primcli 3.0.0-preview.7 → 3.0.0-preview.9

package/dist/{api-command-BXYpylbG.js → api-command-DugUWmZH.js}

@@ -1,4 +1,4 @@
-import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-C6tOKAqk.js";
+import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-DqcHvqvW.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
 import { a as thrownErrorBody } from "./json-output-ch756TXV.js";
@@ -602,7 +602,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-account",
-		"description": "Update the mutable account settings (such as display name and notification preferences) for the authenticated organization.",
+		"description": "Update the organization's spam threshold (spam_threshold) and whether an email's content is discarded once a webhook confirms receipt (discard_content_on_webhook_confirmed), the opt-in POST /emails/{id}/discard-content needs.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateAccount",
@@ -7128,12 +7128,12 @@ const operationManifest = [
 												},
 												"hold": {
 													"type": "object",
-													"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+													"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 													"required": ["reason", "since"],
 													"properties": {
 														"reason": {
 															"type": "string",
-															"description": "Open: credential_reuse_hold."
+															"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 														},
 														"since": {
 															"type": ["string", "null"],
@@ -10557,7 +10557,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "revoke-credential",
-		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true and revoked 0, to a caller who could have revoked it; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
+		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked by the person who holds it, whatever it reaches, or by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. Revoking an API key also revokes the keys it replaced in its rotation that are still in their overlap and that you may revoke (predecessors_revoked_count; predecessors_left counts the rest), so its webhooks stop at once; the keys that replaced it carry its work on. Revoking a key already revoked does the same for those keys. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from, each saying whether anything still acts for it (still_acting, with the key in acting_key_id) and, for a webhook, whether it is still delivering. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true, to a caller who could have revoked it, and revoked counts only the keys it replaced that were revoked now; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "revokeCredential",
@@ -10670,7 +10670,7 @@ const operationManifest = [
 					}
 				},
 				"already_revoked": {
-					"description": "true when the API key was already revoked, so nothing changed and revoked is 0. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
+					"description": "true when the API key was already revoked. revoked then counts only the keys it replaced that were revoked now. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
 					"type": "boolean"
 				},
 				"keep_failed": {
@@ -10698,11 +10698,23 @@ const operationManifest = [
 							"id": { "type": "string" },
 							"label": {
 								"type": "string",
-								"description": "A webhook's URL, a pull subscription's name (or pull when it has none), a route's or filter's pattern, or a wake schedule's command and the address it wakes (command to address). A Function trigger's label is function: look it up by id."
+								"description": "A webhook's scheme and host, followed by \"/... (path and query hidden)\" when its URL has more (GET /v1/endpoints/{id} has the whole URL), a pull subscription's name (or pull when it has none), a route's or filter's pattern, or a wake schedule's command and the address it wakes (command to address). A Function trigger's label is function: look it up by id."
 							},
 							"org_owned": {
 								"type": "boolean",
 								"description": "true: the organization owns it, and it keeps working. false: the credential owns it itself, as with everything a third-party app or agent delegate made, a webhook made with a narrowed API key, or a wake schedule made with a key that does not cover super_admin. It keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to or kept it. Revoking a third-party app or agent delegate turns these off, except that a block filter it made keeps blocking, within the reach the app had, unless the person revoking chose to stop it."
+							},
+							"still_acting": {
+								"description": "For an API key: whether anything still acts for it after this revoke (the organization, a key of the same rotation that still works, or whoever took it over). Null when that could not be read.",
+								"type": ["boolean", "null"]
+							},
+							"acting_key_id": {
+								"description": "For an API key: the key that still acts for it, shown to a caller who may read the organization's API keys. Null otherwise, and when no key does.",
+								"type": ["string", "null"]
+							},
+							"delivering": {
+								"description": "For an API key's webhook: whether it is still sent received mail, as GET /v1/endpoints/{id} delivery.delivering says. Null when that could not be read.",
+								"type": ["boolean", "null"]
 							}
 						},
 						"required": [
@@ -10713,6 +10725,28 @@ const operationManifest = [
 						],
 						"additionalProperties": {}
 					}
+				},
+				"predecessors_revoked_count": {
+					"description": "For an API key: how many keys it replaced in its rotation, still in their overlap, were revoked with it. Keys that replaced it never are.",
+					"type": "integer",
+					"minimum": -9007199254740991,
+					"maximum": 9007199254740991
+				},
+				"predecessors_left": {
+					"description": "For an API key: how many such keys were left working because you may not revoke them. They work until their overlap ends.",
+					"type": "integer",
+					"minimum": -9007199254740991,
+					"maximum": 9007199254740991
+				},
+				"predecessors_revoked": {
+					"description": "The ids of the keys counted in predecessors_revoked_count, to a caller who may read the organization's API keys.",
+					"type": "array",
+					"items": { "type": "string" }
+				},
+				"predecessors_not_revoked": {
+					"description": "The ids of the keys counted in predecessors_left, to a caller who may read the organization's API keys.",
+					"type": "array",
+					"items": { "type": "string" }
 				}
 			},
 			"required": [
@@ -10731,7 +10765,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "rotate-key",
-		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "rotateKey",
@@ -10905,7 +10939,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-key",
-		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. The one exception is suspending a key (suspended true with no other change; expected_grant_ref may accompany it), which the person who holds it may do whatever the key reaches, calling as themself rather than through another app; lifting a suspension is a change like any other. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateKey",
@@ -12913,11 +12947,463 @@ const operationManifest = [
 		"tag": "Domains",
 		"tagCommand": "domains"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-email-rule-covering-me",
+		"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getEmailRuleCoveringMe",
+		"path": "/email-rules/covering-me/{id}",
+		"pathParams": [{
+			"description": "The rule id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"name": {
+					"description": "Null when covers_now is false: its name now may describe something else.",
+					"type": ["string", "null"]
+				},
+				"state": {
+					"type": "string",
+					"enum": [
+						"draft",
+						"observe",
+						"active"
+					],
+					"description": "draft: it decides nothing. observe: it decides and records, and shares nothing. active: it decides and, for a grant rule, shares what it matches."
+				},
+				"kind": {
+					"type": "string",
+					"enum": ["grant", "do_not_share"],
+					"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
+				},
+				"author": {
+					"type": "object",
+					"properties": {
+						"user_id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"name": {
+							"description": "Their name; null when they have none set.",
+							"type": ["string", "null"]
+						},
+						"email": {
+							"description": "Sign-in email; null unless you can list member emails or this is you.",
+							"type": ["string", "null"]
+						}
+					},
+					"required": [
+						"user_id",
+						"name",
+						"email"
+					]
+				},
+				"is_author": {
+					"type": "boolean",
+					"description": "Whether you wrote it."
+				},
+				"covers": {
+					"description": "Null when it no longer covers your mailboxes and you see it because it decided on your mail.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" },
+								"description": "Your own mailboxes (your member mailbox and your personal agents' addresses) it reaches now, lowercase."
+							},
+							"via": {
+								"type": "string",
+								"enum": [
+									"author_reach",
+									"selected",
+									"own_mailboxes"
+								],
+								"description": "author_reach: it runs over everything its author can read, which includes these. selected: it names these mailboxes or their domain. own_mailboxes: it is your own rule over your own mail."
+							}
+						},
+						"required": ["addresses", "via"]
+					}, { "type": "null" }]
+				},
+				"current_version": {
+					"type": ["integer", "null"],
+					"exclusiveMinimum": 0,
+					"description": "Null when covers_now is false."
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"covers_now": {
+					"type": "boolean",
+					"description": "Whether it covers one of your own mailboxes now. False for a rule you see only because it decided on mail at your own mailbox before."
+				},
+				"current": {
+					"description": "Its current version: what it asks of each email. When covers_now is false, the newest version that decided on your mail instead.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "integer",
+								"exclusiveMinimum": 0
+							},
+							"english": {
+								"type": "string",
+								"description": "What its author asked for, in their words."
+							},
+							"tree": {
+								"type": "object",
+								"properties": {
+									"version": {
+										"type": "number",
+										"const": 1
+									},
+									"vocabulary": {
+										"type": "string",
+										"description": "Vocabulary version, such as v1."
+									},
+									"when": {
+										"type": "object",
+										"propertyNames": { "type": "string" },
+										"additionalProperties": {},
+										"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+									},
+									"questions": {
+										"type": "array",
+										"items": { "type": "string" },
+										"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
+									}
+								},
+								"required": [
+									"version",
+									"vocabulary",
+									"when",
+									"questions"
+								]
+							},
+							"explanation": {
+								"type": "string",
+								"description": "What the rule matches, as compiled."
+							},
+							"assumptions": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"compiled_by": { "type": "string" },
+							"vocabulary": { "type": "string" },
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"version",
+							"english",
+							"tree",
+							"explanation",
+							"assumptions",
+							"compiled_by",
+							"vocabulary",
+							"created_at"
+						]
+					}, { "type": "null" }]
+				},
+				"note": {
+					"description": "Present when covers_now is false: what is withheld, and why.",
+					"type": "string"
+				}
+			},
+			"required": [
+				"id",
+				"name",
+				"state",
+				"kind",
+				"author",
+				"is_author",
+				"covers",
+				"current_version",
+				"created_at",
+				"covers_now",
+				"current"
+			]
+		},
+		"sdkName": "getEmailRuleCoveringMe",
+		"summary": "Get a rule over your mail",
+		"tag": "Email Rule Oversight",
+		"tagCommand": "email-rule-oversight"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rule-decisions-on-my-mail",
+		"description": "What a rule that covers your mailboxes, or decided on your mail, decided about mail at your own mailboxes, newest first: never about anyone else's mail. Each decision is in the words of the version that made it, which can be earlier than the current one: the questions it asked about that email (question_answers) and the columns its conditions read (parts). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRuleDecisionsOnMyMail",
+		"path": "/email-rules/covering-me/{id}/decisions",
+		"pathParams": [{
+			"description": "The rule id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [
+			{
+				"default": 50,
+				"description": "Decisions per page, from 1 to 100; defaults to 50.",
+				"enum": null,
+				"maximum": 100,
+				"minimum": 1,
+				"name": "limit",
+				"required": false,
+				"type": "integer"
+			},
+			{
+				"description": "meta.cursor from the preceding page. Omit for the first page.",
+				"enum": null,
+				"name": "cursor",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "true for matches only, false for the rest.",
+				"enum": ["true", "false"],
+				"name": "matched",
+				"required": false,
+				"type": "string"
+			}
+		],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"email_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"rule_version": {
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
+					"classification_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"matched": { "type": "boolean" },
+					"near_miss": {
+						"type": "boolean",
+						"description": "Not matched, but nearly. False when detail_withheld is true."
+					},
+					"parts": {
+						"type": "array",
+						"items": {},
+						"description": "How each top-level part of the rule decided."
+					},
+					"question_answers": {
+						"type": "array",
+						"items": {},
+						"description": "The answers to the rule's own questions, when they were asked."
+					},
+					"detail_withheld": {
+						"description": "Present, as true, when the email's content cannot be read: matched still says what the rule decided, and parts and question_answers are empty.",
+						"type": "boolean",
+						"const": true
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"from_address": {
+						"description": "The email's sender address, as GET /v1/emails/{id} shows it.",
+						"type": ["string", "null"]
+					},
+					"subject": { "type": ["string", "null"] },
+					"received_at": {
+						"type": ["string", "null"],
+						"format": "date-time",
+						"description": "When the email arrived. Null, with the other two, when you are not shown the email (it awaits sender authentication)."
+					}
+				},
+				"required": [
+					"id",
+					"email_id",
+					"rule_version",
+					"classification_id",
+					"matched",
+					"near_miss",
+					"parts",
+					"question_answers",
+					"created_at",
+					"from_address",
+					"subject",
+					"received_at"
+				]
+			}
+		},
+		"sdkName": "listEmailRuleDecisionsOnMyMail",
+		"summary": "List what a rule decided about your mail",
+		"tag": "Email Rule Oversight",
+		"tagCommand": "email-rule-oversight"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rules-covering-me",
+		"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRulesCoveringMe",
+		"path": "/email-rules/covering-me",
+		"pathParams": [],
+		"queryParams": [{
+			"default": 50,
+			"description": "Rules per page, from 1 to 100; defaults to 50.",
+			"enum": null,
+			"maximum": 100,
+			"minimum": 1,
+			"name": "limit",
+			"required": false,
+			"type": "integer"
+		}, {
+			"description": "meta.cursor from the preceding page. Omit for the first page.",
+			"enum": null,
+			"name": "cursor",
+			"required": false,
+			"type": "string"
+		}],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"name": { "type": "string" },
+					"state": {
+						"type": "string",
+						"enum": [
+							"draft",
+							"observe",
+							"active"
+						],
+						"description": "draft: it decides nothing. observe: it decides and records, and shares nothing. active: it decides and, for a grant rule, shares what it matches."
+					},
+					"kind": {
+						"type": "string",
+						"enum": ["grant", "do_not_share"],
+						"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
+					},
+					"author": {
+						"type": "object",
+						"properties": {
+							"user_id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"name": {
+								"description": "Their name; null when they have none set.",
+								"type": ["string", "null"]
+							},
+							"email": {
+								"description": "Sign-in email; null unless you can list member emails or this is you.",
+								"type": ["string", "null"]
+							}
+						},
+						"required": [
+							"user_id",
+							"name",
+							"email"
+						]
+					},
+					"is_author": {
+						"type": "boolean",
+						"description": "Whether you wrote it."
+					},
+					"covers": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" },
+								"description": "Your own mailboxes (your member mailbox and your personal agents' addresses) it reaches now, lowercase."
+							},
+							"via": {
+								"type": "string",
+								"enum": [
+									"author_reach",
+									"selected",
+									"own_mailboxes"
+								],
+								"description": "author_reach: it runs over everything its author can read, which includes these. selected: it names these mailboxes or their domain. own_mailboxes: it is your own rule over your own mail."
