with everything a third-party app or agent delegate made, a webhook made with a narrowed API key, or a wake schedule made with a key that does not cover super_admin. It keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to or kept it. Revoking a third-party app or agent delegate turns these off, except that a block filter it made keeps blocking, within the reach the app had, unless the person revoking chose to stop it."
+							},
+							"still_acting": {
+								"description": "For an API key: whether anything still acts for it after this revoke (the organization, a key of the same rotation that still works, or whoever took it over). Null when that could not be read.",
+								"type": ["boolean", "null"]
+							},
+							"acting_key_id": {
+								"description": "For an API key: the key that still acts for it, shown to a caller who may read the organization's API keys. Null otherwise, and when no key does.",
+								"type": ["string", "null"]
+							},
+							"delivering": {
+								"description": "For an API key's webhook: whether it is still sent received mail, as GET /v1/endpoints/{id} delivery.delivering says. Null when that could not be read.",
+								"type": ["boolean", "null"]
 							}
 						},
 						"required": [
@@ -10713,6 +10725,28 @@ const operationManifest = [
 						],
 						"additionalProperties": {}
 					}
+				},
+				"predecessors_revoked_count": {
+					"description": "For an API key: how many keys it replaced in its rotation, still in their overlap, were revoked with it. Keys that replaced it never are.",
+					"type": "integer",
+					"minimum": -9007199254740991,
+					"maximum": 9007199254740991
+				},
+				"predecessors_left": {
+					"description": "For an API key: how many such keys were left working because you may not revoke them. They work until their overlap ends.",
+					"type": "integer",
+					"minimum": -9007199254740991,
+					"maximum": 9007199254740991
+				},
+				"predecessors_revoked": {
+					"description": "The ids of the keys counted in predecessors_revoked_count, to a caller who may read the organization's API keys.",
+					"type": "array",
+					"items": { "type": "string" }
+				},
+				"predecessors_not_revoked": {
+					"description": "The ids of the keys counted in predecessors_left, to a caller who may read the organization's API keys.",
+					"type": "array",
+					"items": { "type": "string" }
 				}
 			},
 			"required": [
@@ -10731,7 +10765,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "rotate-key",
-		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "rotateKey",
@@ -10905,7 +10939,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-key",
-		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. The one exception is suspending a key (suspended true with no other change; expected_grant_ref may accompany it), which the person who holds it may do whatever the key reaches, calling as themself rather than through another app; lifting a suspension is a change like any other. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateKey",
@@ -12917,7 +12951,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "accept-email-rule-request",
-		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Made-up emails sent in expectation_samples are kept on the rule this writes, where GET /v1/email-rules/{id} lists them. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "acceptEmailRuleRequest",
@@ -13034,6 +13068,112 @@ const operationManifest = [
 						},
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
+				},
+				"expectation_samples": {
+					"description": "Made-up emails the rule must match or not, such as look-alikes it must never match, kept on the rule this accept writes.",
+					"minItems": 1,
+					"maxItems": 20,
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					}
 				}
 			},
 			"additionalProperties": false
@@ -13188,6 +13328,14 @@ const operationManifest = [
 						"decline_reason": {
 							"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 							"type": ["string", "null"]
+						},
+						"edited_on_accept": {
+							"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+							"type": ["boolean", "null"]
+						},
+						"notice": {
+							"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+							"type": ["string", "null"]
 						}
 					},
 					"required": [
@@ -13234,6 +13382,10 @@ const operationManifest = [
 							"type": "string",
 							"enum": ["grant", "do_not_share"]
 						},
+						"protection_note": {
+							"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+							"type": "string"
+						},
 						"evaluation_scope": {
 							"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 							"type": "string",
@@ -13564,6 +13716,10 @@ const operationManifest = [
 						"rule",
 						"rule_id"
 					]
+				},
+				"notice": {
+					"description": "What is now shared, in words.",
+					"type": "string"
 				}
 			},
 			"required": [
@@ -13663,7 +13819,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "compile-email-rule",
-		"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to five yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "compileEmailRule",
@@ -13746,7 +13902,7 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "Parts of the description the column contract cannot express, and how the rule handles them. When the rule reads automated or from_mailing_list, it also has a note on what that column reads and what it misses. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
+					"description": "Parts of the description the column contract cannot express, and how the rule handles them. It also has notes on reading automated, from_mailing_list or sender_relationship, a sender address the description does not give, and a grant worded as a prohibition. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
 				},
 				"compiled_by": {
 					"type": "string",
@@ -13805,7 +13961,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule",
-		"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated). You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated), or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRule",
@@ -13836,9 +13992,13 @@ const operationManifest = [
 					"enum": ["grant", "do_not_share"]
 				},
 				"state": {
-					"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated.",
+					"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated; active only for a do_not_share rule.",
 					"type": "string",
-					"enum": ["draft", "observe"]
+					"enum": [
+						"draft",
+						"observe",
+						"active"
+					]
 				},
 				"evaluation_scope": {
 					"type": "string",
@@ -13899,6 +14059,112 @@ const operationManifest = [
 					"additionalProperties": false,
 					"description": "Emails it must match and must not (at most 100): a test by rule_id judges them unless expect is given, and each version it saves is checked against them."
 				},
+				"expectation_samples": {
+					"description": "Made-up emails it must match or not (at most 20).",
+					"minItems": 1,
+					"maxItems": 20,
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					}
+				},
 				"english": {
 					"type": "string",
 					"minLength": 1,
@@ -14015,6 +14281,10 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
+				"protection_note": {
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+					"type": "string"
+				},
 				"evaluation_scope": {
 					"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 					"type": "string",
@@ -14206,8 +14476,114 @@ const operationManifest = [
 						]
 					}
 				},
+				"expectation_samples": {
+					"description": "Its saved made-up emails, when this write set or added some.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": { "type": ["string", "null"] },
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"expected",
+							"label",
+							"email",
+							"created_at"
+						]
+					}
+				},
 				"expectations_check": {
-					"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
+					"description": "After a write that saved a version or changed its expectations or made-up emails, if it has some: the emails by id judged on that version from stored classifications without asking its questions, and any made-up emails listed as undecided. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed), and after a write that changed only made-up emails on a rule with emails by id. Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
 					"type": "object",
 					"properties": {
 						"version": {
@@ -14219,7 +14595,7 @@ const operationManifest = [
 							"type": ["boolean", "null"]
 						},
 						"decided": {
-							"description": "Whether every expectation was judged (undecided is empty). Absent from a server that predates it.",
+							"description": "Whether every expectation was judged (undecided and undecided_samples are empty). Absent from a server that predates it.",
 							"type": "boolean"
 						},
 						"failed": {
@@ -14236,8 +14612,24 @@ const operationManifest = [
 								"format": "uuid"
 							}
 						},
+						"failed_samples": {
+							"description": "Made-up emails that failed, by index in the set judged (saved oldest first, then added; or as sent).",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"undecided_samples": {
+							"description": "Made-up emails not decided, by index. Only a write sent with if_expectations_pass that saves a version or activates the rule judges them.",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
 						"note": {
-							"description": "On an update that saved a version that did not pass: that it was saved anyway, is current, and whether it is live.",
+							"description": "On an update that saved a version that did not pass, or a do_not_share rule created active: that it was saved anyway, is current, and whether it is live.",
 							"type": "string"
 						}
 					},
@@ -14591,6 +14983,14 @@ const operationManifest = [
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
 				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
+				},
 				"target_can_accept": {
 					"description": "Whether the member asked can accept it now under their role. Null unless you can list members and their roles (members:read), or when it could not be read.",
 					"type": ["boolean", "null"]
@@ -14811,6 +15211,14 @@ const operationManifest = [
 				"decline_reason": {
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
+				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -14968,6 +15376,320 @@ const operationManifest = [
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "generate-look-alikes",
+		"description": "Writes made-up emails that come close to what a grant rule describes but are private (a personal medical bill, pay for named people, a personal purchase, personal banking or tax, or another near case), and reports what the rule decides for each, as test-sample would. failed means the rule matched it, so it would be shared. Nothing is stored and no mail is read. Keep the ones it must never match with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "generateLookAlikes",
+		"path": "/email-rules/look-alikes",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": {
+			"type": "object",
+			"properties": {
+				"tree": {
+					"type": "object",
+					"properties": {
+						"version": {
+							"type": "number",
+							"const": 1
+						},
+						"vocabulary": {
+							"type": "string",
+							"description": "Vocabulary version, such as v1."
+						},
+						"when": {
+							"type": "object",
+							"propertyNames": { "type": "string" },
+							"additionalProperties": {},
+							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+						},
+						"questions": {
+							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": [
+						"version",
+						"vocabulary",
+						"when"
+					],
+					"additionalProperties": false
+				},
+				"english": {
+					"description": "What the tree is meant to match; without it, the tree is described in words.",
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 2e3
+				},
+				"evaluation_scope": {
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those mail:share_own lets you share). author: all you can read, inboxes added later included. selected: what scope_selection names."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
+				},
+				"rule_id": {
+					"description": "A saved rule you can see: its current version and words.",
+					"type": "string",
+					"format": "uuid"
+				},
+				"request_id": {
+					"description": "A rule request you can see: its rule as asked.",
+					"type": "string",
+					"format": "uuid"
+				},
+				"kind": {
+					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
+				"count": {
+					"description": "How many, 1 to 8; 6 by default.",
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 8
+				},
+				"kinds": {
+					"description": "Which kinds, taken in turn; all by default, the private ones first.",
+					"minItems": 1,
+					"maxItems": 5,
+					"type": "array",
+					"items": {
+						"type": "string",
+						"enum": [
+							"medical",
+							"payroll",
+							"personal_purchase",
+							"bank_tax",
+							"other"
+						]
+					}
+				},
+				"to": {
+					"description": "The mailbox they arrive in; by default the rule author's (a request's target's) sign-in address when you may see it, else yours.",
+					"type": "string",
+					"maxLength": 254,
+					"format": "email",
+					"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+				}
+			},
+			"additionalProperties": false
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"rule": {
+					"type": "object",
+					"properties": {
+						"id": {
+							"type": ["string", "null"],
+							"format": "uuid"
+						},
+						"version": {
+							"type": ["integer", "null"],
+							"exclusiveMinimum": 0
+						},
+						"vocabulary": { "type": "string" }
+					},
+					"required": [
+						"id",
+						"version",
+						"vocabulary"
+					]
+				},
+				"look_alikes": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": {
+								"type": "string",
+								"enum": [
+									"medical",
+									"payroll",
+									"personal_purchase",
+									"bank_tax",
+									"other"
+								]
+							},
+							"why": {
+								"type": "string",
+								"description": "Why the rule should not match it."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": { "type": "string" },
+											"name": { "type": "string" }
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"cc": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"subject": { "type": "string" },
+									"text": { "type": "string" },
+									"attachment_types": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" }
+								},
+								"required": [
+									"from",
+									"to",
+									"cc",
+									"subject",
+									"text",
+									"attachment_types",
+									"automated",
+									"from_mailing_list"
+								],
+								"description": "A made-up email, as test-sample takes it."