+							}
+						},
+						"required": ["addresses", "via"]
+					},
+					"current_version": {
+						"type": ["integer", "null"],
+						"exclusiveMinimum": 0
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"name",
+					"state",
+					"kind",
+					"author",
+					"is_author",
+					"covers",
+					"current_version",
+					"created_at"
+				]
+			}
+		},
+		"sdkName": "listEmailRulesCoveringMe",
+		"summary": "List the rules over your mail",
+		"tag": "Email Rule Oversight",
+		"tagCommand": "email-rule-oversight"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "accept-email-rule-request",
-		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Made-up emails sent in expectation_samples are kept on the rule this writes, where GET /v1/email-rules/{id} lists them. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "acceptEmailRuleRequest",
@@ -12972,7 +13458,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -13034,6 +13520,112 @@ const operationManifest = [
 						},
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
+				},
+				"expectation_samples": {
+					"description": "Made-up emails the rule must match or not, such as look-alikes it must never match, kept on the rule this accept writes.",
+					"minItems": 1,
+					"maxItems": 20,
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					}
 				}
 			},
 			"additionalProperties": false
@@ -13079,7 +13671,7 @@ const operationManifest = [
 								"questions": {
 									"type": "array",
 									"items": { "type": "string" },
-									"description": "Yes/no questions asked once the conditions match; all must be yes."
+									"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 								}
 							},
 							"required": [
@@ -13188,6 +13780,14 @@ const operationManifest = [
 						"decline_reason": {
 							"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 							"type": ["string", "null"]
+						},
+						"edited_on_accept": {
+							"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+							"type": ["boolean", "null"]
+						},
+						"notice": {
+							"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+							"type": ["string", "null"]
 						}
 					},
 					"required": [
@@ -13234,6 +13834,10 @@ const operationManifest = [
 							"type": "string",
 							"enum": ["grant", "do_not_share"]
 						},
+						"protection_note": {
+							"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
+							"type": "string"
+						},
 						"evaluation_scope": {
 							"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 							"type": "string",
@@ -13337,7 +13941,7 @@ const operationManifest = [
 											"questions": {
 												"type": "array",
 												"items": { "type": "string" },
-												"description": "Yes/no questions asked once the conditions match; all must be yes."
+												"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 											}
 										},
 										"required": [
@@ -13564,6 +14168,10 @@ const operationManifest = [
 						"rule",
 						"rule_id"
 					]
+				},
+				"notice": {
+					"description": "What is now shared, in words.",
+					"type": "string"
 				}
 			},
 			"required": [
@@ -13663,7 +14271,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "compile-email-rule",
-		"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to five yes/no questions, asked about an email only after its conditions match; they read its subject, its new text and its attachments' file names, never what is inside an attachment, and warnings say when a question mentions attachments. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "compileEmailRule",
@@ -13724,7 +14332,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -13746,7 +14354,7 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "Parts of the description the column contract cannot express, and how the rule handles them. When the rule reads automated or from_mailing_list, it also has a note on what that column reads and what it misses. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
+					"description": "Parts of the description the column contract cannot express, and how the rule handles them. It also has notes on reading automated, from_mailing_list or sender_relationship, a sender address the description does not give, and a grant worded as a prohibition. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
 				},
 				"compiled_by": {
 					"type": "string",
@@ -13805,7 +14413,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule",
-		"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated). You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated), or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRule",
@@ -13836,9 +14444,13 @@ const operationManifest = [
 					"enum": ["grant", "do_not_share"]
 				},
 				"state": {
-					"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated.",
+					"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated; active only for a do_not_share rule.",
 					"type": "string",
-					"enum": ["draft", "observe"]
+					"enum": [
+						"draft",
+						"observe",
+						"active"
+					]
 				},
 				"evaluation_scope": {
 					"type": "string",
@@ -13899,6 +14511,112 @@ const operationManifest = [
 					"additionalProperties": false,
 					"description": "Emails it must match and must not (at most 100): a test by rule_id judges them unless expect is given, and each version it saves is checked against them."
 				},
+				"expectation_samples": {
+					"description": "Made-up emails it must match or not (at most 20).",
+					"minItems": 1,
+					"maxItems": 20,
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					}
+				},
 				"english": {
 					"type": "string",
 					"minLength": 1,
@@ -13923,7 +14641,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -14015,6 +14733,10 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
+				"protection_note": {
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
+					"type": "string"
+				},
 				"evaluation_scope": {
 					"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 					"type": "string",
@@ -14118,7 +14840,7 @@ const operationManifest = [
 									"questions": {
 										"type": "array",
 										"items": { "type": "string" },
-										"description": "Yes/no questions asked once the conditions match; all must be yes."
+										"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 									}
 								},
 								"required": [
@@ -14206,8 +14928,114 @@ const operationManifest = [
 						]
 					}
 				},
+				"expectation_samples": {
+					"description": "Its saved made-up emails, when this write set or added some.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": { "type": ["string", "null"] },
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"expected",
+							"label",
+							"email",
+							"created_at"
+						]
+					}
+				},
 				"expectations_check": {
-					"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
+					"description": "After a write that saved a version or changed its expectations or made-up emails, if it has some: the emails by id judged on that version from stored classifications without asking its questions, and any made-up emails listed as undecided. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed), and after a write that changed only made-up emails on a rule with emails by id. Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
 					"type": "object",
 					"properties": {
 						"version": {
@@ -14219,7 +15047,7 @@ const operationManifest = [
 							"type": ["boolean", "null"]
 						},
 						"decided": {
-							"description": "Whether every expectation was judged (undecided is empty). Absent from a server that predates it.",
+							"description": "Whether every expectation was judged (undecided and undecided_samples are empty). Absent from a server that predates it.",
 							"type": "boolean"
 						},
 						"failed": {
@@ -14236,8 +15064,24 @@ const operationManifest = [
 								"format": "uuid"
 							}
 						},
+						"failed_samples": {
+							"description": "Made-up emails that failed, by index in the set judged (saved oldest first, then added; or as sent).",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"undecided_samples": {
+							"description": "Made-up emails not decided, by index. Only a write sent with if_expectations_pass that saves a version or activates the rule judges them.",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
 						"note": {
-							"description": "On an update that saved a version that did not pass: that it was saved anyway, is current, and whether it is live.",
+							"description": "On an update that saved a version that did not pass, or a do_not_share rule created active: that it was saved anyway, is current, and whether it is live.",
 							"type": "string"
 						}
 					},
@@ -14372,7 +15216,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -14481,7 +15325,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -14591,6 +15435,14 @@ const operationManifest = [
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
 				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
+				},
 				"target_can_accept": {
 					"description": "Whether the member asked can accept it now under their role. Null unless you can list members and their roles (members:read), or when it could not be read.",
 					"type": ["boolean", "null"]
@@ -14702,7 +15554,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -14811,6 +15663,14 @@ const operationManifest = [
 				"decline_reason": {
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
+				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -14941,7 +15801,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "end-email-rule-share",
-		"description": "Stops sharing. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.",
+		"description": "Stops sharing; the rule itself is left unchanged, as the answer's note says. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.",
 		"hasJsonBody": false,
 		"method": "DELETE",
 		"operationId": "endEmailRuleShare",
@@ -14960,14 +15820,339 @@ const operationManifest = [
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
-			"properties": { "ended": { "type": "boolean" } },
-			"required": ["ended"]
+			"properties": {
+				"ended": { "type": "boolean" },
+				"rule_id": { "type": "string" },
+				"note": { "type": "string" }
+			},
+			"required": ["ended"],
+			"additionalProperties": {}
 		},
 		"sdkName": "endEmailRuleShare",
 		"summary": "End a rule share",
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "generate-look-alikes",
+		"description": "Writes made-up emails that come close to what a grant rule describes, and reports what the rule decides for each, as test-sample would. Most should not match (expected no_match): business near misses from its senders and topic (kind other: an all-clear, a reply with nothing new, a related document, another subject) and private mail (a personal medical bill, pay for named people, a personal purchase, personal banking or tax). By default a third, rounded down, are near cases it should match (expected match, kind other). failed means the rule decided one against expected. Nothing is stored and no mail is read. Keep them, with their expected, with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "generateLookAlikes",
+		"path": "/email-rules/look-alikes",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": {
+			"type": "object",
+			"properties": {
+				"tree": {
+					"type": "object",
+					"properties": {
+						"version": {
+							"type": "number",
+							"const": 1
+						},
+						"vocabulary": {
+							"type": "string",
+							"description": "Vocabulary version, such as v1."
+						},
+						"when": {
+							"type": "object",
+							"propertyNames": { "type": "string" },
+							"additionalProperties": {},
+							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+						},
+						"questions": {
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": [
+						"version",
+						"vocabulary",
+						"when"
+					],
+					"additionalProperties": false
+				},
+				"english": {
+					"description": "What the tree is meant to match; without it, the tree is described in words.",
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 2e3
+				},
+				"evaluation_scope": {
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those mail:share_own lets you share). author: all you can read, inboxes added later included. selected: what scope_selection names."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
+				},
+				"rule_id": {
+					"description": "A saved rule you can see: its current version and words.",
+					"type": "string",
+					"format": "uuid"
+				},
+				"request_id": {
+					"description": "A rule request you can see: its rule as asked.",
+					"type": "string",
+					"format": "uuid"
+				},
+				"kind": {
+					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
+				"count": {
+					"description": "How many, 1 to 8; 6 by default.",
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 8
+				},
+				"kinds": {
+					"description": "Which kinds, taken in turn, all expected no_match; other is a business near miss. Left out, a default mix.",
+					"minItems": 1,
+					"maxItems": 5,
+					"type": "array",
+					"items": {
+						"type": "string",
+						"enum": [
+							"medical",
+							"payroll",
+							"personal_purchase",
+							"bank_tax",
+							"other"
+						]
+					}
+				},
+				"to": {
+					"description": "The mailbox they arrive in; by default the first address (alphabetically) a selected scope names that a made-up email can be sent to, preferring one the author still reads; else the rule author's (a request's target's) sign-in address when you may see it, else yours.",
+					"type": "string",
+					"maxLength": 254,
+					"format": "email",
+					"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+				}
+			},
+			"additionalProperties": false
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"rule": {
+					"type": "object",
+					"properties": {
+						"id": {
+							"type": ["string", "null"],
+							"format": "uuid"
+						},
+						"version": {
+							"type": ["integer", "null"],
+							"exclusiveMinimum": 0
+						},
+						"vocabulary": { "type": "string" }
+					},
+					"required": [
+						"id",
+						"version",
+						"vocabulary"
+					]
+				},
+				"look_alikes": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": {
+								"type": "string",
+								"enum": [
+									"medical",
+									"payroll",
+									"personal_purchase",
+									"bank_tax",
+									"other"
+								]
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"],
+								"description": "match: a near case the rule should match; no_match: one it should not."
+							},
+							"why": {
+								"type": "string",
+								"description": "Why the rule should, or should not, match it."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": { "type": "string" },
+											"name": { "type": "string" }
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"cc": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"subject": { "type": "string" },
+									"text": { "type": "string" },
+									"attachment_types": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" }
+								},
+								"required": [
+									"from",
+									"to",
+									"cc",
+									"subject",
+									"text",
+									"attachment_types",
+									"automated",
+									"from_mailing_list"
+								],
+								"description": "A made-up email, as test-sample takes it."
+							},
+							"outcome": {
+								"type": "string",
+								"enum": [
+									"matched",
+									"near_miss",
+									"no_match",
+									"not_decided"
+								]
+							},
+							"status": {
+								"type": "string",
+								"enum": [
+									"passed",
+									"failed",
+									"undecided"
+								],
+								"description": "failed: the rule decided it against expected (shared one it should not, or missed one it should match). undecided: the rule reads a spam score, which it cannot carry, whatever it decided; or not matched on something it could not decide (not classified, a fact or answer missing, or not reached in time)."
+							},
+							"question_answers": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"question": { "type": "string" },
+										"answer": { "type": ["boolean", "null"] },
+										"probability": { "type": ["number", "null"] },
+										"error_class": { "type": "string" }
+									},
+									"required": [
+										"question",
+										"answer",
+										"probability"
+									]
+								}
+							}
+						},
+						"required": [
+							"kind",
+							"expected",
+							"why",
+							"email",
+							"outcome",
+							"status",
+							"question_answers"
+						]
+					}
+				},
+				"counts": {
+					"type": "object",
+					"properties": {
+						"passed": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"failed": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"undecided": {
+							"type": "integer",
+							"minimum": 0
+						},
+						"dropped": {
+							"type": "integer",
+							"minimum": 0,
+							"description": "Asked for but not returned: not written, outside the sample bounds, or of a kind and expected not asked for."
+						}
+					},
+					"required": [
+						"passed",
+						"failed",
+						"undecided",
+						"dropped"
+					]
+				},
+				"note": {
+					"type": "string",
+					"description": "That the emails are made up and were never sent or stored."
+				}
+			},
+			"required": [
+				"rule",
+				"look_alikes",
+				"counts",
+				"note"
+			]
+		},
+		"sdkName": "generateLookAlikes",
+		"summary": "Write look-alike emails a rule should or should not match",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -15016,6 +16201,10 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
+				"protection_note": {
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
+					"type": "string"
+				},
 				"evaluation_scope": {
 					"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 					"type": "string",
@@ -15119,7 +16308,7 @@ const operationManifest = [
 									"questions": {
 										"type": "array",
 										"items": { "type": "string" },
-										"description": "Yes/no questions asked once the conditions match; all must be yes."
+										"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 									}
 								},
 								"required": [
@@ -15197,6 +16386,112 @@ const operationManifest = [
 						}
 					},
 					"required": ["match", "no_match"]
+				},
+				"expectation_samples": {
+					"description": "Its saved made-up emails, oldest first.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": { "type": ["string", "null"] },
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"expected",
+							"label",
+							"email",
+							"created_at"
+						]
+					}
 				}
 			},
 			"required": [
@@ -15220,7 +16515,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-request",
-		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleRequest",
@@ -15275,7 +16570,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -15384,6 +16679,14 @@ const operationManifest = [
 				"decline_reason": {
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
+				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -15974,7 +17277,7 @@ const operationManifest = [
 					"matched": { "type": "boolean" },
 					"near_miss": {
 						"type": "boolean",
-						"description": "Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). Decisions recorded under the earlier definition counted an exclusion too."
+						"description": "Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). Decisions recorded under the earlier definition counted an exclusion too."
 					},
 					"parts": {
 						"type": "array",
@@ -16157,7 +17460,7 @@ const operationManifest = [
 							"questions": {
 								"type": "array",
 								"items": { "type": "string" },
-								"description": "Yes/no questions asked once the conditions match; all must be yes."
+								"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 							}
 						},
 						"required": [
@@ -16266,6 +17569,14 @@ const operationManifest = [
 					"decline_reason": {
 						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 						"type": ["string", "null"]
+					},
+					"edited_on_accept": {
+						"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+						"type": ["boolean", "null"]
+					},
+					"notice": {
+						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"type": ["string", "null"]
 					}
 				},
 				"required": [
@@ -16301,7 +17612,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-results",
-		"description": "Every rule you can see and what it decided about this email (matched, not matched, or not run, with what is known), in the words of the version that decided. A matched do_not_share rule keeps rules from sharing the email while it is active; what was shared before then stays shared. Only a caller who can read the email gets an answer. classification is what the classifier read from the email, every fact as rule conditions read it, so you can see why a rule did or did not match. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only); hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleResults",
@@ -16360,7 +17671,7 @@ const operationManifest = [
 								"type": "string",
 								"format": "uuid"
 							},
-							"name": { "type": "string" },
+							"name": { "type": ["string", "null"] },
 							"state": {
 								"type": "string",
 								"enum": [
@@ -16384,7 +17695,7 @@ const operationManifest = [
 									},
 									"matched": { "type": "boolean" },
 									"near_miss": {
-										"description": "Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). False when detail_withheld is true. Decisions recorded under the earlier definition counted an exclusion too.",
+										"description": "Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). False when detail_withheld is true. Decisions recorded under the earlier definition counted an exclusion too.",
 										"type": "boolean"
 									},
 									"parts": {
@@ -16450,7 +17761,7 @@ const operationManifest = [
 												"questions": {
 													"type": "array",
 													"items": { "type": "string" },
-													"description": "Yes/no questions asked once the conditions match; all must be yes."
+													"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 												}
 											},
 											"required": [
@@ -16527,6 +17838,33 @@ const operationManifest = [
 								"description": "On a do-not-share rule whose author is no longer a member of the organization: it blocks nothing now, whatever it decided. Absent otherwise.",
 								"type": "boolean",
 								"const": true
+							},
+							"read_only": {
+								"description": "Another member's rule that decided on your own mail; dashboard and CLI only. name is null once it no longer covers you.",
+								"type": "boolean",
+								"const": true
+							},
+							"author": {
+								"type": "object",
+								"properties": {
+									"user_id": {
+										"type": "string",
+										"format": "uuid"
+									},
+									"name": {
+										"description": "Their name; null when they have none set.",
+										"type": ["string", "null"]
+									},
+									"email": {
+										"description": "Sign-in email; null unless you can list member emails or this is you.",
+										"type": ["string", "null"]
+									}
+								},
+								"required": [
+									"user_id",
+									"name",
+									"email"
+								]
 							}
 						},
 						"required": [
@@ -16537,12 +17875,17 @@ const operationManifest = [
 							"not_run_reason"
 						]
 					},
-					"description": "Every rule the caller can see: those that matched this email, then those that did not, then those that have not run on it; newest rule first within each."
+					"description": "Rules you can see, and read_only ones: matched first, then not matched, then not run; newest first within each."
 				},
 				"hidden": {
 					"type": "integer",
 					"minimum": 0,
-					"description": "How many more rules the caller can see that are not listed."
+					"description": "Rules that decided on this email that you cannot see."
+				},
+				"not_listed": {
+					"description": "Rules you can see past the 50 listed.",
+					"type": "integer",
+					"minimum": 0
 				},
 				"classification": {
 					"type": ["object", "null"],
@@ -17283,7 +18626,7 @@ const operationManifest = [
 							"questions": {
 								"type": "array",
 								"items": { "type": "string" },
-								"description": "Yes/no questions asked once the conditions match; all must be yes."
+								"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 							}
 						},
 						"required": [
@@ -17409,6 +18752,10 @@ const operationManifest = [
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -17751,7 +19098,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -17841,10 +19188,114 @@ const operationManifest = [
 								"type": "string",
 								"format": "uuid"
 							}
+						},
+						"samples": {
+							"maxItems": 20,
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"expected": {
+										"type": "string",
+										"enum": ["match", "no_match"]
+									},
+									"label": {
+										"type": ["string", "null"],
+										"minLength": 1,
+										"maxLength": 200,
+										"pattern": "^[^\\u0000]*$",
+										"description": "What the email stands for, such as a personal medical bill."
+									},
+									"email": {
+										"type": "object",
+										"properties": {
+											"from": {
+												"type": "object",
+												"properties": {
+													"address": {
+														"type": "string",
+														"maxLength": 254,
+														"format": "email",
+														"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+													},
+													"name": {
+														"type": "string",
+														"maxLength": 200,
+														"pattern": "^[^\\u0000]*$"
+													}
+												},
+												"required": ["address"]
+											},
+											"to": {
+												"minItems": 1,
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"maxLength": 254,
+													"format": "email",
+													"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+												}
+											},
+											"cc": {
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"maxLength": 254,
+													"format": "email",
+													"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+												}
+											},
+											"subject": {
+												"type": "string",
+												"maxLength": 998,
+												"pattern": "^[^\\u0000]*$"
+											},
+											"text": {
+												"type": "string",
+												"minLength": 1,
+												"maxLength": 4e3,
+												"pattern": "^[^\\u0000]*$"
+											},
+											"attachment_types": {
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"minLength": 1,
+													"maxLength": 255,
+													"pattern": "^[^\\u0000]*$"
+												}
+											},
+											"automated": { "type": "boolean" },
+											"from_mailing_list": { "type": "boolean" },
+											"spam_score": {
+												"type": "number",
+												"minimum": -1e3,
+												"maximum": 1e3
+											}
+										},
+										"required": [
+											"from",
+											"to",
+											"text"
+										],
+										"description": "A made-up email, as POST /email-rules/test-sample takes it."
+									},
+									"id": {
+										"type": "string",
+										"format": "uuid"
+									},
+									"created_at": { "type": "string" }
+								},
+								"required": ["expected", "email"],
+								"additionalProperties": false
+							}
 						}
 					},
 					"additionalProperties": false,
-					"description": "Emails the rule must match and must not, at most 100 in all, always tested whatever their age: added to email_ids, or to the recent window, which gives up a place for each. The answer's expectations judge each."
+					"description": "Emails the rule must match and must not (at most 100), always tested whatever their age, and made-up emails (samples, at most 20). Given, it replaces a saved rule's own."
 				}
 			},
 			"additionalProperties": false
@@ -17991,7 +19442,7 @@ const operationManifest = [
 									"skipped",
 									"not_found"
 								],
-								"description": "near_miss: Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). skipped: an email you can see that cannot be tested; skipped_reason says why. not_found: no such email, or not one the rule can read (or not settled, or awaiting sender authentication)."
+								"description": "near_miss: Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). skipped: an email you can see that cannot be tested; skipped_reason says why. not_found: no such email, or not one the rule can read (or not settled, or awaiting sender authentication)."
 							},
 							"received_at": {
 								"type": "string",
@@ -18226,7 +19677,7 @@ const operationManifest = [
 					}
 				},
 				"expectations": {
-					"description": "Present when expect was given, or for a saved rule with saved expectations.",
+					"description": "Present when expect was given, or for a saved rule with saved expectations or made-up emails.",
 					"type": "object",
 					"properties": {
 						"passed": {
@@ -18296,6 +19747,71 @@ const operationManifest = [
 								]
 							},
 							"description": "match first, then no_match, each in the order given (saved expectations by email id)."
+						},
+						"samples": {
+							"description": "Made-up emails judged (expect.samples, or a saved rule's), in order; counts include them.",
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"index": {
+										"type": "integer",
+										"minimum": 0
+									},
+									"sample_id": {
+										"type": ["string", "null"],
+										"format": "uuid"
+									},
+									"label": { "type": ["string", "null"] },
+									"expected": {
+										"type": "string",
+										"enum": ["match", "no_match"]
+									},
+									"outcome": {
+										"type": "string",
+										"enum": [
+											"matched",
+											"near_miss",
+											"no_match",
+											"not_decided"
+										]
+									},
+									"status": {
+										"type": "string",
+										"enum": [
+											"passed",
+											"failed",
+											"undecided"
+										]
+									},
+									"question_answers": {
+										"type": "array",
+										"items": {
+											"type": "object",
+											"properties": {
+												"question": { "type": "string" },
+												"answer": { "type": ["boolean", "null"] },
+												"probability": { "type": ["number", "null"] },
+												"error_class": { "type": "string" }
+											},
+											"required": [
+												"question",
+												"answer",
+												"probability"
+											]
+										}
+									}
+								},
+								"required": [
+									"index",
+									"sample_id",
+									"label",
+									"expected",
+									"outcome",
+									"status",
+									"question_answers"
+								]
+							}
 						}
 					},
 					"required": [
@@ -18360,7 +19876,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -18541,7 +20057,7 @@ const operationManifest = [
 						"near_miss",
 						"no_match"
 					],
-					"description": "near_miss: Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false)."
+					"description": "near_miss: Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false)."
 				},
 				"parts": {
 					"type": "array",
@@ -18728,7 +20244,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -18855,6 +20371,217 @@ const operationManifest = [
 					"additionalProperties": false,
 					"description": "Replaces its saved expectations (author only); null removes them."
 				},
+				"expectation_samples": {
+					"maxItems": 20,
+					"type": ["array", "null"],
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					},
+					"description": "Replaces its saved made-up emails (author only); null or [] removes them."
+				},
+				"add_expectation_samples": {
+					"description": "Adds made-up emails to those saved (author only), up to 20 in all.",
+					"minItems": 1,
+					"maxItems": 20,
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": {
+								"type": ["string", "null"],
+								"minLength": 1,
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$",
+								"description": "What the email stands for, such as a personal medical bill."
+							},
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"created_at": { "type": "string" }
+						},
+						"required": ["expected", "email"],
+						"additionalProperties": false
+					}
+				},
 				"if_revision": {
 					"description": "The revision you read: if the rule was updated since, nothing is saved (409 email_rule_conflict, revision_moved).",
 					"type": "integer",
@@ -18862,7 +20589,7 @@ const operationManifest = [
 					"maximum": 2147483647
 				},
 				"if_expectations_pass": {
-					"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; undecided: 409 expectations_undecided (both with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
+					"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; on emails the rule cannot read: 409 expectations_unreadable; undecided: 409 expectations_undecided (each with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
 					"type": "boolean"
 				},
 				"restore_version": {
@@ -18895,6 +20622,10 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
+				"protection_note": {
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
+					"type": "string"
+				},
 				"evaluation_scope": {
 					"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 					"type": "string",
@@ -18998,7 +20729,7 @@ const operationManifest = [
 									"questions": {
 										"type": "array",
 										"items": { "type": "string" },
-										"description": "Yes/no questions asked once the conditions match; all must be yes."
+										"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 									}
 								},
 								"required": [
@@ -19086,8 +20817,114 @@ const operationManifest = [
 						]
 					}
 				},
+				"expectation_samples": {
+					"description": "Its saved made-up emails, when this write set or added some.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"]
+							},
+							"label": { "type": ["string", "null"] },
+							"email": {
+								"type": "object",
+								"properties": {
+									"from": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"maxLength": 254,
+												"format": "email",
+												"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"maxLength": 200,
+												"pattern": "^[^\\u0000]*$"
+											}
+										},
+										"required": ["address"]
+									},
+									"to": {
+										"minItems": 1,
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"cc": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"maxLength": 254,
+											"format": "email",
+											"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+										}
+									},
+									"subject": {
+										"type": "string",
+										"maxLength": 998,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"text": {
+										"type": "string",
+										"minLength": 1,
+										"maxLength": 4e3,
+										"pattern": "^[^\\u0000]*$"
+									},
+									"attachment_types": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000]*$"
+										}
+									},
+									"automated": { "type": "boolean" },
+									"from_mailing_list": { "type": "boolean" },
+									"spam_score": {
+										"type": "number",
+										"minimum": -1e3,
+										"maximum": 1e3
+									}
+								},
+								"required": [
+									"from",
+									"to",
+									"text"
+								],
+								"description": "A made-up email, as POST /email-rules/test-sample takes it."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"expected",
+							"label",
+							"email",
+							"created_at"
+						]
+					}
+				},
 				"expectations_check": {
-					"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
+					"description": "After a write that saved a version or changed its expectations or made-up emails, if it has some: the emails by id judged on that version from stored classifications without asking its questions, and any made-up emails listed as undecided. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed), and after a write that changed only made-up emails on a rule with emails by id. Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
 					"type": "object",
 					"properties": {
 						"version": {
@@ -19099,7 +20936,7 @@ const operationManifest = [
 							"type": ["boolean", "null"]
 						},
 						"decided": {
-							"description": "Whether every expectation was judged (undecided is empty). Absent from a server that predates it.",
+							"description": "Whether every expectation was judged (undecided and undecided_samples are empty). Absent from a server that predates it.",
 							"type": "boolean"
 						},
 						"failed": {
@@ -19116,8 +20953,24 @@ const operationManifest = [
 								"format": "uuid"
 							}
 						},
+						"failed_samples": {
+							"description": "Made-up emails that failed, by index in the set judged (saved oldest first, then added; or as sent).",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"undecided_samples": {
+							"description": "Made-up emails not decided, by index. Only a write sent with if_expectations_pass that saves a version or activates the rule judges them.",
+							"type": "array",
+							"items": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
 						"note": {
-							"description": "On an update that saved a version that did not pass: that it was saved anyway, is current, and whether it is live.",
+							"description": "On an update that saved a version that did not pass, or a do_not_share rule created active: that it was saved anyway, is current, and whether it is live.",
 							"type": "string"
 						}
 					},
@@ -19246,7 +21099,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -19355,6 +21208,14 @@ const operationManifest = [
 				"decline_reason": {
 					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 					"type": ["string", "null"]
+				},
+				"edited_on_accept": {
+					"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+					"type": ["boolean", "null"]
+				},
+				"notice": {
+					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -19892,12 +21753,12 @@ const operationManifest = [
 							},
 							"hold": {
 								"type": "object",
-								"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+								"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 								"required": ["reason", "since"],
 								"properties": {
 									"reason": {
 										"type": "string",
-										"description": "Open: credential_reuse_hold."