+							},
+							"outcome": {
+								"type": "string",
+								"enum": [
+									"matched",
+									"near_miss",
+									"no_match",
+									"not_decided"
+								]
+							},
+							"status": {
+								"type": "string",
+								"enum": [
+									"passed",
+									"failed",
+									"undecided"
+								],
+								"description": "failed: the rule matched it, so it would be shared. undecided: the rule reads a spam score, which it cannot carry, whatever it decided; or not matched on something it could not decide (not classified, a fact or answer missing, or not reached in time)."
+							},
+							"question_answers": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"question": { "type": "string" },
+										"answer": { "type": ["boolean", "null"] },
+										"probability": { "type": ["number", "null"] },
+										"error_class": { "type": "string" }
+									},
+									"required": [
+										"question",
+										"answer",
+										"probability"
+									]
+								}
+							}
+						},
+						"required": [
+							"kind",
+							"why",
+							"email",
+							"outcome",
+							"status",
+							"question_answers"
+						]
+					}
+				},
+				"counts": {
+					"type": "object",
+					"properties": {
+						"passed": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"failed": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"undecided": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"dropped": {
+							"type": "integer",
+							"minimum": 0,
+							"description": "Asked for but not returned: not written, outside the sample bounds, or of a kind not asked for."
+						}
+					},
+					"required": [
+						"passed",
+						"failed",
+						"undecided",
+						"dropped"
+					]
+				},
+				"note": {
+					"type": "string",
+					"description": "That the emails are made up and were never sent or stored."
+				}
+			},
+			"required": [
+				"rule",
+				"look_alikes",
+				"counts",
+				"note"
+			]
+		},
+		"sdkName": "generateLookAlikes",
+		"summary": "Write look-alike emails a rule should not match",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -15016,6 +15738,10 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
+				"protection_note": {
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+					"type": "string"
+				},
 				"evaluation_scope": {
 					"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 					"type": "string",
@@ -15197,6 +15923,112 @@ const operationManifest = [
 						}
 					},
 					"required": ["match", "no_match"]
+				},
+				"expectation_samples": {
+					"description": "Its saved made-up emails, oldest first.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": { "type": ["string", "null"] },
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"expected",
+							"label",
+							"email",
+							"created_at"
+						]
+					}
 				}
 			},
 			"required": [
@@ -15220,7 +16052,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-request",
-		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleRequest",
@@ -15384,6 +16216,14 @@ const operationManifest = [
 				"decline_reason": {
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
+				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -16266,6 +17106,14 @@ const operationManifest = [
 					"decline_reason": {
 						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 						"type": ["string", "null"]
+					},
+					"edited_on_accept": {
+						"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+						"type": ["boolean", "null"]
+					},
+					"notice": {
+						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"type": ["string", "null"]
 					}
 				},
 				"required": [
@@ -17409,6 +18257,10 @@ const operationManifest = [
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -17841,10 +18693,114 @@ const operationManifest = [
 								"type": "string",
 								"format": "uuid"
 							}
+						},
+						"samples": {
+							"maxItems": 20,
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"expected": {
+										"type": "string",
+										"enum": ["match", "no_match"]
+									},
+									"label": {
+										"type": ["string", "null"],
+										"minLength": 1,
+										"maxLength": 200,
+										"pattern": "^[^\\u0000]*$",
+										"description": "What the email stands for, such as a personal medical bill."
+									},
+									"email": {
+										"type": "object",
+										"properties": {
+											"from": {
+												"type": "object",
+												"properties": {
+													"address": {
+														"type": "string",
+														"maxLength": 254,
+														"format": "email",
+														"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+													},
+													"name": {
+														"type": "string",
+														"maxLength": 200,
+														"pattern": "^[^\\u0000]*$"
+													}
+												},
+												"required": ["address"]
+											},
+											"to": {
+												"minItems": 1,
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"maxLength": 254,
+													"format": "email",
+													"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+												}
+											},
+											"cc": {
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"maxLength": 254,
+													"format": "email",
+													"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+												}
+											},
+											"subject": {
+												"type": "string",
+												"maxLength": 998,
+												"pattern": "^[^\\u0000]*$"
+											},
+											"text": {
+												"type": "string",
+												"minLength": 1,
+												"maxLength": 4e3,
+												"pattern": "^[^\\u0000]*$"
+											},
+											"attachment_types": {
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"minLength": 1,
+													"maxLength": 255,
+													"pattern": "^[^\\u0000]*$"
+												}
+											},
+											"automated": { "type": "boolean" },
+											"from_mailing_list": { "type": "boolean" },
+											"spam_score": {
+												"type": "number",
+												"minimum": -1e3,
+												"maximum": 1e3
+											}
+										},
+										"required": [
+											"from",
+											"to",
+											"text"
+										],
+										"description": "A made-up email, as POST /email-rules/test-sample takes it."
+									},
+									"id": {
+										"type": "string",
+										"format": "uuid"
+									},
+									"created_at": { "type": "string" }
+								},
+								"required": ["expected", "email"],
+								"additionalProperties": false
+							}
 						}
 					},
 					"additionalProperties": false,
-					"description": "Emails the rule must match and must not, at most 100 in all, always tested whatever their age: added to email_ids, or to the recent window, which gives up a place for each. The answer's expectations judge each."
+					"description": "Emails the rule must match and must not (at most 100), always tested whatever their age, and made-up emails (samples, at most 20). Given, it replaces a saved rule's own."
 				}
 			},
 			"additionalProperties": false
@@ -18226,7 +19182,7 @@ const operationManifest = [
 					}
 				},
 				"expectations": {
-					"description": "Present when expect was given, or for a saved rule with saved expectations.",
+					"description": "Present when expect was given, or for a saved rule with saved expectations or made-up emails.",
 					"type": "object",
 					"properties": {
 						"passed": {
@@ -18296,6 +19252,71 @@ const operationManifest = [
 								]
 							},
 							"description": "match first, then no_match, each in the order given (saved expectations by email id)."
+						},
+						"samples": {
+							"description": "Made-up emails judged (expect.samples, or a saved rule's), in order; counts include them.",
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"index": {
+										"type": "integer",
+										"minimum": 0
+									},
+									"sample_id": {
+										"type": ["string", "null"],
+										"format": "uuid"
+									},
+									"label": { "type": ["string", "null"] },
+									"expected": {
+										"type": "string",
+										"enum": ["match", "no_match"]
+									},
+									"outcome": {
+										"type": "string",
+										"enum": [
+											"matched",
+											"near_miss",
+											"no_match",
+											"not_decided"
+										]
+									},
+									"status": {
+										"type": "string",
+										"enum": [
+											"passed",
+											"failed",
+											"undecided"
+										]
+									},
+									"question_answers": {
+										"type": "array",
+										"items": {
+											"type": "object",
+											"properties": {
+												"question": { "type": "string" },
+												"answer": { "type": ["boolean", "null"] },
+												"probability": { "type": ["number", "null"] },
+												"error_class": { "type": "string" }
+											},
+											"required": [
+												"question",
+												"answer",
+												"probability"
+											]
+										}
+									}
+								},
+								"required": [
+									"index",
+									"sample_id",
+									"label",
+									"expected",
+									"outcome",
+									"status",
+									"question_answers"
+								]
+							}
 						}
 					},
 					"required": [
@@ -18855,6 +19876,217 @@ const operationManifest = [
 					"additionalProperties": false,
 					"description": "Replaces its saved expectations (author only); null removes them."
 				},
+				"expectation_samples": {
+					"maxItems": 20,
+					"type": ["array", "null"],
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					},
+					"description": "Replaces its saved made-up emails (author only); null or [] removes them."
+				},
+				"add_expectation_samples": {
+					"description": "Adds made-up emails to those saved (author only), up to 20 in all.",
+					"minItems": 1,
+					"maxItems": 20,
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					}
+				},
 				"if_revision": {
 					"description": "The revision you read: if the rule was updated since, nothing is saved (409 email_rule_conflict, revision_moved).",
 					"type": "integer",
@@ -18895,6 +20127,10 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
+				"protection_note": {
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+					"type": "string"
+				},
 				"evaluation_scope": {
 					"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 					"type": "string",
@@ -19086,8 +20322,114 @@ const operationManifest = [
 						]
 					}
 				},
+				"expectation_samples": {
+					"description": "Its saved made-up emails, when this write set or added some.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": { "type": ["string", "null"] },
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"expected",
+							"label",
+							"email",
+							"created_at"
+						]
+					}
+				},
 				"expectations_check": {
-					"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
+					"description": "After a write that saved a version or changed its expectations or made-up emails, if it has some: the emails by id judged on that version from stored classifications without asking its questions, and any made-up emails listed as undecided. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed), and after a write that changed only made-up emails on a rule with emails by id. Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
 					"type": "object",
 					"properties": {
 						"version": {
@@ -19099,7 +20441,7 @@ const operationManifest = [
 							"type": ["boolean", "null"]
 						},
 						"decided": {
-							"description": "Whether every expectation was judged (undecided is empty). Absent from a server that predates it.",
+							"description": "Whether every expectation was judged (undecided and undecided_samples are empty). Absent from a server that predates it.",
 							"type": "boolean"
 						},
 						"failed": {
@@ -19116,8 +20458,24 @@ const operationManifest = [
 								"format": "uuid"
 							}
 						},
+						"failed_samples": {
+							"description": "Made-up emails that failed, by index in the set judged (saved oldest first, then added; or as sent).",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"undecided_samples": {
+							"description": "Made-up emails not decided, by index. Only a write sent with if_expectations_pass that saves a version or activates the rule judges them.",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
 						"note": {
-							"description": "On an update that saved a version that did not pass: that it was saved anyway, is current, and whether it is live.",
+							"description": "On an update that saved a version that did not pass, or a do_not_share rule created active: that it was saved anyway, is current, and whether it is live.",
 							"type": "string"
 						}
 					},
@@ -19355,6 +20713,14 @@ const operationManifest = [
 				"decline_reason": {
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
+				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -35371,7 +36737,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "decide-suspension",
-		"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
+		"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it needs the decider to cover it, and so does revoking an API key unless the decider holds it and decides as themself rather than through another app (revoking an uncovered key someone else holds is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "decideSuspension",
@@ -47171,7 +48537,7 @@ function sanitizeForTerminal(value) {
 	return out;
 }
 // src/oclif/answer-reports.ts
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 /** Text from an answer, made safe and one line for a report: no terminal controls. */
@@ -47180,10 +48546,10 @@ function oneLine(text) {
 }
 /** One line per warning a route write answers with (createRoute, updateRoute). */
 function routeWarningLines(data) {
-	const warnings = isRecord$2(data) ? data.warnings : void 0;
+	const warnings = isRecord$3(data) ? data.warnings : void 0;
 	if (!Array.isArray(warnings)) return [];
 	return warnings.flatMap((warning) => {
-		if (!isRecord$2(warning)) return [];
+		if (!isRecord$3(warning)) return [];
 		const message = typeof warning.message === "string" ? oneLine(warning.message) : "";
 		if (message) return [`Route warning: ${withCliCommands(message)}`];
 		const code = typeof warning.code === "string" ? oneLine(warning.code) : "";
@@ -47211,11 +48577,11 @@ const DELIVERED_STATUSES = /* @__PURE__ */ new Set(["delivered", "header_confirm
 * and has no recorded answer says so.