+										"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 									},
 									"since": {
 										"type": ["string", "null"],
@@ -35371,7 +37232,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "decide-suspension",
-		"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
+		"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it needs the decider to cover it, and so does revoking an API key unless the decider holds it and decides as themself rather than through another app (revoking an uncovered key someone else holds is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "decideSuspension",
@@ -35636,7 +37497,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-access-mode",
-		"description": "Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Any person; API keys are refused.",
+		"description": "Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Needs members:read (owners, admins, members and roles that grant it); API keys are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getAccessMode",
@@ -35898,7 +37759,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-roles",
-		"description": "Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Any person (a session or OAuth token); API keys are refused.",
+		"description": "Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Needs members:read (owners, admins, members and roles that grant it); API keys are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listRoles",
@@ -38442,12 +40303,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -38675,12 +40536,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -39140,12 +41001,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -39373,12 +41234,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -40354,12 +42215,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -40587,12 +42448,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -41219,12 +43080,12 @@ const operationManifest = [
 					},
 					"hold": {
 						"type": "object",
-						"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+						"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 						"required": ["reason", "since"],
 						"properties": {
 							"reason": {
 								"type": "string",
-								"description": "Open: credential_reuse_hold."
+								"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 							},
 							"since": {
 								"type": ["string", "null"],
@@ -41704,12 +43565,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -41937,12 +43798,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -42725,12 +44586,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -42958,12 +44819,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -46675,7 +48536,10 @@ const operationManifest = [
 					"format": "uuid",
 					"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
 				},
-				"endpoint_url": { "type": "string" },
+				"endpoint_url": {
+					"type": "string",
+					"description": "Where it was sent: a webhook's scheme and host, followed by \"/... (path and query hidden)\" when its URL has more (GET /endpoints/{id} has the whole URL), function://<id> for a Function, or pull: for a pull subscription."
+				},
 				"status": { "type": "string" },
 				"attempt_count": { "type": "integer" },
 				"duration_ms": { "type": ["integer", "null"] },
@@ -46686,7 +48550,7 @@ const operationManifest = [
 					"description": "The HTTP status the endpoint answered this attempt with: a webhook's own answer, or for a Function what its runtime answered, which is the platform's own error when the Function could not be run. Null when no answer came back (a network error, a timeout, an attempt refused or not sent) and on attempts recorded before this field."
 				},
 				"response_body": {
-					"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent.",
+					"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent. Null for a redirect (3xx), whose body repeats its Location; otherwise the webhook URL's path and query are hidden wherever it repeats them.",
 					"type": ["string", "null"]
 				},
 				"created_at": { "type": "string" },
@@ -46739,7 +48603,7 @@ const operationManifest = [
 								"description": "The HTTP status the endpoint answered this attempt with: a webhook's own answer, or for a Function what its runtime answered, which is the platform's own error when the Function could not be run. Null when no answer came back (a network error, a timeout, an attempt refused or not sent) and on attempts recorded before this field."
 							},
 							"response_body": {
-								"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent.",
+								"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent. Null for a redirect (3xx), whose body repeats its Location; otherwise the webhook URL's path and query are hidden wherever it repeats them.",
 								"type": ["string", "null"]
 							},
 							"retry_scheduled": {
@@ -46896,7 +48760,10 @@ const operationManifest = [
 						"type": "string",
 						"format": "uuid"
 					},
-					"endpoint_url": { "type": "string" },
+					"endpoint_url": {
+						"type": "string",
+						"description": "Where it was sent: a webhook's scheme and host, followed by \"/... (path and query hidden)\" when its URL has more (GET /endpoints/{id} has the whole URL), function://<id> for a Function, or pull: for a pull subscription."
+					},
 					"status": {
 						"type": "string",
 						"enum": [
@@ -46949,7 +48816,7 @@ const operationManifest = [
 					},
 					"response_body": {
 						"type": ["string", "null"],
-						"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent."
+						"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent. Null for a redirect (3xx), whose body repeats its Location; otherwise the webhook URL's path and query are hidden wherever it repeats them."
 					},
 					"latest_attempt": {
 						"type": "boolean",
@@ -47171,7 +49038,7 @@ function sanitizeForTerminal(value) {
 	return out;
 }
 // src/oclif/answer-reports.ts
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 /** Text from an answer, made safe and one line for a report: no terminal controls. */
@@ -47180,10 +49047,10 @@ function oneLine(text) {
 }
 /** One line per warning a route write answers with (createRoute, updateRoute). */
 function routeWarningLines(data) {
-	const warnings = isRecord$2(data) ? data.warnings : void 0;
+	const warnings = isRecord$3(data) ? data.warnings : void 0;
 	if (!Array.isArray(warnings)) return [];
 	return warnings.flatMap((warning) => {
-		if (!isRecord$2(warning)) return [];
+		if (!isRecord$3(warning)) return [];
 		const message = typeof warning.message === "string" ? oneLine(warning.message) : "";
 		if (message) return [`Route warning: ${withCliCommands(message)}`];
 		const code = typeof warning.code === "string" ? oneLine(warning.code) : "";
@@ -47211,11 +49078,11 @@ const DELIVERED_STATUSES = /* @__PURE__ */ new Set(["delivered", "header_confirm
 * and has no recorded answer says so.
 */
 function deliveryAttemptLines(data) {
-	const attempts = isRecord$2(data) ? data.attempts : void 0;
+	const attempts = isRecord$3(data) ? data.attempts : void 0;
 	if (!Array.isArray(attempts)) return [];
 	const lines = [];
 	for (const attempt of attempts) {
-		if (!isRecord$2(attempt)) continue;
+		if (!isRecord$3(attempt)) continue;
 		const text = (value) => typeof value === "string" && value ? oneLine(value) : "";
 		const status = text(attempt.status);
 		const parts = [
@@ -47309,7 +49176,7 @@ var CliOrgRefusedError = class extends Errors.CLIError {
 		this.orgId = params.orgId;
 	}
 };
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function apiOrigin(apiBaseUrl) {
@@ -47336,7 +49203,7 @@ function isUuid(value) {
 	return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
 function isOrgAccessToken(value) {
-	return isRecord$1(value) && typeof value.access_token === "string" && value.access_token.length > 0 && value.token_type === "Bearer" && typeof value.expires_in === "number" && value.expires_in > 0 && typeof value.org_id === "string" && (value.org_name === null || typeof value.org_name === "string") && typeof value.oauth_grant_id === "string";
+	return isRecord$2(value) && typeof value.access_token === "string" && value.access_token.length > 0 && value.token_type === "Bearer" && typeof value.expires_in === "number" && value.expires_in > 0 && typeof value.org_id === "string" && (value.org_name === null || typeof value.org_name === "string") && typeof value.oauth_grant_id === "string";
 }
 function orgTokenFromResponse(token, now = Date.now) {
 	return {
@@ -47383,7 +49250,7 @@ async function postTokenEndpoint(params) {
 		throw new Errors.CLIError(`Could not reach the Primitive OAuth token endpoint: ${detail}`, { exit: 1 });
 	}
 	const payload = await response.json().catch(() => null);
-	if (response.ok && isRecord$1(payload)) return {
+	if (response.ok && isRecord$2(payload)) return {
 		ok: true,
 		payload
 	};
@@ -47391,7 +49258,7 @@ async function postTokenEndpoint(params) {
 		ok: true,
 		payload: {}
 	};
-	const record = isRecord$1(payload) ? payload : {};
+	const record = isRecord$2(payload) ? payload : {};
 	return {
 		ok: false,
 		status: response.status,
@@ -47594,12 +49461,12 @@ async function fetchCliOrgs(params) {
 	}
 	const payload = await response.json().catch(() => null);
 	if (!response.ok) {
-		const error = isRecord$1(payload) && isRecord$1(payload.error) ? payload.error : {};
+		const error = isRecord$2(payload) && isRecord$2(payload.error) ? payload.error : {};
 		if (response.status === 404 && error.code === "feature_disabled") throw new Errors.CLIError("This Primitive server does not support switching organizations for CLI logins.", { exit: 1 });
 		throw new Errors.CLIError(`Could not list organizations${typeof error.message === "string" ? `: ${error.message}` : ` (HTTP ${response.status}).`}`, { exit: 1 });
 	}
-	const data = isRecord$1(payload) ? payload.data : null;
-	if (!isRecord$1(data) || !Array.isArray(data.orgs)) throw new Errors.CLIError("Primitive API returned an unexpected organization list.", { exit: 1 });
+	const data = isRecord$2(payload) ? payload.data : null;
+	if (!isRecord$2(data) || !Array.isArray(data.orgs)) throw new Errors.CLIError("Primitive API returned an unexpected organization list.", { exit: 1 });
 	return data;
 }
 /** How long a command waits for another CLI process to finish with the saved login. */
@@ -48172,6 +50039,379 @@ async function withAttachmentWait(call, options) {
 	}
 	return result;
 }
+// src/oclif/email-rule-samples.ts
+function errorDetail(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function usageError$1(message) {
+	return new Errors.CLIError(message, { exit: 2 });
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** A path as a shell word: quoted when it holds anything but plain characters. */
+function shellWord(value) {
+	return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+/** A JSON file a flag names, parsed, or an exit-1 error saying why not. */
+function readJsonFileFlag(path, flag) {
+	let text;
+	try {
+		text = readFileSync(path, "utf8");
+	} catch (error) {
+		throw new Errors.CLIError(`Could not read ${flag} ${path}: ${errorDetail(error)}`, { exit: 1 });
+	}
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		throw new Errors.CLIError(`${flag} ${path} is not valid JSON: ${errorDetail(error)}`, { exit: 1 });
+	}
+}
+/** The longest label the API keeps on a sample. */
+const SAMPLE_LABEL_MAX = 200;
+/**
+* `text` cut to `max` UTF-16 units, as the API counts a label's length,
+* never inside a character.
+*/
+function cutLabel(text, max) {
+	const cut = text.slice(0, max);
+	return (/[\uD800-\uDBFF]$/.test(cut) ? cut.slice(0, -1) : cut).trimEnd();
+}
+/**
+* Whether a look-alike is one the rule should match: its `expected` as the
+* API gives it. An answer without one (an older server) is must-not-match,
+* as every look-alike was.
+*/
+function lookAlikeExpected(lookAlike) {
+	return lookAlike.expected === "match" ? "match" : "no_match";
+}
+/**
+* A look-alike as a sample, keeping its `expected` (most must not match; a
+* near case the rule should take must match): the email as written,
+* labelled with its kind and why ("medical: ..."), or the why alone when
+* both do not fit a label.
+*/
+function lookAlikeSample(lookAlike) {
+	if (!isRecord$1(lookAlike) || !isRecord$1(lookAlike.email)) return null;
+	const kind = typeof lookAlike.kind === "string" ? lookAlike.kind : "";
+	const why = typeof lookAlike.why === "string" ? lookAlike.why.trim() : "";
+	const both = kind && why ? `${kind}: ${why}` : kind || why;
+	const label = both.length <= SAMPLE_LABEL_MAX ? both : why.length <= SAMPLE_LABEL_MAX ? why : `${cutLabel(why, 197)}...`;
+	return {
+		expected: lookAlikeExpected(lookAlike),
+		...label ? { label } : {},
+		email: lookAlike.email
+	};
+}
+/**
+* The look-alikes of a generate-look-alikes answer that can be saved (each
+* with an email), in the answer's order. The report numbers these and the
+* samples file holds these, so a number means the same email in both.
+*/
+function lookAlikeEntries(answer) {
+	const list = isRecord$1(answer) && Array.isArray(answer.look_alikes) ? answer.look_alikes : [];
+	const entries = [];
+	for (const item of list) {
+		const sample = lookAlikeSample(item);
+		if (sample && isRecord$1(item)) entries.push({
+			lookAlike: item,
+			sample
+		});
+	}
+	return entries;
+}
+/** The look-alikes of a generate-look-alikes answer, as samples, in order. */
+function lookAlikeSamples(answer) {
+	return lookAlikeEntries(answer).map((entry) => entry.sample);
+}
+/** The fields a saved made-up email takes, and the API's bounds on them. */
+const SAMPLE_EMAIL_KEYS = /* @__PURE__ */ new Set([
+	"from",
+	"to",
+	"cc",
+	"subject",
+	"text",
+	"attachment_types",
+	"automated",
+	"from_mailing_list",
+	"spam_score"
+]);
+const SAMPLE_TEXT_MAX = 4e3;
+const SAMPLE_SUBJECT_MAX = 998;
+const SAMPLE_LIST_MAX = 10;
+/**
+* Refuse, naming the sample and the field, a made-up email the API would
+* refuse to keep: the fields it takes and their bounds. The API checks the
+* rest (address forms, a NUL).