 */
 function deliveryAttemptLines(data) {
-	const attempts = isRecord$2(data) ? data.attempts : void 0;
+	const attempts = isRecord$3(data) ? data.attempts : void 0;
 	if (!Array.isArray(attempts)) return [];
 	const lines = [];
 	for (const attempt of attempts) {
-		if (!isRecord$2(attempt)) continue;
+		if (!isRecord$3(attempt)) continue;
 		const text = (value) => typeof value === "string" && value ? oneLine(value) : "";
 		const status = text(attempt.status);
 		const parts = [
@@ -47309,7 +48675,7 @@ var CliOrgRefusedError = class extends Errors.CLIError {
 		this.orgId = params.orgId;
 	}
 };
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function apiOrigin(apiBaseUrl) {
@@ -47336,7 +48702,7 @@ function isUuid(value) {
 	return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
 function isOrgAccessToken(value) {
-	return isRecord$1(value) && typeof value.access_token === "string" && value.access_token.length > 0 && value.token_type === "Bearer" && typeof value.expires_in === "number" && value.expires_in > 0 && typeof value.org_id === "string" && (value.org_name === null || typeof value.org_name === "string") && typeof value.oauth_grant_id === "string";
+	return isRecord$2(value) && typeof value.access_token === "string" && value.access_token.length > 0 && value.token_type === "Bearer" && typeof value.expires_in === "number" && value.expires_in > 0 && typeof value.org_id === "string" && (value.org_name === null || typeof value.org_name === "string") && typeof value.oauth_grant_id === "string";
 }
 function orgTokenFromResponse(token, now = Date.now) {
 	return {
@@ -47383,7 +48749,7 @@ async function postTokenEndpoint(params) {
 		throw new Errors.CLIError(`Could not reach the Primitive OAuth token endpoint: ${detail}`, { exit: 1 });
 	}
 	const payload = await response.json().catch(() => null);
-	if (response.ok && isRecord$1(payload)) return {
+	if (response.ok && isRecord$2(payload)) return {
 		ok: true,
 		payload
 	};
@@ -47391,7 +48757,7 @@ async function postTokenEndpoint(params) {
 		ok: true,
 		payload: {}
 	};
-	const record = isRecord$1(payload) ? payload : {};
+	const record = isRecord$2(payload) ? payload : {};
 	return {
 		ok: false,
 		status: response.status,
@@ -47594,12 +48960,12 @@ async function fetchCliOrgs(params) {
 	}
 	const payload = await response.json().catch(() => null);
 	if (!response.ok) {
-		const error = isRecord$1(payload) && isRecord$1(payload.error) ? payload.error : {};
+		const error = isRecord$2(payload) && isRecord$2(payload.error) ? payload.error : {};
 		if (response.status === 404 && error.code === "feature_disabled") throw new Errors.CLIError("This Primitive server does not support switching organizations for CLI logins.", { exit: 1 });
 		throw new Errors.CLIError(`Could not list organizations${typeof error.message === "string" ? `: ${error.message}` : ` (HTTP ${response.status}).`}`, { exit: 1 });
 	}
-	const data = isRecord$1(payload) ? payload.data : null;
-	if (!isRecord$1(data) || !Array.isArray(data.orgs)) throw new Errors.CLIError("Primitive API returned an unexpected organization list.", { exit: 1 });
+	const data = isRecord$2(payload) ? payload.data : null;
+	if (!isRecord$2(data) || !Array.isArray(data.orgs)) throw new Errors.CLIError("Primitive API returned an unexpected organization list.", { exit: 1 });
 	return data;
 }
 /** How long a command waits for another CLI process to finish with the saved login. */
@@ -48172,6 +49538,358 @@ async function withAttachmentWait(call, options) {
 	}
 	return result;
 }
+// src/oclif/email-rule-samples.ts
+function errorDetail(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function usageError$1(message) {
+	return new Errors.CLIError(message, { exit: 2 });
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** A path as a shell word: quoted when it holds anything but plain characters. */
+function shellWord(value) {
+	return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+/** A JSON file a flag names, parsed, or an exit-1 error saying why not. */
+function readJsonFileFlag(path, flag) {
+	let text;
+	try {
+		text = readFileSync(path, "utf8");
+	} catch (error) {
+		throw new Errors.CLIError(`Could not read ${flag} ${path}: ${errorDetail(error)}`, { exit: 1 });
+	}
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		throw new Errors.CLIError(`${flag} ${path} is not valid JSON: ${errorDetail(error)}`, { exit: 1 });
+	}
+}
+/** The longest label the API keeps on a sample. */
+const SAMPLE_LABEL_MAX = 200;
+/**
+* `text` cut to `max` UTF-16 units, as the API counts a label's length,
+* never inside a character.
+*/
+function cutLabel(text, max) {
+	const cut = text.slice(0, max);
+	return (/[\uD800-\uDBFF]$/.test(cut) ? cut.slice(0, -1) : cut).trimEnd();
+}
+/**
+* A look-alike as a must-not-match sample: the email as written, labelled
+* with its kind and why the rule should not match it ("medical: ..."), or
+* the why alone when both do not fit a label.
+*/
+function lookAlikeSample(lookAlike) {
+	if (!isRecord$1(lookAlike) || !isRecord$1(lookAlike.email)) return null;
+	const kind = typeof lookAlike.kind === "string" ? lookAlike.kind : "";
+	const why = typeof lookAlike.why === "string" ? lookAlike.why.trim() : "";
+	const both = kind && why ? `${kind}: ${why}` : kind || why;
+	const label = both.length <= SAMPLE_LABEL_MAX ? both : why.length <= SAMPLE_LABEL_MAX ? why : `${cutLabel(why, 197)}...`;
+	return {
+		expected: "no_match",
+		...label ? { label } : {},
+		email: lookAlike.email
+	};
+}
+/**
+* The look-alikes of a generate-look-alikes answer that can be saved (each
+* with an email), in the answer's order. The report numbers these and the
+* samples file holds these, so a number means the same email in both.
+*/
+function lookAlikeEntries(answer) {
+	const list = isRecord$1(answer) && Array.isArray(answer.look_alikes) ? answer.look_alikes : [];
+	const entries = [];
+	for (const item of list) {
+		const sample = lookAlikeSample(item);
+		if (sample && isRecord$1(item)) entries.push({
+			lookAlike: item,
+			sample
+		});
+	}
+	return entries;
+}
+/** The look-alikes of a generate-look-alikes answer, as samples, in order. */
+function lookAlikeSamples(answer) {
+	return lookAlikeEntries(answer).map((entry) => entry.sample);
+}
+/** The fields a saved made-up email takes, and the API's bounds on them. */
+const SAMPLE_EMAIL_KEYS = /* @__PURE__ */ new Set([
+	"from",
+	"to",
+	"cc",
+	"subject",
+	"text",
+	"attachment_types",
+	"automated",
+	"from_mailing_list",
+	"spam_score"
+]);
+const SAMPLE_TEXT_MAX = 4e3;
+const SAMPLE_SUBJECT_MAX = 998;
+const SAMPLE_LIST_MAX = 10;
+/**
+* Refuse, naming the sample and the field, a made-up email the API would
+* refuse to keep: the fields it takes and their bounds. The API checks the
+* rest (address forms, a NUL).
+*/
+function checkSampleEmail(email, at) {
+	const fail = (what) => {
+		throw usageError$1(`${at}: email ${what}.`);
+	};
+	const unknown = Object.keys(email).find((key) => !SAMPLE_EMAIL_KEYS.has(key));
+	if (unknown !== void 0) fail(`takes no "${unknown}" (it takes ${[...SAMPLE_EMAIL_KEYS].join(", ")})`);
+	if (!isRecord$1(email.from) || typeof email.from.address !== "string") fail("needs from.address");
+	const list = (key, min) => {
+		const value = email[key];
+		if (value === void 0 && min === 0) return;
+		if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string") || value.length < min || value.length > SAMPLE_LIST_MAX) fail(`${key} must be a list of ${min > 0 ? `${min} to ` : "at most "}${SAMPLE_LIST_MAX} strings`);
+	};
+	list("to", 1);
+	list("cc", 0);
+	list("attachment_types", 0);
+	if (email.subject !== void 0 && (typeof email.subject !== "string" || email.subject.length > SAMPLE_SUBJECT_MAX)) fail(`subject must be a string of at most ${SAMPLE_SUBJECT_MAX} characters`);
+	if (typeof email.text !== "string" || email.text.length === 0 || email.text.length > SAMPLE_TEXT_MAX) fail(`text must be 1 to ${SAMPLE_TEXT_MAX} characters`);
+	for (const key of ["automated", "from_mailing_list"]) if (email[key] !== void 0 && typeof email[key] !== "boolean") fail(`${key} must be true or false`);
+	if (email.spam_score !== void 0 && (typeof email.spam_score !== "number" || !Number.isFinite(email.spam_score))) fail("spam_score must be a number");
+}
+/** The keys a sample may carry: a saved one's id and time are taken and ignored. */
+const SAMPLE_KEYS = /* @__PURE__ */ new Set([
+	"expected",
+	"label",
+	"email",
+	"id",
+	"created_at"
+]);
+/**
+* The samples a file holds: a JSON array of samples, as --samples-file
+* writes them, or a generate-look-alikes answer saved as the command printed
+* it (with or without --json), whose look-alikes become must-not-match
+* samples numbered as its report numbered them. Only a literal [] holds no
+* samples; an answer with none is refused, so it never empties a rule's.