+*/
+function checkSampleEmail(email, at) {
+	const fail = (what) => {
+		throw usageError$1(`${at}: email ${what}.`);
+	};
+	const unknown = Object.keys(email).find((key) => !SAMPLE_EMAIL_KEYS.has(key));
+	if (unknown !== void 0) fail(`takes no "${unknown}" (it takes ${[...SAMPLE_EMAIL_KEYS].join(", ")})`);
+	if (!isRecord$1(email.from) || typeof email.from.address !== "string") fail("needs from.address");
+	const list = (key, min) => {
+		const value = email[key];
+		if (value === void 0 && min === 0) return;
+		if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string") || value.length < min || value.length > SAMPLE_LIST_MAX) fail(`${key} must be a list of ${min > 0 ? `${min} to ` : "at most "}${SAMPLE_LIST_MAX} strings`);
+	};
+	list("to", 1);
+	list("cc", 0);
+	list("attachment_types", 0);
+	if (email.subject !== void 0 && (typeof email.subject !== "string" || email.subject.length > SAMPLE_SUBJECT_MAX)) fail(`subject must be a string of at most ${SAMPLE_SUBJECT_MAX} characters`);
+	if (typeof email.text !== "string" || email.text.length === 0 || email.text.length > SAMPLE_TEXT_MAX) fail(`text must be 1 to ${SAMPLE_TEXT_MAX} characters`);
+	for (const key of ["automated", "from_mailing_list"]) if (email[key] !== void 0 && typeof email[key] !== "boolean") fail(`${key} must be true or false`);
+	if (email.spam_score !== void 0 && (typeof email.spam_score !== "number" || !Number.isFinite(email.spam_score))) fail("spam_score must be a number");
+}
+/** The keys a sample may carry: a saved one's id and time are taken and ignored. */
+const SAMPLE_KEYS = /* @__PURE__ */ new Set([
+	"expected",
+	"label",
+	"email",
+	"id",
+	"created_at"
+]);
+/**
+* The samples a file holds: a JSON array of samples, as --samples-file
+* writes them, or a generate-look-alikes answer saved as the command printed
+* it (with or without --json), whose look-alikes become samples, each
+* keeping whether it must match, numbered as its report numbered them. Only a literal [] holds no
+* samples; an answer with none is refused, so it never empties a rule's.
+*/
+function samplesFromJson(value, source) {
+	const data = isRecord$1(value) && isRecord$1(value.data) ? value.data : value;
+	if (isRecord$1(data) && Array.isArray(data.look_alikes)) {
+		const samples = lookAlikeSamples(data);
+		if (samples.length === 0) throw usageError$1(`${source} is a generate-look-alikes answer with no look-alikes in it.`);
+		samples.forEach((sample, index) => {
+			checkSampleEmail(sample.email, `${source}, look-alike ${index + 1}`);
+		});
+		return samples;
+	}
+	if (!Array.isArray(data)) throw usageError$1(`${source} must hold a JSON array of samples, such as [{"expected": "no_match", "label": "a personal bill", "email": {...}}], or a generate-look-alikes answer.`);
+	return data.map((item, index) => {
+		const at = `${source}, sample ${index + 1}`;
+		if (!isRecord$1(item)) throw usageError$1(`${at} is not an object.`);
+		const unknown = Object.keys(item).find((key) => !SAMPLE_KEYS.has(key));
+		if (unknown !== void 0) throw usageError$1(`${at}: "${unknown}" is not a sample field; a sample takes expected, label and email.`);
+		if (item.expected !== "match" && item.expected !== "no_match") throw usageError$1(`${at}: expected must be "match" or "no_match".`);
+		if (!isRecord$1(item.email)) throw usageError$1(`${at}: email must be an object, as test-email-rule-on-sample takes it.`);
+		checkSampleEmail(item.email, at);
+		const label = item.label;
+		if (label !== void 0 && label !== null) {
+			if (typeof label !== "string") throw usageError$1(`${at}: label must be a string.`);
+			if (label.trim() === "") throw usageError$1(`${at}: label is blank; leave it out or say what the email stands for.`);
+			if (label.trim().length > SAMPLE_LABEL_MAX) throw usageError$1(`${at}: label is longer than ${SAMPLE_LABEL_MAX} characters.`);
+		}
+		return {
+			expected: item.expected,
+			...label !== void 0 ? { label } : {},
+			email: item.email
+		};
+	});
+}
+/**
+* The numbers --pick names, from 1, in the order given and without repeats,
+* or a usage error: "2,4" or "2 4". `count` is how many there are to pick
+* from; a number past it is refused, rather than skipped.
+*/
+function pickNumbers(pick, count, source) {
+	const parts = pick.split(/[\s,]+/).map((part) => part.trim()).filter((part) => part !== "");
+	if (parts.length === 0) throw usageError$1("--pick needs the numbers of the samples to take, such as --pick 2,4.");
+	const chosen = [];
+	for (const part of parts) {
+		if (!/^\d+$/.test(part)) throw usageError$1(`--pick ${pick}: "${part}" is not a sample number.`);
+		const n = Number(part);
+		if (n < 1 || n > count) throw usageError$1(count === 0 ? `--pick ${pick}: ${source} holds no samples.` : `--pick ${pick}: ${n} is not a sample number; ${source} holds ${count === 1 ? "sample 1" : `samples 1 to ${count}`}.`);
+		if (!chosen.includes(n)) chosen.push(n);
+	}
+	return chosen;
+}
+/** The samples --pick chooses, by their numbers from 1. */
+function pickSamples(samples, pick, source) {
+	return pickNumbers(pick, samples.length, source).map((n) => samples[n - 1]);
+}
+/**
+* The number a person knows a sample a command sent by: its number in the
+* samples file when --pick took it, else its place from 1 in what was sent.
+* `index` is its place in what was sent, from 0, as the API gives it.
+*/
+function sentSampleNumber(index, flags) {
+	const pick = flags?.[PICK_FLAG];
+	if (typeof pick !== "string") return index + 1;
+	try {
+		return pickNumbers(pick, Number.MAX_SAFE_INTEGER, "")[index] ?? index + 1;
+	} catch {
+		return index + 1;
+	}
+}
+/** The samples file flags: replace (create and update), add (update), and test. */
+const SAMPLES_FILE_FLAG = "expectation-samples-file";
+const ADD_SAMPLES_FILE_FLAG = "add-expectation-samples-file";
+const EXPECT_SAMPLES_FILE_FLAG = "expect-samples-file";
+const PICK_FLAG = "pick";
+/** generate-look-alikes' flag for the file it writes them to. */
+const LOOK_ALIKES_SAMPLES_FILE_FLAG = "samples-file";
+/** The samples a samples file flag names, only those --pick chooses if given. */
+function readSamplesFile(path, flag, pick) {
+	const source = `--${flag} ${path}`;
+	const all = samplesFromJson(readJsonFileFlag(path, `--${flag}`), source);
+	const samples = typeof pick === "string" ? pickSamples(all, pick, source) : all;
+	if (samples.length > 20) throw usageError$1(`${source} holds ${samples.length} samples, and a rule or a test takes at most 20; take some with --pick.`);
+	return samples;
+}
+/** The one of `names` given as a file path, or null; --pick without one is refused. */
+function givenSamplesFlag(flags, names) {
+	const given = names.find((name) => typeof flags[name] === "string") ?? null;
+	if (given === null && typeof flags["pick"] === "string") throw usageError$1(`--pick chooses from a samples file: pass it with ${names.map((name) => `--${name}`).join(" or ")}.`);
+	return given;
+}
+/**
+* The body fields a samples file sets on create-email-rule and
+* update-email-rule: expectation_samples (on update it replaces them) or, on
+* update, add_expectation_samples. With --pick, only the samples it names.
+*/
+function samplesBodyFields(canAdd) {
+	const names = canAdd ? [SAMPLES_FILE_FLAG, ADD_SAMPLES_FILE_FLAG] : [SAMPLES_FILE_FLAG];
+	return (flags) => {
+		const flag = givenSamplesFlag(flags, names);
+		if (flag === null) return [];
+		const path = flags[flag];
+		const samples = readSamplesFile(path, flag, flags[PICK_FLAG]);
+		if (samples.length === 0 && !(canAdd && flag === "expectation-samples-file")) throw usageError$1(`--${flag} ${path} holds no samples.`);
+		return [{
+			flag: `--${flag}`,
+			property: flag === "add-expectation-samples-file" ? "add_expectation_samples" : "expectation_samples",
+			value: samples
+		}];
+	};
+}
+/**
+* The samples test-email-rule expects, from --expect-samples-file (only
+* those --pick chooses if given), or null without the flag. They go in
+* expect.samples.
+*/
+function expectSamples(flags) {
+	const flag = givenSamplesFlag(flags, [EXPECT_SAMPLES_FILE_FLAG]);
+	if (flag === null) return null;
+	const path = flags[flag];
+	const samples = readSamplesFile(path, flag, flags[PICK_FLAG]);
+	if (samples.length === 0) throw usageError$1(`--${flag} ${path} holds no samples.`);
+	return samples;
+}
+/** --pick's help, naming the flags it chooses from. */
+function pickFlagHelp(flags) {
+	return `Take only these samples from ${flags.map((flag) => `--${flag}`).join(" or ")}, by their numbers from 1 as generate-look-alikes printed them: --pick 2,4. A number the file does not hold is refused.`;
+}
+/**
+* What the rule decided for a look-alike, and what its status makes of it,
+* against what it should do: leave it (`no_match`), or take it (`match`).
+*/
+function decidedLine(outcome, status, expected) {
+	if (outcome === "not_decided") return "The rule did not decide it: it was not reached in time, or deciding it failed.";
+	if (outcome === "matched") return status === "undecided" ? "The rule matched it, but it reads a spam score, which a look-alike does not carry, so this one is undecided." : expected === "match" ? "The rule matched it, as it should." : "The rule matched it, so mail like it would be shared.";
+	const decided = outcome === "near_miss" ? "The rule nearly matched it, but did not" : "The rule did not match it";
+	if (status === "undecided") return `${decided}, on something it could not decide (its classification failed, a fact or a question's answer is missing, or it reads a spam score, which a look-alike does not carry), so this one is undecided.`;
+	if (expected === "no_match") return `${decided}.`;
+	return `${decided}, ${outcome === "near_miss" ? "though" : "but"} it should: mail like it would be missed.`;
+}
+/**
+* The stderr report of generate-look-alikes: each look-alike numbered as the
+* samples file numbers it, with its status, kind, subject, sender, why the
+* rule should (or should not) match it and what the rule decided; the
+* counts; the answer's note; and how to save the ones you choose. With
+* --samples-file it writes every look-alike there as a sample keeping its
+* expected, in that order.
+*/
+function lookAlikesReport(data, request) {
+	const file = request.flags?.[LOOK_ALIKES_SAMPLES_FILE_FLAG];
+	if (!isRecord$1(data)) {
+		if (typeof file !== "string") return { lines: [] };
+		const message = `Did not write --${LOOK_ALIKES_SAMPLES_FILE_FLAG} ${file}: the answer held no look-alikes to write.`;
+		return {
+			lines: [message],
+			exitCode: 1,
+			error: {
+				code: "samples_file_not_written",
+				message
+			}
+		};
+	}
+	const entries = lookAlikeEntries(data);
+	const lines = [];
+	entries.forEach(({ lookAlike }, index) => {
+		const email = lookAlike.email;
+		const from = isRecord$1(email.from) && typeof email.from.address === "string" ? email.from.address : "an unknown sender";
+		const subject = typeof email.subject === "string" && email.subject ? `"${email.subject}"` : "(no subject)";
+		const status = typeof lookAlike.status === "string" ? lookAlike.status : "undecided";
+		const kind = typeof lookAlike.kind === "string" ? lookAlike.kind : "other";
+		const outcome = typeof lookAlike.outcome === "string" ? lookAlike.outcome : "not_decided";
+		const expected = lookAlikeExpected(lookAlike);
+		lines.push(`${index + 1}. ${status}  ${kind}  ${subject} from ${from}`);
+		if (typeof lookAlike.why === "string" && lookAlike.why.trim()) lines.push(`   Why it should ${expected === "match" ? "" : "not "}match: ${lookAlike.why.trim()}`);
+		lines.push(`   ${decidedLine(outcome, status, expected)}`);
+	});
+	const counts = isRecord$1(data.counts) ? data.counts : {};
+	const count = (key) => typeof counts[key] === "number" ? counts[key] : 0;
+	const dropped = count("dropped");
+	lines.push(`Counts: ${count("passed")} passed, ${count("failed")} failed, ${count("undecided")} undecided${dropped > 0 ? `; ${dropped} asked for did not come back` : ""}.`);
+	if (typeof data.note === "string" && data.note.trim()) lines.push(data.note.trim());
+	const numbered = (status) => entries.map(({ lookAlike }, index) => lookAlike.status === status ? index + 1 : 0).filter((n) => n > 0);
+	const wanted = (n) => entries[n - 1]?.sample.expected === "match";
+	const failed = numbered("failed");
+	const missed = failed.filter(wanted);
+	const matched = failed.filter((n) => !wanted(n));
+	const undecided = numbered("undecided");
+	const chosen = failed.length > 0 ? failed : undecided.length > 0 ? numbered("passed") : [];
+	const pick = chosen.length > 0 ? ` --pick ${chosen.join(",")}` : "";
+	const body = isRecord$1(request.body) ? request.body : {};
+	const ruleId = typeof body.rule_id === "string" ? body.rule_id : null;
+	const requestId = typeof body.request_id === "string" ? body.request_id : null;
+	const target = typeof file === "string" ? shellWord(file) : "<file>";
+	const save = ruleId ? `\`primitive email-rules update-email-rule ${ruleId} --${ADD_SAMPLES_FILE_FLAG} ${target}${pick}\`` : requestId ? `\`primitive email-rules accept-email-rule-request ${requestId} --${SAMPLES_FILE_FLAG} ${target}${pick}\` when the member the request asks accepts it` : `\`primitive email-rules create-email-rule ... --${SAMPLES_FILE_FLAG} ${target}${pick}\` when you save the rule`;
+	const one = (count, single, many) => count === 1 ? single : many;
+	const noneDecided = entries.length > 0 && undecided.length === entries.length ? `None of them was decided (each says why above), so saved as they are they may stay undecided; if the rule reads a spam score, give each email a spam_score${typeof file === "string" ? " in the file" : ""} first.` : "";
+	const keepMatched = `${one(matched.length, "the one it matched as an email", "the ones it matched as emails")} it must not match`;
+	const keepMissed = `${one(missed.length, "the one it missed as an email", "the ones it missed as emails")} it must match`;
+	const which = failed.length > 0 ? `Keep ${matched.length > 0 && missed.length > 0 ? `${keepMatched}, and ${keepMissed}` : matched.length > 0 ? keepMatched : keepMissed}` : chosen.length > 0 ? chosen.some(wanted) ? `Keep ${one(chosen.length, "the one", "the ones")} it decided as expected (each keeps whether it must match; an undecided one may stay undecided as a sample)` : `Keep ${one(chosen.length, "the one it did not match as an email", "the ones it did not match as emails")} it must not match (an undecided one may stay undecided as a sample)` : entries.some((_, index) => wanted(index + 1)) ? `Keep ${one(entries.length, "it as an email", "them as emails")} the rule must match or not, as each says` : `Keep ${one(entries.length, "it as an email", "them as emails")} the rule must not match`;
+	const test = failed.length > 0 ? ` Test an edited rule on ${one(failed.length, "it", "them")} with \`primitive email-rules test-email-rule ${ruleId ? `--rule-id ${ruleId}` : "--body-file <body.json>"} --${EXPECT_SAMPLES_FILE_FLAG} ${target}${pick}\`.` : "";
+	if (typeof file === "string") {
+		const samples = entries.map((entry) => entry.sample);
+		if (samples.length === 0) {
+			const message = `Did not write --${LOOK_ALIKES_SAMPLES_FILE_FLAG} ${file}: no look-alikes came back, so it was left as it was.`;
+			return {
+				lines: [...lines, message],
+				exitCode: 1,
+				error: {
+					code: "samples_file_not_written",
+					message
+				}
+			};
+		}
+		try {
+			writeFileSync(file, `${JSON.stringify(samples, null, 2)}\n`);
+		} catch (error) {
+			const message = `Could not write --${LOOK_ALIKES_SAMPLES_FILE_FLAG} ${file}: ${errorDetail(error)}`;
+			return {
+				lines: [
+					...lines,
+					message,
+					"The JSON printed above holds these same look-alikes: save it to a file and give that file instead. Running generate-look-alikes again writes new ones."
+				],
+				exitCode: 1,
+				error: {
+					code: "samples_file_not_written",
+					message
+				}
+			};
+		}
+		const wrote = `Wrote ${one(samples.length, "the look-alike", `the ${samples.length} look-alikes`)} to ${file}, numbered as above.`;
+		lines.push(noneDecided ? `${wrote} ${noneDecided}` : `${wrote} ${which}, with ${save}; --pick takes any of the numbers.${test}`);
+	} else if (noneDecided) lines.push(noneDecided);
+	else if (entries.length > 0) lines.push(`${which}: save the JSON printed above to a file and give it to ${save}; --pick takes any of the numbers above.${test}`);
+	return { lines };
+}
 // src/oclif/email-rule-authoring.ts
 const EMAIL_ID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
 /** Whether `id` has the shape of an email id (a UUID). */
@@ -48184,9 +50424,6 @@ function usageError(message) {
 function isRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function errorDetail(error) {
-	return error instanceof Error ? error.message : String(error);
-}
 /** `count` and the word for it: "1 expectation", "2 expectations". */
 function plural$1(count, one, many) {
 	return `${count} ${count === 1 ? one : many}`;
@@ -48227,7 +50464,7 @@ function checkExpectations(value, label) {
 	if (!isRecord(value)) throw usageError(`${label} must hold a JSON object such as {"match": ["<email-id>"], "no_match": ["<email-id>"]}.`);
 	const expectations = {};
 	for (const [key, list] of Object.entries(value)) {
-		if (key !== "match" && key !== "no_match") throw usageError(`${label} takes only "match" and "no_match"; "${key}" is not one of them.`);
+		if (key !== "match" && key !== "no_match") throw usageError(key === "samples" ? `${label} takes emails by id only; give made-up emails with ${label.startsWith("--expectations-file") ? "--expectation-samples-file" : "--expect-samples-file"}.` : `${label} takes only "match" and "no_match"; "${key}" is not one of them.`);
 		if (!Array.isArray(list) || list.some((id) => typeof id !== "string")) throw usageError(`${label}: "${key}" must be a list of email ids.`);
 		const ids = [];
 		const seen = /* @__PURE__ */ new Set();
@@ -48243,33 +50480,19 @@ function checkExpectations(value, label) {
 	assertDisjoint(expectations, label);
 	return expectations;
 }
-/** Read and parse a JSON file a flag names, failing like --body-file does. */
-function readJsonFileFlag(path, flag) {
-	let text;
-	try {
-		text = readFileSync(path, "utf8");
-	} catch (error) {
-		throw new Errors.CLIError(`Could not read ${flag} ${path}: ${errorDetail(error)}`, { exit: 1 });
-	}
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		throw new Errors.CLIError(`${flag} ${path} is not valid JSON: ${errorDetail(error)}`, { exit: 1 });
-	}
-}
-/** `expect` for test-email-rule, from --expect-file or the id flags. */
+/**
+* `expect` for test-email-rule, from --expect-file or the id flags, with the
+* made-up emails --expect-samples-file holds in expect.samples.
+*/
 function expectBodyFields(flags) {
+	const samples = expectSamples(flags);
 	const file = flags["expect-file"];
-	if (typeof file === "string") {
-		const label = `--expect-file ${file}`;
-		return [{
-			flag: "--expect-file",
-			property: "expect",
-			value: checkExpectations(readJsonFileFlag(file, "--expect-file"), label)
-		}];
-	}
 	const expect = {};
 	const given = [];
+	if (typeof file === "string") {
+		Object.assign(expect, checkExpectations(readJsonFileFlag(file, "--expect-file"), `--expect-file ${file}`));
+		given.push("--expect-file");
+	}
 	const match = flags["expect-match"];
 	if (Array.isArray(match)) {
 		expect.match = parseEmailIdList(match, "--expect-match");
@@ -48280,8 +50503,12 @@ function expectBodyFields(flags) {
 		expect.no_match = parseEmailIdList(noMatch, "--expect-no-match");
 		given.push("--expect-no-match");
 	}
-	if (given.length === 0) return [];
 	assertDisjoint(expect, given.join(" and "));
+	if (samples) {
+		expect.samples = samples;
+		given.push(`--${EXPECT_SAMPLES_FILE_FLAG}`);
+	}
+	if (given.length === 0) return [];
 	return [{
 		flag: given.join(", "),
 		property: "expect",
@@ -48418,18 +50645,72 @@ function expectationLine(result, results) {
 	const note = result.status === "undecided" ? undecidedNote(undecidedReason(result, results)) : void 0;
 	return `  ${result.status}: ${result.email_id} expected ${result.expected}, got ${result.outcome}${note ? ` (${note})` : ""}`;
 }
-function expectationsLines(expectations, testResults) {
+/** The made-up emails a test's expectations judged, in order. */
+function sampleJudgments(expectations) {
+	return (isRecord(expectations) && Array.isArray(expectations.samples) ? expectations.samples : []).filter(isRecord).map((item, position) => ({
+		index: typeof item.index === "number" ? item.index : position,
+		label: typeof item.label === "string" ? item.label : null,
+		expected: String(item.expected ?? ""),
+		outcome: String(item.outcome ?? "not_decided"),
+		status: String(item.status ?? "undecided"),
+		question_answers: Array.isArray(item.question_answers) ? item.question_answers.filter(isRecord) : []
+	}));
+}
+function sampleNamer(request) {
+	const sent = isRecord(request?.body) && isRecord(request.body.expect) && Array.isArray(request.body.expect.samples);
+	const fromFile = sent && typeof request?.flags?.["expect-samples-file"] === "string";
+	return ({ index, label }) => {
+		const n = fromFile ? sentSampleNumber(index, request?.flags) : index + 1;
+		const name = sent ? `sample ${n}` : `saved sample ${n}`;
+		return label ? `${name} ("${label}")` : name;
+	};
+}
+/**
+* Why a made-up email is undecided, and whether a later test can decide it:
+* yes when it was not reached or a question went unanswered; maybe not
+* otherwise, since a spam score it does not carry, a fact its
+* classification left out or a failed classification look the same. A
+* spam score left unset makes one undecided even with a question
+* unanswered, which then reads as decidable later: the answer cannot tell.
+*/
+function sampleUndecidedReason(sample) {
+	if (sample.outcome === "not_decided") return {
+		why: "it was not reached in time, or deciding it failed",
+		resolvable: true
+	};
+	const answers = sample.question_answers;
+	if (answers.some((answer) => answer.answer === null) && !answers.some((answer) => answer.answer === false)) return {
+		why: "a question went unanswered",
+		resolvable: true
+	};
+	return {
+		why: "it reads a spam score the sample does not carry, a fact its classification left out, or its classification failed",
+		resolvable: false,
+		may: true
+	};
+}
+function sampleLines(sample, name) {
+	const note = sample.status === "undecided" ? ` (${undecidedNote(sampleUndecidedReason(sample))})` : "";
+	const lines = [`  ${sample.status}: ${name(sample)} expected ${sample.expected}, got ${sample.outcome}${note}`];
+	if (sample.question_answers.length > 0) lines.push(`    questions: ${sample.question_answers.map(answerText).join("; ")}`);
+	return lines;
+}
+function expectationsLines(expectations, testResults, name = sampleNamer()) {
 	if (!expectations) return [];
 	const results = Array.isArray(expectations.results) ? expectations.results : [];
 	const passed = expectations.counts?.passed ?? 0;
 	const failed = expectations.counts?.failed ?? 0;
 	const undecided = expectations.counts?.undecided ?? 0;
 	if (expectations.passed && failed === 0 && undecided === 0) return [`Expectations: all ${passed} passed.`];
-	return [`Expectations: ${[
-		failed > 0 ? `${failed} failed` : "",
-		undecided > 0 ? `${undecided} undecided` : "",
-		`${passed} passed`
-	].filter((part) => part !== "").join(", ")}.`, ...results.filter((result) => result.status !== "passed").map((result) => expectationLine(result, testResults))];
+	return [
+		`Expectations: ${[
+			failed > 0 ? `${failed} failed` : "",
+			undecided > 0 ? `${undecided} undecided` : "",
+			`${passed} passed`
+		].filter((part) => part !== "").join(", ")}.`,
+		...results.filter((result) => result.status !== "passed").map((result) => expectationLine(result, testResults)),
+		...sampleJudgments(expectations).filter((sample) => sample.status !== "passed").flatMap((sample) => sampleLines(sample, name))
+	];
 }
 const NOT_MATCHED_ORDER = {
 	near_miss: 1,
@@ -48491,14 +50772,24 @@ function notMatchedLines(results, expectations) {
 *   test can decide it;
 * - else nothing: the exit code stays 0.
 */
-function expectationsOutcome(expectations, testResults = []) {
+function expectationsOutcome(expectations, testResults = [], name = sampleNamer()) {
 	if (!expectations) return {};
 	const results = Array.isArray(expectations.results) ? expectations.results : [];
-	const failed = results.filter((result) => result.status === "failed").map((result) => result.email_id);
-	const undecided = results.filter((result) => result.status === "undecided").map((result) => ({
+	const samples = sampleJudgments(expectations);
+	const failed = [...results.filter((result) => result.status === "failed").map((result) => result.email_id), ...samples.filter((sample) => sample.status === "failed").map((sample) => name({
+		index: sample.index,
+		label: null
+	}))];
+	const undecided = [...results.filter((result) => result.status === "undecided").map((result) => ({
 		id: result.email_id,
 		reason: undecidedReason(result, testResults)
-	}));
+	})), ...samples.filter((sample) => sample.status === "undecided").map((sample) => ({
+		id: name({
+			index: sample.index,
+			label: null
+		}),
+		reason: sampleUndecidedReason(sample)
+	}))];
 	const unresolvable = undecided.filter(({ reason }) => !reason.resolvable);
 	const failedCount = Math.max(expectations.counts?.failed ?? 0, failed.length);
 	const undecidedCount = Math.max(expectations.counts?.undecided ?? 0, undecided.length);
@@ -48514,7 +50805,7 @@ function expectationsOutcome(expectations, testResults = []) {
 		exitCode: 1,
 		error: {
 			code: "expectations_unresolvable",
-			message: `${plural$1(unresolvable.length, "expectation is", "expectations are")} undecided, and testing again will not decide ${unresolvable.length === 1 ? "it" : "them"}: ${why(unresolvable)}.`
+			message: `${plural$1(unresolvable.length, "expectation is", "expectations are")} undecided, and testing again ${unresolvable.every(({ reason }) => reason.may) ? "may not decide" : "will not decide"} ${unresolvable.length === 1 ? "it" : "them"}: ${why(unresolvable)}.`
 		}
 	};
 	if (undecidedCount > 0) return {
@@ -48527,8 +50818,9 @@ function expectationsOutcome(expectations, testResults = []) {
 	return {};
 }
 /** The stderr report and exit code of a test-email-rule answer. */
-function testEmailRuleReport(data) {
+function testEmailRuleReport(data, request) {
 	if (!isRecord(data)) return { lines: [] };
+	const name = sampleNamer(request);
 	const result = data;
 	const results = Array.isArray(result.results) ? result.results : [];
 	const summary = isRecord(result.summary) ? result.summary : void 0;
@@ -48538,23 +50830,56 @@ function testEmailRuleReport(data) {
 			...scopeWarningLines(result.scope_warnings),
 			...conditionLines(summary),
 			...questionLines(summary, results),
-			...expectationsLines(result.expectations, results),
+			...expectationsLines(result.expectations, results, name),
 			...notMatchedLines(results, result.expectations)
 		],
-		...expectationsOutcome(result.expectations, results)
+		...expectationsOutcome(result.expectations, results, name)
 	};
 }
-function expectationsCheckLine(check, ruleId) {
+/** A list of numbers from 0, as the API gives sample indexes. */
+function indexList(value) {
+	return Array.isArray(value) ? value.filter((n) => typeof n === "number") : [];
+}
+/**
+* How a rule write names a made-up email its check gives by index, from 0 in
+* the set judged: those this write sends in place of the rule's
+* (expectation_samples), or the rule's saved ones oldest first and then
+* those it adds (add_expectation_samples). One this write sent is "sample
+* N", its number in the samples file --pick took it from (or its place in
+* what was sent); any other is "saved sample N", its place among the rule's.