+*/
+function samplesFromJson(value, source) {
+	const data = isRecord$1(value) && isRecord$1(value.data) ? value.data : value;
+	if (isRecord$1(data) && Array.isArray(data.look_alikes)) {
+		const samples = lookAlikeSamples(data);
+		if (samples.length === 0) throw usageError$1(`${source} is a generate-look-alikes answer with no look-alikes in it.`);
+		samples.forEach((sample, index) => {
+			checkSampleEmail(sample.email, `${source}, look-alike ${index + 1}`);
+		});
+		return samples;
+	}
+	if (!Array.isArray(data)) throw usageError$1(`${source} must hold a JSON array of samples, such as [{"expected": "no_match", "label": "a personal bill", "email": {...}}], or a generate-look-alikes answer.`);
+	return data.map((item, index) => {
+		const at = `${source}, sample ${index + 1}`;
+		if (!isRecord$1(item)) throw usageError$1(`${at} is not an object.`);
+		const unknown = Object.keys(item).find((key) => !SAMPLE_KEYS.has(key));
+		if (unknown !== void 0) throw usageError$1(`${at}: "${unknown}" is not a sample field; a sample takes expected, label and email.`);
+		if (item.expected !== "match" && item.expected !== "no_match") throw usageError$1(`${at}: expected must be "match" or "no_match".`);
+		if (!isRecord$1(item.email)) throw usageError$1(`${at}: email must be an object, as test-email-rule-on-sample takes it.`);
+		checkSampleEmail(item.email, at);
+		const label = item.label;
+		if (label !== void 0 && label !== null) {
+			if (typeof label !== "string") throw usageError$1(`${at}: label must be a string.`);
+			if (label.trim() === "") throw usageError$1(`${at}: label is blank; leave it out or say what the email stands for.`);
+			if (label.trim().length > SAMPLE_LABEL_MAX) throw usageError$1(`${at}: label is longer than ${SAMPLE_LABEL_MAX} characters.`);
+		}
+		return {
+			expected: item.expected,
+			...label !== void 0 ? { label } : {},
+			email: item.email
+		};
+	});
+}
+/**
+* The numbers --pick names, from 1, in the order given and without repeats,
+* or a usage error: "2,4" or "2 4". `count` is how many there are to pick
+* from; a number past it is refused, rather than skipped.
+*/
+function pickNumbers(pick, count, source) {
+	const parts = pick.split(/[\s,]+/).map((part) => part.trim()).filter((part) => part !== "");
+	if (parts.length === 0) throw usageError$1("--pick needs the numbers of the samples to take, such as --pick 2,4.");
+	const chosen = [];
+	for (const part of parts) {
+		if (!/^\d+$/.test(part)) throw usageError$1(`--pick ${pick}: "${part}" is not a sample number.`);
+		const n = Number(part);
+		if (n < 1 || n > count) throw usageError$1(count === 0 ? `--pick ${pick}: ${source} holds no samples.` : `--pick ${pick}: ${n} is not a sample number; ${source} holds ${count === 1 ? "sample 1" : `samples 1 to ${count}`}.`);
+		if (!chosen.includes(n)) chosen.push(n);
+	}
+	return chosen;
+}
+/** The samples --pick chooses, by their numbers from 1. */
+function pickSamples(samples, pick, source) {
+	return pickNumbers(pick, samples.length, source).map((n) => samples[n - 1]);
+}
+/**
+* The number a person knows a sample a command sent by: its number in the
+* samples file when --pick took it, else its place from 1 in what was sent.
+* `index` is its place in what was sent, from 0, as the API gives it.
+*/
+function sentSampleNumber(index, flags) {
+	const pick = flags?.[PICK_FLAG];
+	if (typeof pick !== "string") return index + 1;
+	try {
+		return pickNumbers(pick, Number.MAX_SAFE_INTEGER, "")[index] ?? index + 1;
+	} catch {
+		return index + 1;
+	}
+}
+/** The samples file flags: replace (create and update), add (update), and test. */
+const SAMPLES_FILE_FLAG = "expectation-samples-file";
+const ADD_SAMPLES_FILE_FLAG = "add-expectation-samples-file";
+const EXPECT_SAMPLES_FILE_FLAG = "expect-samples-file";
+const PICK_FLAG = "pick";
+/** generate-look-alikes' flag for the file it writes them to. */
+const LOOK_ALIKES_SAMPLES_FILE_FLAG = "samples-file";
+/** The samples a samples file flag names, only those --pick chooses if given. */
+function readSamplesFile(path, flag, pick) {
+	const source = `--${flag} ${path}`;
+	const all = samplesFromJson(readJsonFileFlag(path, `--${flag}`), source);
+	const samples = typeof pick === "string" ? pickSamples(all, pick, source) : all;
+	if (samples.length > 20) throw usageError$1(`${source} holds ${samples.length} samples, and a rule or a test takes at most 20; take some with --pick.`);
+	return samples;
+}
+/** The one of `names` given as a file path, or null; --pick without one is refused. */
+function givenSamplesFlag(flags, names) {
+	const given = names.find((name) => typeof flags[name] === "string") ?? null;
+	if (given === null && typeof flags["pick"] === "string") throw usageError$1(`--pick chooses from a samples file: pass it with ${names.map((name) => `--${name}`).join(" or ")}.`);
+	return given;
+}
+/**
+* The body fields a samples file sets on create-email-rule and
+* update-email-rule: expectation_samples (on update it replaces them) or, on
+* update, add_expectation_samples. With --pick, only the samples it names.
+*/
+function samplesBodyFields(canAdd) {
+	const names = canAdd ? [SAMPLES_FILE_FLAG, ADD_SAMPLES_FILE_FLAG] : [SAMPLES_FILE_FLAG];
+	return (flags) => {
+		const flag = givenSamplesFlag(flags, names);
+		if (flag === null) return [];
+		const path = flags[flag];
+		const samples = readSamplesFile(path, flag, flags[PICK_FLAG]);
+		if (samples.length === 0 && !(canAdd && flag === "expectation-samples-file")) throw usageError$1(`--${flag} ${path} holds no samples.`);
+		return [{
+			flag: `--${flag}`,
+			property: flag === "add-expectation-samples-file" ? "add_expectation_samples" : "expectation_samples",
+			value: samples
+		}];
+	};
+}
+/**
+* The samples test-email-rule expects, from --expect-samples-file (only
+* those --pick chooses if given), or null without the flag. They go in
+* expect.samples.
+*/
+function expectSamples(flags) {
+	const flag = givenSamplesFlag(flags, [EXPECT_SAMPLES_FILE_FLAG]);
+	if (flag === null) return null;
+	const path = flags[flag];
+	const samples = readSamplesFile(path, flag, flags[PICK_FLAG]);
+	if (samples.length === 0) throw usageError$1(`--${flag} ${path} holds no samples.`);
+	return samples;
+}
+/** --pick's help, naming the flags it chooses from. */
+function pickFlagHelp(flags) {
+	return `Take only these samples from ${flags.map((flag) => `--${flag}`).join(" or ")}, by their numbers from 1 as generate-look-alikes printed them: --pick 2,4. A number the file does not hold is refused.`;
+}
+/** What the rule decided for a look-alike, and what its status makes of it. */
+function decidedLine(outcome, status) {
+	if (outcome === "not_decided") return "The rule did not decide it: it was not reached in time, or deciding it failed.";
+	if (outcome === "matched") return status === "undecided" ? "The rule matched it, but it reads a spam score, which a look-alike does not carry, so this one is undecided." : "The rule matched it, so mail like it would be shared.";
+	const decided = outcome === "near_miss" ? "The rule nearly matched it, but did not" : "The rule did not match it";
+	return status === "undecided" ? `${decided}, on something it could not decide (its classification failed, a fact or a question's answer is missing, or it reads a spam score, which a look-alike does not carry), so this one is undecided.` : `${decided}.`;
+}
+/**
+* The stderr report of generate-look-alikes: each look-alike numbered as the
+* samples file numbers it, with its status, kind, subject, sender, why the
+* rule should not match it and what the rule decided; the counts; the
+* answer's note; and how to save the ones you choose. With --samples-file it
+* writes every look-alike there as a must-not-match sample, in that order.