+* With its label when known. `saved` is the answer's expectation_samples,
+* every one the rule keeps after the write, when it has them.
+*/
+function writtenSampleNamer(body, flags, saved) {
+	const sent = isRecord(body) && Array.isArray(body.expectation_samples) ? body.expectation_samples : null;
+	const added = isRecord(body) && Array.isArray(body.add_expectation_samples) ? body.add_expectation_samples : null;
+	const kept = Array.isArray(saved) ? saved : null;
+	const labelled = (name, sample) => isRecord(sample) && typeof sample.label === "string" && sample.label ? `${name} ("${sample.label}")` : name;
+	return (index) => {
+		if (sent) return labelled(`sample ${sentSampleNumber(index, flags)}`, sent[index]);
+		if (added) {
+			const start = kept ? kept.length - added.length : null;
+			if (start === null) return `made-up email ${index + 1}`;
+			if (index >= start) return labelled(`sample ${sentSampleNumber(index - start, flags)}`, added[index - start]);
+		}
+		return labelled(`saved sample ${index + 1}`, kept?.[index]);
+	};
+}
+function expectationsCheckLine(check, ruleId, name = (index) => `saved sample ${index + 1}`) {
 	if (!isRecord(check)) return void 0;
 	const on = typeof check.version === "number" ? `version ${check.version}` : "the current version";
 	const failed = Array.isArray(check.failed) ? check.failed : [];
 	const undecided = Array.isArray(check.undecided) ? check.undecided : [];
-	if (check.passed && failed.length === 0 && undecided.length === 0) return `Expectations on ${on}: all passed.`;
+	const failedSamples = indexList(check.failed_samples);
+	const undecidedSamples = indexList(check.undecided_samples);
+	if (check.passed && failed.length === 0 && undecided.length === 0 && failedSamples.length === 0 && undecidedSamples.length === 0) return `Expectations on ${on}: all passed.`;
 	const parts = [];
 	if (failed.length > 0) parts.push(`${failed.length} failed (${failed.join(", ")})`);
-	else if (undecided.length > 0) parts.push("none failed");
+	if (failedSamples.length > 0) parts.push(`${plural$1(failedSamples.length, "made-up email", "made-up emails")} failed (${failedSamples.map(name).join(", ")})`);
+	if (failed.length === 0 && failedSamples.length === 0 && (undecided.length > 0 || undecidedSamples.length > 0)) parts.push("none failed");
 	if (undecided.length > 0) parts.push(`${undecided.length} undecided (${undecided.join(", ")})`);
-	const rest = undecided.length > 0 ? ` To decide the rest, run \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.` : "";
+	if (undecidedSamples.length > 0) parts.push(`${plural$1(undecidedSamples.length, "made-up email", "made-up emails")} not judged by this write (${undecidedSamples.map(name).join(", ")})`);
+	const rest = undecided.length > 0 || undecidedSamples.length > 0 ? ` To decide the rest, run \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.` : "";
 	const note = typeof check.note === "string" && check.note.trim() ? ` ${check.note.trim()}` : "";
 	return `Expectations on ${on}: ${parts.length > 0 ? parts.join(", ") : "not passed"}.${rest}${note}`;
 }
@@ -48568,7 +50893,7 @@ const FAIL_ON_EXPECTATIONS_FLAG = "fail-on-expectations";
 * `passed` as false or as null when nothing failed and something is
 * undecided; any other check that did not pass exits 1.
 */
-function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "") {
+function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "", name = (index) => `saved sample ${index + 1}`) {
 	const test = `\`primitive email-rules test-email-rule --rule-id ${ruleId}\``;
 	if (!isRecord(check)) {
 		if (!sentExpectations) return {};
@@ -48580,8 +50905,9 @@ function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "")
 			}
 		};
 	}
-	const failed = Array.isArray(check.failed) ? check.failed : [];
-	const undecided = Array.isArray(check.undecided) ? check.undecided : [];
+	const failed = [...Array.isArray(check.failed) ? check.failed : [], ...indexList(check.failed_samples).map(name)];
+	const undecidedSamples = indexList(check.undecided_samples);
+	const undecided = [...Array.isArray(check.undecided) ? check.undecided : [], ...undecidedSamples.map(name)];
 	if (failed.length > 0) return {
 		exitCode: 1,
 		error: {
@@ -48593,7 +50919,7 @@ function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "")
 		exitCode: 3,
 		error: {
 			code: "expectations_undecided",
-			message: `${saved}${plural$1(undecided.length, "expectation is", "expectations are")} undecided on this write, which judges them without classifying mail or asking the rule's questions: ${undecided.join(", ")}. Test them with ${test}.`
+			message: `${saved}${plural$1(undecided.length, "expectation is", "expectations are")} undecided on this write, which judges them without classifying mail or asking the rule's questions${undecidedSamples.length > 0 ? ", and leaves made-up emails unjudged" : ""}: ${undecided.join(", ")}. Test them with ${test}.`
 		}
 	};
 	if (check.passed !== true) return {
@@ -48611,6 +50937,14 @@ function writtenExpectationsOutcome(check, sentExpectations, ruleId, saved = "")
 * rule active, and refuses with these same codes, saving nothing.
 */
 const SAVED_UNJUDGED = "The write was saved: the server judges a write before saving only when it saves a version or turns the rule active, so not this one. ";
+/** What a written do_not_share rule's report says first. */
+const BLOCKS_SHARING = "This rule blocks sharing (kind do_not_share): while it is active, no rule shares an email it matches.";
+/** A do_not_share rule's protection_note, as a line, or undefined. */
+function protectionLine(rule) {
+	if (!isRecord(rule)) return void 0;
+	const note = rule.protection_note;
+	return typeof note === "string" && note.trim() ? `Protection: ${note.trim()}` : void 0;
+}
 /** What a restore_version write saved, as its answer says. */
 function restoredLine(restored, currentVersion) {
 	if (!isRecord(restored) || typeof restored.version !== "number") return void 0;
@@ -48647,21 +50981,31 @@ function writtenEmailRuleReport(data, request) {
 	const rule = data;
 	const ruleId = typeof rule.id === "string" ? rule.id : "<rule-id>";
 	const lines = scopeWarningLines(rule.scope_warnings);
-	if (rule.kind === "do_not_share") lines.unshift(`This rule blocks sharing (kind do_not_share): while it is active, no rule shares an email it matches.${typeof rule.state === "string" && rule.state !== "active" ? " It blocks nothing until it is active." : ""}`);
+	if (rule.kind === "do_not_share") {
+		const note = protectionLine(rule);
+		lines.unshift(...note ? [BLOCKS_SHARING, note] : [`${BLOCKS_SHARING}${typeof rule.state === "string" && rule.state !== "active" ? " It blocks nothing until it is active." : ""}`]);
+	}
 	const restored = restoredLine(rule.restored_from, rule.current_version);
 	if (restored) lines.push(restored);
 	const reach = affectsLine(rule.affects);
 	if (reach) lines.push(reach);
-	const sentExpectations = isRecord(request.body) && isRecord(request.body.expectations);
-	const checked = expectationsCheckLine(rule.expectations_check, ruleId);
+	const sentExpectations = sentExpectationsIn(request.body);
+	const name = writtenSampleNamer(request.body, request.flags, rule.expectation_samples);
+	const checked = expectationsCheckLine(rule.expectations_check, ruleId, name);
 	if (checked) lines.push(checked);
 	else if (sentExpectations) lines.push(`Expectations were not checked on this write. Test them with \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.`);
 	if (request.flags?.["fail-on-expectations"] !== true) return { lines };
 	return {
 		lines,
-		...writtenExpectationsOutcome(rule.expectations_check, sentExpectations, ruleId, isUpdate(request) ? SAVED_UNJUDGED : "")
+		...writtenExpectationsOutcome(rule.expectations_check, sentExpectations, ruleId, isUpdate(request) ? SAVED_UNJUDGED : "", name)
 	};
 }
+/** Whether a rule write sent expectations: emails by id, or made-up emails to save or add. */
+function sentExpectationsIn(body) {
+	if (!isRecord(body)) return false;
+	const some = (value) => Array.isArray(value) && value.length > 0;
+	return isRecord(body.expectations) || some(body.expectation_samples) || some(body.add_expectation_samples);
+}
 /** Whether a rule write is an update: it names the rule in its path. */
 function isUpdate(request) {
 	return typeof request.path?.id === "string";
@@ -48673,7 +51017,7 @@ function isUpdate(request) {
 */
 function writtenFallbackExitCode(data, request) {
 	if (request.flags["fail-on-expectations"] !== true) return void 0;
-	return writtenExpectationsOutcome(isRecord(data) ? data.expectations_check : void 0, isRecord(request.body) && isRecord(request.body.expectations), "<rule-id>").exitCode;
+	return writtenExpectationsOutcome(isRecord(data) ? data.expectations_check : void 0, sentExpectationsIn(request.body), "<rule-id>").exitCode;
 }
 /** The stderr report of get-email-rule-scope. */
 function emailRuleScopeReport(data) {
@@ -48740,10 +51084,10 @@ function readAgain(id) {
 * The hint for update-email-rule's refusals: an email_rule_conflict by its
 * details.reason (version_moved, revision_moved, expectations_moved,
 * rule_changed), and the expectations guard's expectations_failed,
-* expectations_undecided and no_expectations. Nothing was saved in any of
-* them.
+* expectations_undecided, expectations_unreadable and no_expectations.
+* Nothing was saved in any of them.
 */
-function updateEmailRuleErrorHint(code, payload, ruleId, body) {
+function updateEmailRuleErrorHint(code, payload, ruleId, body, flags) {
 	const id = typeof ruleId === "string" && ruleId ? ruleId : "<rule-id>";
 	const details = errorDetails(payload);
 	const guarded = isRecord(body) && body.if_expectations_pass === true;
@@ -48761,10 +51105,50 @@ function updateEmailRuleErrorHint(code, payload, ruleId, body) {
 		const check = isRecord(details.expectations_check) ? details.expectations_check : {};
 		const failed = Array.isArray(check.failed) ? check.failed : [];
 		const undecided = Array.isArray(check.undecided) ? check.undecided : [];
-		const parts = [...failed.length > 0 ? [`failed: ${failed.join(", ")}`] : [], ...undecided.length > 0 ? [`undecided: ${undecided.join(", ")}`] : []];
-		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved.${parts.length > 0 ? ` Expectations ${parts.join("; ")}.` : ""}${code === "expectations_failed" ? "" : ` ${UNDECIDED_NEXT_STEP[String(details.reason)] ?? UNDECIDED_NEXT_STEP.none}`} The command exits ${updateEmailRuleErrorExitCode(payload) ?? 1}.`;
+		const name = writtenSampleNamer(body, flags);
+		const failedAll = [...failed, ...indexList(check.failed_samples).map(name)];
+		const undecidedSamples = indexList(check.undecided_samples);
+		const undecidedAll = [...undecided, ...undecidedSamples.map(name)];
+		const parts = [...failedAll.length > 0 ? [`failed: ${failedAll.join(", ")}`] : [], ...undecidedAll.length > 0 ? [`undecided: ${undecidedAll.join(", ")}`] : []];
+		const addedOrder = isRecord(body) && Array.isArray(body.add_expectation_samples) && indexList(check.failed_samples).length + undecidedSamples.length > 0 ? " Made-up emails are numbered from 1: the rule's saved ones first, then those this write adds." : "";
+		const which = parts.length > 0 ? ` Expectations ${parts.join("; ")}.${addedOrder}` : "";
+		const reason = String(details.reason);
+		const samplesMayStay = undecidedSamplesMayStay(undecidedSamples.length, reason);
+		const byReason = reason !== "none" && Object.hasOwn(UNDECIDED_NEXT_STEP, reason) ? UNDECIDED_NEXT_STEP[reason] : UNDECIDED_NEXT_STEP.none;
+		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved.${which}${code === "expectations_failed" ? "" : samplesMayStay ? `${undecided.length > 0 ? ` ${byReason}` : ""} ${UNDECIDED_SAMPLES_NEXT_STEP} ${refusedSampleTest(body, id)}` : ` ${byReason}`} The command exits ${updateEmailRuleErrorExitCode(payload) ?? 1}.`;
 	}
-	if (code === "no_expectations") return "Hint: nothing was saved. Give the rule expectations with --expectations-file (in this write or before it), or send the write without if_expectations_pass (--fail-on-expectations or --if-expectations-pass).";
+	if (code === "expectations_unreadable") {
+		const unreadable = Array.isArray(details.unreadable) ? details.unreadable.filter((entry) => entry !== null && entry !== void 0 && entry !== "").map(String) : [];
+		const one = unreadable.length === 1;
+		const named = unreadable.length > 0 ? `: ${unreadable.join(", ")}` : "";
+		const them = one ? "it" : "them";
+		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved. ${one ? "An expectation names an email" : "Expectations name emails"} this rule cannot read (deleted, or outside its scope or its author's mail)${named}. Sending the write again will not decide ${them}: send --expectations-file without ${them}, or an evaluation_scope that reads ${them}. The command exits 1.`;
+	}
+	if (code === "no_expectations") return "Hint: nothing was saved. Give the rule expectations with --expectations-file or made-up emails with --expectation-samples-file or --add-expectation-samples-file (in this write or before it), or send the write without if_expectations_pass (--fail-on-expectations or --if-expectations-pass).";
+}
+/** The reasons a guard's undecided judgment can be decided by sending the write again. */
+const RETRYABLE_REASONS = /* @__PURE__ */ new Set([
+	"deadline",
+	"error",
+	"client_gone"
+]);
+/**
+* A made-up email can stay undecided: one that reads a spam score it does
+* not carry, or whose classification failed or left out a fact the rule
+* needs, decides the same way every time.