+*/
+function lookAlikesReport(data, request) {
+	const file = request.flags?.[LOOK_ALIKES_SAMPLES_FILE_FLAG];
+	if (!isRecord$1(data)) {
+		if (typeof file !== "string") return { lines: [] };
+		const message = `Did not write --${LOOK_ALIKES_SAMPLES_FILE_FLAG} ${file}: the answer held no look-alikes to write.`;
+		return {
+			lines: [message],
+			exitCode: 1,
+			error: {
+				code: "samples_file_not_written",
+				message
+			}
+		};
+	}
+	const entries = lookAlikeEntries(data);
+	const lines = [];
+	entries.forEach(({ lookAlike }, index) => {
+		const email = lookAlike.email;
+		const from = isRecord$1(email.from) && typeof email.from.address === "string" ? email.from.address : "an unknown sender";
+		const subject = typeof email.subject === "string" && email.subject ? `"${email.subject}"` : "(no subject)";
+		const status = typeof lookAlike.status === "string" ? lookAlike.status : "undecided";
+		const kind = typeof lookAlike.kind === "string" ? lookAlike.kind : "other";
+		const outcome = typeof lookAlike.outcome === "string" ? lookAlike.outcome : "not_decided";
+		lines.push(`${index + 1}. ${status}  ${kind}  ${subject} from ${from}`);
+		if (typeof lookAlike.why === "string" && lookAlike.why.trim()) lines.push(`   Why it should not match: ${lookAlike.why.trim()}`);
+		lines.push(`   ${decidedLine(outcome, status)}`);
+	});
+	const counts = isRecord$1(data.counts) ? data.counts : {};
+	const count = (key) => typeof counts[key] === "number" ? counts[key] : 0;
+	const dropped = count("dropped");
+	lines.push(`Counts: ${count("passed")} passed, ${count("failed")} failed, ${count("undecided")} undecided${dropped > 0 ? `; ${dropped} asked for did not come back` : ""}.`);
+	if (typeof data.note === "string" && data.note.trim()) lines.push(data.note.trim());
+	const numbered = (status) => entries.map(({ lookAlike }, index) => lookAlike.status === status ? index + 1 : 0).filter((n) => n > 0);
+	const matched = numbered("failed");
+	const undecided = numbered("undecided");
+	const chosen = matched.length > 0 ? matched : undecided.length > 0 ? numbered("passed") : [];
+	const pick = chosen.length > 0 ? ` --pick ${chosen.join(",")}` : "";
+	const body = isRecord$1(request.body) ? request.body : {};
+	const ruleId = typeof body.rule_id === "string" ? body.rule_id : null;
+	const requestId = typeof body.request_id === "string" ? body.request_id : null;
+	const target = typeof file === "string" ? shellWord(file) : "<file>";
+	const save = ruleId ? `\`primitive email-rules update-email-rule ${ruleId} --${ADD_SAMPLES_FILE_FLAG} ${target}${pick}\`` : requestId ? `\`primitive email-rules accept-email-rule-request ${requestId} --${SAMPLES_FILE_FLAG} ${target}${pick}\` when the member the request asks accepts it` : `\`primitive email-rules create-email-rule ... --${SAMPLES_FILE_FLAG} ${target}${pick}\` when you save the rule`;
+	const one = (count, single, many) => count === 1 ? single : many;
+	const noneDecided = entries.length > 0 && undecided.length === entries.length ? `None of them was decided (each says why above), so saved as they are they may stay undecided; if the rule reads a spam score, give each email a spam_score${typeof file === "string" ? " in the file" : ""} first.` : "";
+	const which = matched.length > 0 ? `Keep ${one(matched.length, "the one it matched as an email", "the ones it matched as emails")} it must not match` : chosen.length > 0 ? `Keep ${one(chosen.length, "the one it did not match as an email", "the ones it did not match as emails")} it must not match (an undecided one may stay undecided as a sample)` : `Keep ${one(entries.length, "it as an email", "them as emails")} the rule must not match`;
+	const test = matched.length > 0 ? ` Test an edited rule on ${one(matched.length, "it", "them")} with \`primitive email-rules test-email-rule ${ruleId ? `--rule-id ${ruleId}` : "--body-file <body.json>"} --${EXPECT_SAMPLES_FILE_FLAG} ${target}${pick}\`.` : "";
+	if (typeof file === "string") {
+		const samples = entries.map((entry) => entry.sample);
+		if (samples.length === 0) {
+			const message = `Did not write --${LOOK_ALIKES_SAMPLES_FILE_FLAG} ${file}: no look-alikes came back, so it was left as it was.`;
+			return {
+				lines: [...lines, message],
+				exitCode: 1,
+				error: {
+					code: "samples_file_not_written",
+					message
+				}
+			};
+		}
+		try {
+			writeFileSync(file, `${JSON.stringify(samples, null, 2)}\n`);
+		} catch (error) {
+			const message = `Could not write --${LOOK_ALIKES_SAMPLES_FILE_FLAG} ${file}: ${errorDetail(error)}`;
+			return {
+				lines: [
+					...lines,
+					message,
+					"The JSON printed above holds these same look-alikes: save it to a file and give that file instead. Running generate-look-alikes again writes new ones."
+				],
+				exitCode: 1,
+				error: {
+					code: "samples_file_not_written",
+					message
+				}
+			};
+		}
+		const wrote = `Wrote ${one(samples.length, "the look-alike", `the ${samples.length} look-alikes`)} to ${file}, numbered as above.`;
+		lines.push(noneDecided ? `${wrote} ${noneDecided}` : `${wrote} ${which} with ${save}; --pick takes any of the numbers.${test}`);
+	} else if (noneDecided) lines.push(noneDecided);
+	else if (entries.length > 0) lines.push(`${which}: save the JSON printed above to a file and give it to ${save}; --pick takes any of the numbers above.${test}`);
+	return { lines };
+}
 // src/oclif/email-rule-authoring.ts
 const EMAIL_ID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
 /** Whether `id` has the shape of an email id (a UUID). */
@@ -48184,9 +49902,6 @@ function usageError(message) {
 function isRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function errorDetail(error) {
-	return error instanceof Error ? error.message : String(error);
-}
 /** `count` and the word for it: "1 expectation", "2 expectations". */
 function plural$1(count, one, many) {
 	return `${count} ${count === 1 ? one : many}`;
@@ -48227,7 +49942,7 @@ function checkExpectations(value, label) {
 	if (!isRecord(value)) throw usageError(`${label} must hold a JSON object such as {"match": ["<email-id>"], "no_match": ["<email-id>"]}.`);
 	const expectations = {};
 	for (const [key, list] of Object.entries(value)) {
-		if (key !== "match" && key !== "no_match") throw usageError(`${label} takes only "match" and "no_match"; "${key}" is not one of them.`);
+		if (key !== "match" && key !== "no_match") throw usageError(key === "samples" ? `${label} takes emails by id only; give made-up emails with ${label.startsWith("--expectations-file") ? "--expectation-samples-file" : "--expect-samples-file"}.` : `${label} takes only "match" and "no_match"; "${key}" is not one of them.`);
 		if (!Array.isArray(list) || list.some((id) => typeof id !== "string")) throw usageError(`${label}: "${key}" must be a list of email ids.`);
 		const ids = [];
 		const seen = /* @__PURE__ */ new Set();
@@ -48243,33 +49958,19 @@ function checkExpectations(value, label) {
 	assertDisjoint(expectations, label);
 	return expectations;
 }
-/** Read and parse a JSON file a flag names, failing like --body-file does. */
-function readJsonFileFlag(path, flag) {
-	let text;
-	try {
-		text = readFileSync(path, "utf8");
-	} catch (error) {
-		throw new Errors.CLIError(`Could not read ${flag} ${path}: ${errorDetail(error)}`, { exit: 1 });
-	}
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		throw new Errors.CLIError(`${flag} ${path} is not valid JSON: ${errorDetail(error)}`, { exit: 1 });
-	}
-}
-/** `expect` for test-email-rule, from --expect-file or the id flags. */
+/**
+* `expect` for test-email-rule, from --expect-file or the id flags, with the
+* made-up emails --expect-samples-file holds in expect.samples.
+*/
 function expectBodyFields(flags) {
+	const samples = expectSamples(flags);
 	const file = flags["expect-file"];
-	if (typeof file === "string") {
-		const label = `--expect-file ${file}`;
-		return [{
-			flag: "--expect-file",
-			property: "expect",
-			value: checkExpectations(readJsonFileFlag(file, "--expect-file"), label)
-		}];
-	}
 	const expect = {};
 	const given = [];
+	if (typeof file === "string") {
+		Object.assign(expect, checkExpectations(readJsonFileFlag(file, "--expect-file"), `--expect-file ${file}`));
+		given.push("--expect-file");
+	}
 	const match = flags["expect-match"];
 	if (Array.isArray(match)) {
 		expect.match = parseEmailIdList(match, "--expect-match");
@@ -48280,8 +49981,12 @@ function expectBodyFields(flags) {
 		expect.no_match = parseEmailIdList(noMatch, "--expect-no-match");
 		given.push("--expect-no-match");
 	}
-	if (given.length === 0) return [];
 	assertDisjoint(expect, given.join(" and "));
+	if (samples) {
+		expect.samples = samples;
+		given.push(`--${EXPECT_SAMPLES_FILE_FLAG}`);
+	}
+	if (given.length === 0) return [];
 	return [{
 		flag: given.join(", "),
 		property: "expect",
@@ -48418,18 +50123,72 @@ function expectationLine(result, results) {
 	const note = result.status === "undecided" ? undecidedNote(undecidedReason(result, results)) : void 0;
 	return `  ${result.status}: ${result.email_id} expected ${result.expected}, got ${result.outcome}${note ? ` (${note})` : ""}`;
 }
-function expectationsLines(expectations, testResults) {
+/** The made-up emails a test's expectations judged, in order. */
+function sampleJudgments(expectations) {
+	return (isRecord(expectations) && Array.isArray(expectations.samples) ? expectations.samples : []).filter(isRecord).map((item, position) => ({
+		index: typeof item.index === "number" ? item.index : position,
+		label: typeof item.label === "string" ? item.label : null,
+		expected: String(item.expected ?? ""),
+		outcome: String(item.outcome ?? "not_decided"),
+		status: String(item.status ?? "undecided"),
+		question_answers: Array.isArray(item.question_answers) ? item.question_answers.filter(isRecord) : []
+	}));
+}
+function sampleNamer(request) {
+	const sent = isRecord(request?.body) && isRecord(request.body.expect) && Array.isArray(request.body.expect.samples);
+	const fromFile = sent && typeof request?.flags?.["expect-samples-file"] === "string";
+	return ({ index, label }) => {
+		const n = fromFile ? sentSampleNumber(index, request?.flags) : index + 1;
+		const name = sent ? `sample ${n}` : `saved sample ${n}`;
+		return label ? `${name} ("${label}")` : name;
+	};
+}
+/**
+* Why a made-up email is undecided, and whether a later test can decide it:
+* yes when it was not reached or a question went unanswered; maybe not
+* otherwise, since a spam score it does not carry, a fact its
+* classification left out or a failed classification look the same. A
+* spam score left unset makes one undecided even with a question
+* unanswered, which then reads as decidable later: the answer cannot tell.
+*/
+function sampleUndecidedReason(sample) {
+	if (sample.outcome === "not_decided") return {
+		why: "it was not reached in time, or deciding it failed",
+		resolvable: true
+	};
+	const answers = sample.question_answers;
+	if (answers.some((answer) => answer.answer === null) && !answers.some((answer) => answer.answer === false)) return {
+		why: "a question went unanswered",
+		resolvable: true
+	};
+	return {
+		why: "it reads a spam score the sample does not carry, a fact its classification left out, or its classification failed",
+		resolvable: false,
+		may: true
+	};
+}
+function sampleLines(sample, name) {
+	const note = sample.status === "undecided" ? ` (${undecidedNote(sampleUndecidedReason(sample))})` : "";
+	const lines = [`  ${sample.status}: ${name(sample)} expected ${sample.expected}, got ${sample.outcome}${note}`];
+	if (sample.question_answers.length > 0) lines.push(`    questions: ${sample.question_answers.map(answerText).join("; ")}`);
+	return lines;
+}
+function expectationsLines(expectations, testResults, name = sampleNamer()) {
 	if (!expectations) return [];
 	const results = Array.isArray(expectations.results) ? expectations.results : [];
 	const passed = expectations.counts?.passed ?? 0;
 	const failed = expectations.counts?.failed ?? 0;
 	const undecided = expectations.counts?.undecided ?? 0;
 	if (expectations.passed && failed === 0 && undecided === 0) return [`Expectations: all ${passed} passed.`];
-	return [`Expectations: ${[
-		failed > 0 ? `${failed} failed` : "",
-		undecided > 0 ? `${undecided} undecided` : "",
-		`${passed} passed`
-	].filter((part) => part !== "").join(", ")}.`, ...results.filter((result) => result.status !== "passed").map((result) => expectationLine(result, testResults))];
+	return [
+		`Expectations: ${[
+			failed > 0 ? `${failed} failed` : "",
+			undecided > 0 ? `${undecided} undecided` : "",
+			`${passed} passed`
+		].filter((part) => part !== "").join(", ")}.`,
+		...results.filter((result) => result.status !== "passed").map((result) => expectationLine(result, testResults)),
+		...sampleJudgments(expectations).filter((sample) => sample.status !== "passed").flatMap((sample) => sampleLines(sample, name))
+	];
 }
 const NOT_MATCHED_ORDER = {
 	near_miss: 1,
@@ -48491,14 +50250,24 @@ function notMatchedLines(results, expectations) {
 *   test can decide it;
 * - else nothing: the exit code stays 0.
 */
-function expectationsOutcome(expectations, testResults = []) {
+function expectationsOutcome(expectations, testResults = [], name = sampleNamer()) {
 	if (!expectations) return {};
 	const results = Array.isArray(expectations.results) ? expectations.results : [];
-	const failed = results.filter((result) => result.status === "failed").map((result) => result.email_id);
-	const undecided = results.filter((result) => result.status === "undecided").map((result) => ({
+	const samples = sampleJudgments(expectations);
+	const failed = [...results.filter((result) => result.status === "failed").map((result) => result.email_id), ...samples.filter((sample) => sample.status === "failed").map((sample) => name({
+		index: sample.index,
+		label: null
+	}))];
+	const undecided = [...results.filter((result) => result.status === "undecided").map((result) => ({
 		id: result.email_id,
 		reason: undecidedReason(result, testResults)
-	}));
+	})), ...samples.filter((sample) => sample.status === "undecided").map((sample) => ({
+		id: name({
+			index: sample.index,
+			label: null
+		}),
+		reason: sampleUndecidedReason(sample)
+	}))];
 	const unresolvable = undecided.filter(({ reason }) => !reason.resolvable);
 	const failedCount = Math.max(expectations.counts?.failed ?? 0, failed.length);
 	const undecidedCount = Math.max(expectations.counts?.undecided ?? 0, undecided.length);
@@ -48514,7 +50283,7 @@ function expectationsOutcome(expectations, testResults = []) {
 		exitCode: 1,
 		error: {
 			code: "expectations_unresolvable",
-			message: `${plural$1(unresolvable.length, "expectation is", "expectations are")} undecided, and testing again will not decide ${unresolvable.length === 1 ? "it" : "them"}: ${why(unresolvable)}.`
+			message: `${plural$1(unresolvable.length, "expectation is", "expectations are")} undecided, and testing again ${unresolvable.every(({ reason }) => reason.may) ? "may not decide" : "will not decide"} ${unresolvable.length === 1 ? "it" : "them"}: ${why(unresolvable)}.`
 		}
 	};
 	if (undecidedCount > 0) return {
@@ -48527,8 +50296,9 @@ function expectationsOutcome(expectations, testResults = []) {
 	return {};
 }
 /** The stderr report and exit code of a test-email-rule answer. */
-function testEmailRuleReport(data) {
+function testEmailRuleReport(data, request) {
 	if (!isRecord(data)) return { lines: [] };
+	const name = sampleNamer(request);
 	const result = data;
 	const results = Array.isArray(result.results) ? result.results : [];
 	const summary = isRecord(result.summary) ? result.summary : void 0;
@@ -48538,23 +50308,56 @@ function testEmailRuleReport(data) {
 			...scopeWarningLines(result.scope_warnings),
 			...conditionLines(summary),
 			...questionLines(summary, results),
-			...expectationsLines(result.expectations, results),
+			...expectationsLines(result.expectations, results, name),
 			...notMatchedLines(results, result.expectations)
 		],
-		...expectationsOutcome(result.expectations, results)
+		...expectationsOutcome(result.expectations, results, name)
 	};
 }
-function expectationsCheckLine(check, ruleId) {
+/** A list of numbers from 0, as the API gives sample indexes. */
+function indexList(value) {
+	return Array.isArray(value) ? value.filter((n) => typeof n === "number") : [];
+}
+/**
+* How a rule write names a made-up email its check gives by index, from 0 in
+* the set judged: those this write sends in place of the rule's
+* (expectation_samples), or the rule's saved ones oldest first and then
+* those it adds (add_expectation_samples). One this write sent is "sample
+* N", its number in the samples file --pick took it from (or its place in
+* what was sent); any other is "saved sample N", its place among the rule's.
+* With its label when known. `saved` is the answer's expectation_samples,
+* every one the rule keeps after the write, when it has them.
+*/
+function writtenSampleNamer(body, flags, saved) {
+	const sent = isRecord(body) && Array.isArray(body.expectation_samples) ? body.expectation_samples : null;
+	const added = isRecord(body) && Array.isArray(body.add_expectation_samples) ? body.add_expectation_samples : null;
+	const kept = Array.isArray(saved) ? saved : null;
+	const labelled = (name, sample) => isRecord(sample) && typeof sample.label === "string" && sample.label ? `${name} ("${sample.label}")` : name;
+	return (index) => {
+		if (sent) return labelled(`sample ${sentSampleNumber(index, flags)}`, sent[index]);
+		if (added) {
+			const start = kept ? kept.length - added.length : null;
+			if (start === null) return `made-up email ${index + 1}`;
+			if (index >= start) return labelled(`sample ${sentSampleNumber(index - start, flags)}`, added[index - start]);
+		}
+		return labelled(`saved sample ${index + 1}`, kept?.[index]);
+	};
+}
+function expectationsCheckLine(check, ruleId, name = (index) => `saved sample ${index + 1}`) {
 	if (!isRecord(check)) return void 0;
 	const on = typeof check.version === "number" ? `version ${check.version}` : "the current version";
 	const failed = Array.isArray(check.failed) ? check.failed : [];
 	const undecided = Array.isArray(check.undecided) ? check.undecided : [];
-	if (check.passed && failed.length === 0 && undecided.length === 0) return `Expectations on ${on}: all passed.`;
+	const failedSamples = indexList(check.failed_samples);
+	const undecidedSamples = indexList(check.undecided_samples);
+	if (check.passed && failed.length === 0 && undecided.length === 0 && failedSamples.length === 0 && undecidedSamples.length === 0) return `Expectations on ${on}: all passed.`;
 	const parts = [];
 	if (failed.length > 0) parts.push(`${failed.length} failed (${failed.join(", ")})`);
-	else if (undecided.length > 0) parts.push("none failed");
+	if (failedSamples.length > 0) parts.push(`${plural$1(failedSamples.length, "made-up email", "made-up emails")} failed (${failedSamples.map(name).join(", ")})`);
+	if (failed.length === 0 && failedSamples.length === 0 && (undecided.length > 0 || undecidedSamples.length > 0)) parts.push("none failed");
 	if (undecided.length > 0) parts.push(`${undecided.length} undecided (${undecided.join(", ")})`);
-	const rest = undecided.length > 0 ? ` To decide the rest, run \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.` : "";
+	if (undecidedSamples.length > 0) parts.push(`${plural$1(undecidedSamples.length, "made-up email", "made-up emails")} not judged by this write (${undecidedSamples.map(name).join(", ")})`);
+	const rest = undecided.length > 0 || undecidedSamples.length > 0 ? ` To decide the rest, run \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.` : "";
 	const note = typeof check.note === "string" && check.note.trim() ? ` ${check.note.trim()}` : "";
 	return `Expectations on ${on}: ${parts.length > 0 ? parts.join(", ") : "not passed"}.${rest}${note}`;
 }
@@ -48568,7 +50371,7 @@ const FAIL_ON_EXPECTATIONS_FLAG = "fail-on-expectations";
 * `passed` as false or as null when nothing failed and something is
 * undecided; any other check that did not pass exits 1.
 */
-function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "") {
+function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "", name = (index) => `saved sample ${index + 1}`) {
 	const test = `\`primitive email-rules test-email-rule --rule-id ${ruleId}\``;
 	if (!isRecord(check)) {
 		if (!sentExpectations) return {};
@@ -48580,8 +50383,9 @@ function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "")
 			}
 		};
 	}
-	const failed = Array.isArray(check.failed) ? check.failed : [];
-	const undecided = Array.isArray(check.undecided) ? check.undecided : [];
+	const failed = [...Array.isArray(check.failed) ? check.failed : [], ...indexList(check.failed_samples).map(name)];
+	const undecidedSamples = indexList(check.undecided_samples);
+	const undecided = [...Array.isArray(check.undecided) ? check.undecided : [], ...undecidedSamples.map(name)];
 	if (failed.length > 0) return {
 		exitCode: 1,
 		error: {
@@ -48593,7 +50397,7 @@ function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "")
 		exitCode: 3,
 		error: {
 			code: "expectations_undecided",
-			message: `${saved}${plural$1(undecided.length, "expectation is", "expectations are")} undecided on this write, which judges them without classifying mail or asking the rule's questions: ${undecided.join(", ")}. Test them with ${test}.`
+			message: `${saved}${plural$1(undecided.length, "expectation is", "expectations are")} undecided on this write, which judges them without classifying mail or asking the rule's questions${undecidedSamples.length > 0 ? ", and leaves made-up emails unjudged" : ""}: ${undecided.join(", ")}. Test them with ${test}.`
 		}
 	};
 	if (check.passed !== true) return {
@@ -48611,6 +50415,14 @@ function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "")
 * rule active, and refuses with these same codes, saving nothing.
 */
 const SAVED_UNJUDGED = "The write was saved: the server judges a write before saving only when it saves a version or turns the rule active, so not this one. ";
+/** What a written do_not_share rule's report says first. */
+const BLOCKS_SHARING = "This rule blocks sharing (kind do_not_share): while it is active, no rule shares an email it matches.";
+/** A do_not_share rule's protection_note, as a line, or undefined. */
+function protectionLine(rule) {
+	if (!isRecord(rule)) return void 0;
+	const note = rule.protection_note;
+	return typeof note === "string" && note.trim() ? `Protection: ${note.trim()}` : void 0;
+}
 /** What a restore_version write saved, as its answer says. */
 function restoredLine(restored, currentVersion) {
 	if (!isRecord(restored) || typeof restored.version !== "number") return void 0;
@@ -48647,21 +50459,31 @@ function writtenEmailRuleReport(data, request) {
 	const rule = data;
 	const ruleId = typeof rule.id === "string" ? rule.id : "<rule-id>";
 	const lines = scopeWarningLines(rule.scope_warnings);
-	if (rule.kind === "do_not_share") lines.unshift(`This rule blocks sharing (kind do_not_share): while it is active, no rule shares an email it matches.${typeof rule.state === "string" && rule.state !== "active" ? " It blocks nothing until it is active." : ""}`);
+	if (rule.kind === "do_not_share") {
+		const note = protectionLine(rule);
+		lines.unshift(...note ? [BLOCKS_SHARING, note] : [`${BLOCKS_SHARING}${typeof rule.state === "string" && rule.state !== "active" ? " It blocks nothing until it is active." : ""}`]);
+	}
 	const restored = restoredLine(rule.restored_from, rule.current_version);
 	if (restored) lines.push(restored);
 	const reach = affectsLine(rule.affects);
 	if (reach) lines.push(reach);
-	const sentExpectations = isRecord(request.body) && isRecord(request.body.expectations);
-	const checked = expectationsCheckLine(rule.expectations_check, ruleId);
+	const sentExpectations = sentExpectationsIn(request.body);
+	const name = writtenSampleNamer(request.body, request.flags, rule.expectation_samples);
+	const checked = expectationsCheckLine(rule.expectations_check, ruleId, name);
 	if (checked) lines.push(checked);
 	else if (sentExpectations) lines.push(`Expectations were not checked on this write. Test them with \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.`);
 	if (request.flags?.["fail-on-expectations"] !== true) return { lines };
 	return {
 		lines,
-		...writtenExpectationsOutcome(rule.expectations_check, sentExpectations, ruleId, isUpdate(request) ? SAVED_UNJUDGED : "")
+		...writtenExpectationsOutcome(rule.expectations_check, sentExpectations, ruleId, isUpdate(request) ? SAVED_UNJUDGED : "", name)
 	};
 }
+/** Whether a rule write sent expectations: emails by id, or made-up emails to save or add. */
+function sentExpectationsIn(body) {
+	if (!isRecord(body)) return false;
+	const some = (value) => Array.isArray(value) && value.length > 0;
+	return isRecord(body.expectations) || some(body.expectation_samples) || some(body.add_expectation_samples);
+}
 /** Whether a rule write is an update: it names the rule in its path. */
 function isUpdate(request) {
 	return typeof request.path?.id === "string";
@@ -48673,7 +50495,7 @@ function isUpdate(request) {
 */
 function writtenFallbackExitCode(data, request) {
 	if (request.flags["fail-on-expectations"] !== true) return void 0;
-	return writtenExpectationsOutcome(isRecord(data) ? data.expectations_check : void 0, isRecord(request.body) && isRecord(request.body.expectations), "<rule-id>").exitCode;
+	return writtenExpectationsOutcome(isRecord(data) ? data.expectations_check : void 0, sentExpectationsIn(request.body), "<rule-id>").exitCode;
 }
 /** The stderr report of get-email-rule-scope. */
 function emailRuleScopeReport(data) {
@@ -48743,7 +50565,7 @@ function readAgain(id) {
 * expectations_undecided and no_expectations. Nothing was saved in any of
 * them.
 */
-function updateEmailRuleErrorHint(code, payload, ruleId, body) {
+function updateEmailRuleErrorHint(code, payload, ruleId, body, flags) {
 	const id = typeof ruleId === "string" && ruleId ? ruleId : "<rule-id>";
 	const details = errorDetails(payload);
 	const guarded = isRecord(body) && body.if_expectations_pass === true;
@@ -48761,10 +50583,43 @@ function updateEmailRuleErrorHint(code, payload, ruleId, body) {
 		const check = isRecord(details.expectations_check) ? details.expectations_check : {};
 		const failed = Array.isArray(check.failed) ? check.failed : [];
 		const undecided = Array.isArray(check.undecided) ? check.undecided : [];
-		const parts = [...failed.length > 0 ? [`failed: ${failed.join(", ")}`] : [], ...undecided.length > 0 ? [`undecided: ${undecided.join(", ")}`] : []];
-		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved.${parts.length > 0 ? ` Expectations ${parts.join("; ")}.` : ""}${code === "expectations_failed" ? "" : ` ${UNDECIDED_NEXT_STEP[String(details.reason)] ?? UNDECIDED_NEXT_STEP.none}`} The command exits ${updateEmailRuleErrorExitCode(payload) ?? 1}.`;
+		const name = writtenSampleNamer(body, flags);
+		const failedAll = [...failed, ...indexList(check.failed_samples).map(name)];
+		const undecidedSamples = indexList(check.undecided_samples);
+		const undecidedAll = [...undecided, ...undecidedSamples.map(name)];
+		const parts = [...failedAll.length > 0 ? [`failed: ${failedAll.join(", ")}`] : [], ...undecidedAll.length > 0 ? [`undecided: ${undecidedAll.join(", ")}`] : []];
+		const addedOrder = isRecord(body) && Array.isArray(body.add_expectation_samples) && indexList(check.failed_samples).length + undecidedSamples.length > 0 ? " Made-up emails are numbered from 1: the rule's saved ones first, then those this write adds." : "";
+		const which = parts.length > 0 ? ` Expectations ${parts.join("; ")}.${addedOrder}` : "";
+		const reason = String(details.reason);
+		const samplesMayStay = undecidedSamplesMayStay(undecidedSamples.length, reason);
+		const byReason = reason !== "none" && Object.hasOwn(UNDECIDED_NEXT_STEP, reason) ? UNDECIDED_NEXT_STEP[reason] : UNDECIDED_NEXT_STEP.none;
+		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved.${which}${code === "expectations_failed" ? "" : samplesMayStay ? `${undecided.length > 0 ? ` ${byReason}` : ""} ${UNDECIDED_SAMPLES_NEXT_STEP} ${refusedSampleTest(body, id)}` : ` ${byReason}`} The command exits ${updateEmailRuleErrorExitCode(payload) ?? 1}.`;
 	}
-	if (code === "no_expectations") return "Hint: nothing was saved. Give the rule expectations with --expectations-file (in this write or before it), or send the write without if_expectations_pass (--fail-on-expectations or --if-expectations-pass).";
+	if (code === "no_expectations") return "Hint: nothing was saved. Give the rule expectations with --expectations-file or made-up emails with --expectation-samples-file or --add-expectation-samples-file (in this write or before it), or send the write without if_expectations_pass (--fail-on-expectations or --if-expectations-pass).";
+}
+/** The reasons a guard's undecided judgment can be decided by sending the write again. */
+const RETRYABLE_REASONS = /* @__PURE__ */ new Set([
+	"deadline",
+	"error",
+	"client_gone"
+]);
+/**
+* A made-up email can stay undecided: one that reads a spam score it does
+* not carry, or whose classification failed or left out a fact the rule
+* needs, decides the same way every time.
+*/
+const UNDECIDED_SAMPLES_NEXT_STEP = "A made-up email undecided for no reason given may stay so (a spam score it does not carry, a fact its classification left out, or a failed classification), so sending the write again may not decide it.";
+/**
+* How to see why a refused write's made-up emails are undecided: only
+* test-email-rule-on-sample answers with what a made-up email lacked. Test
+* the tree this write sent (or the version it restores), else the rule, on
+* each. Nothing was saved, so a test by rule id would see neither.
+*/
+function refusedSampleTest(body, ruleId) {
+	const onSample = "`primitive email-rules test-email-rule-on-sample`";
+	if (isRecord(body) && isRecord(body.tree)) return `To see why, test the tree this write sent on each with ${onSample}.`;
+	if (isRecord(body) && typeof body.restore_version === "number") return `To see why, test version ${body.restore_version}'s tree (\`primitive email-rules list-email-rule-versions ${ruleId} --versions ${body.restore_version}\`) on each with ${onSample}.`;
+	return `To see why, test rule ${ruleId} on each with ${onSample}${isRecord(body) && Array.isArray(body.expectation_samples) ? "" : ` (\`primitive email-rules get-email-rule ${ruleId}\` lists its saved ones)`}.`;
 }
 /** What to do about an undecided judgment, by details.reason ("none": no reason given). */
 const UNDECIDED_NEXT_STEP = {
@@ -48776,21 +50631,33 @@ const UNDECIDED_NEXT_STEP = {
 };
 /**
 * update-email-rule's exit code for the expectations guard's refusals: 1 when
-* one failed, or when they cannot be decided by trying again (the rule cannot
-* run as its author); 3 when trying again later can decide them.
+* one failed, or when they may not be decided by trying again (the rule
+* cannot run as its author, or a made-up email is undecided for no reason
+* the answer gives); 3 when trying again later can decide them.
 */
 function updateEmailRuleErrorExitCode(payload) {
 	const code = isRecord(payload) ? payload.code : void 0;
 	if (code === "expectations_failed") return 1;
 	if (code !== "expectations_undecided") return void 0;
-	return errorDetails(payload).reason === "author_unresolvable" ? 1 : 3;
+	const details = errorDetails(payload);
+	if (details.reason === "author_unresolvable") return 1;
+	return undecidedSamplesMayStay(indexList((isRecord(details.expectations_check) ? details.expectations_check : {}).undecided_samples).length, String(details.reason)) ? 1 : 3;
+}
+/**
+* Whether a guard's undecided made-up emails may stay undecided: some are,
+* and the answer gives no reason that sending the write again can change
+* (author_unresolvable has its own advice and exit code).
+*/
+function undecidedSamplesMayStay(count, reason) {
+	return count > 0 && !RETRYABLE_REASONS.has(reason) && reason !== "author_unresolvable";
 }
 /** The stderr report of compile-email-rule: how many recent emails it holds for. */
 function compileEmailRuleReport(data) {
 	if (!isRecord(data)) return { lines: [] };
+	const lines = (Array.isArray(data.warnings) ? data.warnings : []).filter((warning) => typeof warning === "string" && warning.trim() !== "").map((warning) => `Warning: ${warning.trim()}`);
 	const breadth = data.breadth;
-	if (!isRecord(breadth) || typeof breadth.checked !== "number" || typeof breadth.matched !== "number") return { lines: [] };
-	return { lines: [`Breadth: its conditions hold for ${breadth.matched} of ${plural$1(breadth.checked, "recent email", "recent emails")} checked in your own mailboxes, whatever scope you save it with.`] };
+	if (isRecord(breadth) && typeof breadth.checked === "number" && typeof breadth.matched === "number") lines.push(`Breadth: its conditions hold for ${breadth.matched} of ${plural$1(breadth.checked, "recent email", "recent emails")} checked in your own mailboxes, whatever scope you save it with.`);
+	return { lines };
 }
 /** The stderr report of get-email-rule: who wrote it, and its revision. */
 function getEmailRuleReport(data) {
@@ -48798,13 +50665,31 @@ function getEmailRuleReport(data) {
 	const lines = [];
 	const author = authorLine(data.author);
 	if (author) lines.push(author);
+	const protection = protectionLine(data);
+	if (protection) lines.push(protection);
 	if (typeof data.revision === "number") lines.push(`Revision ${data.revision}: pass --if-revision ${data.revision} to update-email-rule so a change made since is never replaced unseen.`);
 	return { lines };
 }
+/** The stderr report of list-email-rules: the protective rules that protect nothing yet, or less than they seem. */
+function listEmailRulesReport(data) {
+	const rules = Array.isArray(data) ? data : [];
+	const lines = [];
+	for (const rule of rules) {
+		if (!isRecord(rule)) continue;
+		const note = typeof rule.protection_note === "string" ? rule.protection_note.trim() : "";
+		if (!note) continue;
+		const id = typeof rule.id === "string" ? rule.id : "<rule-id>";
+		const name = typeof rule.name === "string" ? rule.name : "no name";
+		lines.push(`Protection of ${id} (${name}): ${note}`);
+	}
+	return { lines };
+}
 /** create-email-rule's --fail-on-expectations: the exit code follows the check made after saving. */
-const FAIL_ON_EXPECTATIONS_HELP = "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). Without it the command exits 0 whatever the check says.";
+const FAIL_ON_EXPECTATIONS_HELP = "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). A create does not judge made-up emails, so with some it exits 3. Without it the command exits 0 whatever the check says.";
 /** update-email-rule's --fail-on-expectations: the server refuses the write. */
-const UPDATE_FAIL_ON_EXPECTATIONS_HELP = "Refuse the write unless the rule, as this write would leave it, passes its expectations. It sends if_expectations_pass (over any in --body-file or --raw-body), so the server judges a new version, a restored one, a new scope or turning the rule active before saving, and saves nothing when one failed (exit 1), one is undecided (exit 3, or 1 when the rule cannot run as its author) or the rule has none (exit 1). It can take as long as a test of the rule; the command waits for it. Judging needs a credential that reads the mail's content. A write the server does not judge (one changing only expectations, say) is saved, and the exit code then follows the answer's expectations_check, as on create. With --json, a refused write's document holds the API's error alone; a saved write's holds the rule.";
+const UPDATE_FAIL_ON_EXPECTATIONS_HELP = "Refuse the write unless the rule, as this write would leave it, passes its expectations. It sends if_expectations_pass (over any in --body-file or --raw-body), so the server judges a new version, a restored one, a new scope or turning the rule active before saving, on its emails by id and its made-up emails, and saves nothing when one failed (exit 1), one is undecided (exit 3, or 1 when the rule cannot run as its author or a made-up email is undecided for no reason the answer gives) or the rule has none (exit 1). It can take as long as a test of the rule; the command waits for it. Judging needs a credential that reads the mail's content. A write the server does not judge (one changing only expectations, say) is saved, and the exit code then follows the answer's expectations_check, as on create. With --json, a refused write's document holds the API's error alone; a saved write's holds the rule.";
+/** What a samples file flag reads. */
+const SAMPLES_FILE_SHAPE = "A JSON file of made-up emails the rule must match or not: an array such as [{\"expected\": \"no_match\", \"label\": \"a personal bill\", \"email\": {...}}], with email as test-email-rule-on-sample takes it (text up to 4,000 characters, at most 10 each of to, cc and attachment_types), like the one generate-look-alikes --samples-file writes, or a generate-look-alikes answer saved as it printed it.";
 const EXPECTATION_FLAG_NOTE = "Replaces any expect in --body-file or --raw-body. The answer reports them in expectations (passed, counts, results) and the exit code follows it; see --help-full.";
 /**
 * update-email-rule's --fail-on-expectations sends if_expectations_pass, over
@@ -48833,9 +50718,11 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 				exclusive: ["expect-file"]
 			}),
 			"expect-file": Flags.string({
-				description: "A JSON file holding the request's expect, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}. Not with --expect-match or --expect-no-match.",
+				description: "A JSON file holding the emails the request's expect names by id, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}; made-up emails go in --expect-samples-file. Not with --expect-match or --expect-no-match.",
 				exclusive: ["expect-match", "expect-no-match"]
-			})
+			}),
+			[EXPECT_SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expect.samples (at most 20), beside any emails by id; the answer judges each in expectations.samples (index from 0 over those sent), and the report names each by its number in the file. Like any expect, it replaces a saved rule's own expectations and samples for this test. ${EXPECTATION_FLAG_NOTE}` }),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([EXPECT_SAMPLES_FILE_FLAG]) })
 		},
 		bodyFields: expectBodyFields,
 		bodyProperties: ["expect"],
@@ -48848,24 +50735,55 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	createEmailRule: {
 		flags: {
 			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check (passed, decided, failed, undecided); the report test-email-rule answers with is named expectations instead." }),
+			[SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expectation_samples (at most 20), over any in --body-file or --raw-body. A create does not judge them; test-email-rule --rule-id does.` }),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG]) }),
 			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: FAIL_ON_EXPECTATIONS_HELP })
 		},
-		bodyFields: expectationsBodyFields(false),
-		bodyProperties: ["expectations"],
+		bodyFields: (flags) => [...expectationsBodyFields(false)(flags), ...samplesBodyFields(false)(flags)],
+		bodyProperties: ["expectations", "expectation_samples"],
 		fallbackExitCode: writtenFallbackExitCode,
 		report: writtenEmailRuleReport
 	},
 	updateEmailRule: {
 		flags: {
 			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}, replacing its saved expectations; a file holding null removes them. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check (passed, decided, failed, undecided); the report test-email-rule answers with is named expectations instead." }),
+			[SAMPLES_FILE_FLAG]: Flags.string({
+				description: `${SAMPLES_FILE_SHAPE} They replace the rule's saved ones, and a file holding [] removes them. Sets expectation_samples, over any in --body-file or --raw-body. Not with --${ADD_SAMPLES_FILE_FLAG}. The write judges them only with --${FAIL_ON_EXPECTATIONS_FLAG}, and only when it saves a version or turns the rule active.`,
+				exclusive: [ADD_SAMPLES_FILE_FLAG]
+			}),
+			[ADD_SAMPLES_FILE_FLAG]: Flags.string({
+				description: `${SAMPLES_FILE_SHAPE} They are added to the rule's saved ones, 20 at most in all. Sets add_expectation_samples, over any in --body-file or --raw-body. Not with --${SAMPLES_FILE_FLAG}. The write judges them only with --${FAIL_ON_EXPECTATIONS_FLAG}, and only when it saves a version or turns the rule active.`,
+				exclusive: [SAMPLES_FILE_FLAG]
+			}),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG, ADD_SAMPLES_FILE_FLAG]) }),
 			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: UPDATE_FAIL_ON_EXPECTATIONS_HELP })
 		},
-		bodyFields: (flags) => [...expectationsBodyFields(true)(flags), ...expectationsGuardBodyFields(flags)],
-		bodyProperties: ["expectations"],
+		bodyFields: (flags) => [
+			...expectationsBodyFields(true)(flags),
+			...samplesBodyFields(true)(flags),
+			...expectationsGuardBodyFields(flags)
+		],
+		bodyProperties: [
+			"expectations",
+			"expectation_samples",
+			"add_expectation_samples"
+		],
 		errorExitCode: updateEmailRuleErrorExitCode,
 		fallbackExitCode: writtenFallbackExitCode,
 		report: writtenEmailRuleReport
 	},
+	generateLookAlikes: {
+		flags: { [LOOK_ALIKES_SAMPLES_FILE_FLAG]: Flags.string({ description: `Also write the look-alikes to this JSON file as made-up emails the rule must not match, a JSON array numbered from 1 in the order the report prints them. Save the ones you choose with create-email-rule --${SAMPLES_FILE_FLAG}, update-email-rule --${ADD_SAMPLES_FILE_FLAG} or, for a request, accept-email-rule-request --${SAMPLES_FILE_FLAG}, with --pick; test an edited rule on them with test-email-rule --${EXPECT_SAMPLES_FILE_FLAG}. Replaces the file if it exists, once the call succeeds; when no look-alikes came back it leaves the file as it was and exits 1.` }) },
+		report: lookAlikesReport
+	},
+	acceptEmailRuleRequest: {
+		flags: {
+			[SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expectation_samples (at most 20), over any in --body-file or --raw-body: they are kept on the rule this accept writes, such as the look-alikes of the request it must never match.` }),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG]) })
+		},
+		bodyFields: samplesBodyFields(false),
+		bodyProperties: ["expectation_samples"]
+	},
 	compileEmailRule: {
 		flags: {},
 		report: compileEmailRuleReport
@@ -48874,6 +50792,10 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 		flags: {},
 		report: getEmailRuleReport
 	},
+	listEmailRules: {
+		flags: {},
+		report: listEmailRulesReport
+	},
 	getEmailRuleScope: {
 		flags: {},
 		report: emailRuleScopeReport
@@ -51004,7 +52926,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-YQWxPePp.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-DNnNhhFr.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)
@@ -52111,7 +54033,7 @@ const OPERATION_ERROR_HINTS = {
 	inviteOrganizationMember: (code, body, payload) => inviteRefusalHint(code, body, payload),
 	createEndpoint: (code, body, payload) => createEndpointRuleRequestHint(code, body, payload),
 	updateEndpoint: (code, body, payload) => updateEndpointRuleRequestHint(code, body, payload),
-	updateEmailRule: (code, body, payload, path) => updateEmailRuleErrorHint(code, payload, path?.id, body),
+	updateEmailRule: (code, body, payload, path, flags) => updateEmailRuleErrorHint(code, payload, path?.id, body, flags),
 	verifyDomain: (code, _body, payload) => code === "dns_verification_failed" ? domainVerificationFailedHint(payload) : void 0,
 	addDomain: (code, body) => {
 		if (code === "mail_relay_unavailable") return MAIL_RELAY_UNAVAILABLE_MESSAGE;
@@ -52314,7 +54236,7 @@ function createOperationCommand(operation) {
 				}) : await callOperation();
 				if (result.error) {
 					const errorPayload = extractErrorPayload(result.error);
-					const operationErrorHint = OPERATION_ERROR_HINTS[operation.sdkName]?.(extractErrorCode(errorPayload), body, errorPayload, collectValues(operation.pathParams, parsedFlags, operation.sdkName));
+					const operationErrorHint = OPERATION_ERROR_HINTS[operation.sdkName]?.(extractErrorCode(errorPayload), body, errorPayload, collectValues(operation.pathParams, parsedFlags, operation.sdkName), parsedFlags);
 					writeErrorWithHints(errorPayload, result.response, { codeHint: !(operationErrorHint && OPERATION_ERROR_HINTS_REPLACING_CODE_HINT.has(operation.sdkName)) });
 					if (operationErrorHint) process.stderr.write(`${operationErrorHint}\n`);
 					if (stepUpUrl) process.stderr.write(approveThenRerunHint(stepUpUrl));