+*/
+const UNDECIDED_SAMPLES_NEXT_STEP = "A made-up email undecided for no reason given may stay so (a spam score it does not carry, a fact its classification left out, or a failed classification), so sending the write again may not decide it.";
+/**
+* How to see why a refused write's made-up emails are undecided: only
+* test-email-rule-on-sample answers with what a made-up email lacked. Test
+* the tree this write sent (or the version it restores), else the rule, on
+* each. Nothing was saved, so a test by rule id would see neither.
+*/
+function refusedSampleTest(body, ruleId) {
+	const onSample = "`primitive email-rules test-email-rule-on-sample`";
+	if (isRecord(body) && isRecord(body.tree)) return `To see why, test the tree this write sent on each with ${onSample}.`;
+	if (isRecord(body) && typeof body.restore_version === "number") return `To see why, test version ${body.restore_version}'s tree (\`primitive email-rules list-email-rule-versions ${ruleId} --versions ${body.restore_version}\`) on each with ${onSample}.`;
+	return `To see why, test rule ${ruleId} on each with ${onSample}${isRecord(body) && Array.isArray(body.expectation_samples) ? "" : ` (\`primitive email-rules get-email-rule ${ruleId}\` lists its saved ones)`}.`;
 }
 /** What to do about an undecided judgment, by details.reason ("none": no reason given). */
 const UNDECIDED_NEXT_STEP = {
@@ -48776,21 +51160,34 @@ const UNDECIDED_NEXT_STEP = {
 };
 /**
 * update-email-rule's exit code for the expectations guard's refusals: 1 when
-* one failed, or when they cannot be decided by trying again (the rule cannot
-* run as its author); 3 when trying again later can decide them.
+* one failed, or when they may not be decided by trying again (an expectation
+* names an email the rule cannot read, the rule cannot run as its author, or
+* a made-up email is undecided for no reason the answer gives); 3 when trying
+* again later can decide them.
 */
 function updateEmailRuleErrorExitCode(payload) {
 	const code = isRecord(payload) ? payload.code : void 0;
-	if (code === "expectations_failed") return 1;
+	if (code === "expectations_failed" || code === "expectations_unreadable") return 1;
 	if (code !== "expectations_undecided") return void 0;
-	return errorDetails(payload).reason === "author_unresolvable" ? 1 : 3;
+	const details = errorDetails(payload);
+	if (details.reason === "author_unresolvable") return 1;
+	return undecidedSamplesMayStay(indexList((isRecord(details.expectations_check) ? details.expectations_check : {}).undecided_samples).length, String(details.reason)) ? 1 : 3;
+}
+/**
+* Whether a guard's undecided made-up emails may stay undecided: some are,
+* and the answer gives no reason that sending the write again can change
+* (author_unresolvable has its own advice and exit code).
+*/
+function undecidedSamplesMayStay(count, reason) {
+	return count > 0 && !RETRYABLE_REASONS.has(reason) && reason !== "author_unresolvable";
 }
 /** The stderr report of compile-email-rule: how many recent emails it holds for. */
 function compileEmailRuleReport(data) {
 	if (!isRecord(data)) return { lines: [] };
+	const lines = (Array.isArray(data.warnings) ? data.warnings : []).filter((warning) => typeof warning === "string" && warning.trim() !== "").map((warning) => `Warning: ${warning.trim()}`);
 	const breadth = data.breadth;
-	if (!isRecord(breadth) || typeof breadth.checked !== "number" || typeof breadth.matched !== "number") return { lines: [] };
-	return { lines: [`Breadth: its conditions hold for ${breadth.matched} of ${plural$1(breadth.checked, "recent email", "recent emails")} checked in your own mailboxes, whatever scope you save it with.`] };
+	if (isRecord(breadth) && typeof breadth.checked === "number" && typeof breadth.matched === "number") lines.push(`Breadth: its conditions hold for ${breadth.matched} of ${plural$1(breadth.checked, "recent email", "recent emails")} checked in your own mailboxes, whatever scope you save it with.`);
+	return { lines };
 }
 /** The stderr report of get-email-rule: who wrote it, and its revision. */
 function getEmailRuleReport(data) {
@@ -48798,13 +51195,31 @@ function getEmailRuleReport(data) {
 	const lines = [];
 	const author = authorLine(data.author);
 	if (author) lines.push(author);
+	const protection = protectionLine(data);
+	if (protection) lines.push(protection);
 	if (typeof data.revision === "number") lines.push(`Revision ${data.revision}: pass --if-revision ${data.revision} to update-email-rule so a change made since is never replaced unseen.`);
 	return { lines };
 }
+/** The stderr report of list-email-rules: the protective rules that protect nothing yet, or less than they seem. */
+function listEmailRulesReport(data) {
+	const rules = Array.isArray(data) ? data : [];
+	const lines = [];
+	for (const rule of rules) {
+		if (!isRecord(rule)) continue;
+		const note = typeof rule.protection_note === "string" ? rule.protection_note.trim() : "";
+		if (!note) continue;
+		const id = typeof rule.id === "string" ? rule.id : "<rule-id>";
+		const name = typeof rule.name === "string" ? rule.name : "no name";
+		lines.push(`Protection of ${id} (${name}): ${note}`);
+	}
+	return { lines };
+}
 /** create-email-rule's --fail-on-expectations: the exit code follows the check made after saving. */
-const FAIL_ON_EXPECTATIONS_HELP = "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). Without it the command exits 0 whatever the check says.";
+const FAIL_ON_EXPECTATIONS_HELP = "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). A create does not judge made-up emails, so with some it exits 3. Without it the command exits 0 whatever the check says.";
 /** update-email-rule's --fail-on-expectations: the server refuses the write. */
-const UPDATE_FAIL_ON_EXPECTATIONS_HELP = "Refuse the write unless the rule, as this write would leave it, passes its expectations. It sends if_expectations_pass (over any in --body-file or --raw-body), so the server judges a new version, a restored one, a new scope or turning the rule active before saving, and saves nothing when one failed (exit 1), one is undecided (exit 3, or 1 when the rule cannot run as its author) or the rule has none (exit 1). It can take as long as a test of the rule; the command waits for it. Judging needs a credential that reads the mail's content. A write the server does not judge (one changing only expectations, say) is saved, and the exit code then follows the answer's expectations_check, as on create. With --json, a refused write's document holds the API's error alone; a saved write's holds the rule.";
+const UPDATE_FAIL_ON_EXPECTATIONS_HELP = "Refuse the write unless the rule, as this write would leave it, passes its expectations. It sends if_expectations_pass (over any in --body-file or --raw-body), so the server judges a new version, a restored one, a new scope or turning the rule active before saving, on its emails by id and its made-up emails, and saves nothing when one failed (exit 1), one names an email the rule cannot read (exit 1, since sending again never decides it), one is undecided (exit 3, or 1 when the rule cannot run as its author or a made-up email is undecided for no reason the answer gives) or the rule has none (exit 1). It can take as long as a test of the rule; the command waits for it. Judging needs a credential that reads the mail's content. A write the server does not judge (one changing only expectations, say) is saved, and the exit code then follows the answer's expectations_check, as on create. With --json, a refused write's document holds the API's error alone; a saved write's holds the rule.";
+/** What a samples file flag reads. */
+const SAMPLES_FILE_SHAPE = "A JSON file of made-up emails the rule must match or not: an array such as [{\"expected\": \"no_match\", \"label\": \"a personal bill\", \"email\": {...}}], with email as test-email-rule-on-sample takes it (text up to 4,000 characters, at most 10 each of to, cc and attachment_types), like the one generate-look-alikes --samples-file writes, or a generate-look-alikes answer saved as it printed it.";
 const EXPECTATION_FLAG_NOTE = "Replaces any expect in --body-file or --raw-body. The answer reports them in expectations (passed, counts, results) and the exit code follows it; see --help-full.";
 /**
 * update-email-rule's --fail-on-expectations sends if_expectations_pass, over
@@ -48819,6 +51234,15 @@ function expectationsGuardBodyFields(flags) {
 		value: true
 	}];
 }
+/**
+* The stderr report of end-email-rule-share: the answer's note, which says
+* the rule itself is left as it was (ending a share does not turn it off)
+* and, to the member who shared, how to stop it.
+*/
+function endEmailRuleShareReport(data) {
+	const note = isRecord(data) && typeof data.note === "string" ? data.note.trim() : "";
+	return { lines: note ? [note] : [] };
+}
 const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	testEmailRule: {
 		flags: {
@@ -48833,9 +51257,11 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 				exclusive: ["expect-file"]
 			}),
 			"expect-file": Flags.string({
-				description: "A JSON file holding the request's expect, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}. Not with --expect-match or --expect-no-match.",
+				description: "A JSON file holding the emails the request's expect names by id, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}; made-up emails go in --expect-samples-file. Not with --expect-match or --expect-no-match.",
 				exclusive: ["expect-match", "expect-no-match"]
-			})
+			}),
+			[EXPECT_SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expect.samples (at most 20), beside any emails by id; the answer judges each in expectations.samples (index from 0 over those sent), and the report names each by its number in the file. Like any expect, it replaces a saved rule's own expectations and samples for this test. ${EXPECTATION_FLAG_NOTE}` }),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([EXPECT_SAMPLES_FILE_FLAG]) })
 		},
 		bodyFields: expectBodyFields,
 		bodyProperties: ["expect"],
@@ -48848,32 +51274,71 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	createEmailRule: {
 		flags: {
 			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check (passed, decided, failed, undecided); the report test-email-rule answers with is named expectations instead." }),
+			[SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expectation_samples (at most 20), over any in --body-file or --raw-body. A create does not judge them; test-email-rule --rule-id does.` }),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG]) }),
 			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: FAIL_ON_EXPECTATIONS_HELP })
 		},
-		bodyFields: expectationsBodyFields(false),
-		bodyProperties: ["expectations"],
+		bodyFields: (flags) => [...expectationsBodyFields(false)(flags), ...samplesBodyFields(false)(flags)],
+		bodyProperties: ["expectations", "expectation_samples"],
 		fallbackExitCode: writtenFallbackExitCode,
 		report: writtenEmailRuleReport
 	},
 	updateEmailRule: {
 		flags: {
 			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}, replacing its saved expectations; a file holding null removes them. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check (passed, decided, failed, undecided); the report test-email-rule answers with is named expectations instead." }),
+			[SAMPLES_FILE_FLAG]: Flags.string({
+				description: `${SAMPLES_FILE_SHAPE} They replace the rule's saved ones, and a file holding [] removes them. Sets expectation_samples, over any in --body-file or --raw-body. Not with --${ADD_SAMPLES_FILE_FLAG}. The write judges them only with --${FAIL_ON_EXPECTATIONS_FLAG}, and only when it saves a version or turns the rule active.`,
+				exclusive: [ADD_SAMPLES_FILE_FLAG]
+			}),
+			[ADD_SAMPLES_FILE_FLAG]: Flags.string({
+				description: `${SAMPLES_FILE_SHAPE} They are added to the rule's saved ones, 20 at most in all. Sets add_expectation_samples, over any in --body-file or --raw-body. Not with --${SAMPLES_FILE_FLAG}. The write judges them only with --${FAIL_ON_EXPECTATIONS_FLAG}, and only when it saves a version or turns the rule active.`,
+				exclusive: [SAMPLES_FILE_FLAG]
+			}),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG, ADD_SAMPLES_FILE_FLAG]) }),
 			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: UPDATE_FAIL_ON_EXPECTATIONS_HELP })
 		},
-		bodyFields: (flags) => [...expectationsBodyFields(true)(flags), ...expectationsGuardBodyFields(flags)],
-		bodyProperties: ["expectations"],
+		bodyFields: (flags) => [
+			...expectationsBodyFields(true)(flags),
+			...samplesBodyFields(true)(flags),
+			...expectationsGuardBodyFields(flags)
+		],
+		bodyProperties: [
+			"expectations",
+			"expectation_samples",
+			"add_expectation_samples"
+		],
 		errorExitCode: updateEmailRuleErrorExitCode,
 		fallbackExitCode: writtenFallbackExitCode,
 		report: writtenEmailRuleReport
 	},
+	generateLookAlikes: {
+		flags: { [LOOK_ALIKES_SAMPLES_FILE_FLAG]: Flags.string({ description: `Also write the look-alikes to this JSON file as made-up emails the rule must match or not (each keeps its expected: most must not match, and a near case it should take must match), a JSON array numbered from 1 in the order the report prints them. Save the ones you choose with create-email-rule --${SAMPLES_FILE_FLAG}, update-email-rule --${ADD_SAMPLES_FILE_FLAG} or, for a request, accept-email-rule-request --${SAMPLES_FILE_FLAG}, with --pick; test an edited rule on them with test-email-rule --${EXPECT_SAMPLES_FILE_FLAG}. Replaces the file if it exists, once the call succeeds; when no look-alikes came back it leaves the file as it was and exits 1. The numbered report is printed on stderr, and only without --json, which prints exactly one JSON document and nothing on stderr; the answer's look_alikes and this file hold the same emails in the same order, so with --json the file still gives the numbered set to --pick from.` }) },
+		report: lookAlikesReport
+	},
+	acceptEmailRuleRequest: {
+		flags: {
+			[SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expectation_samples (at most 20), over any in --body-file or --raw-body: they are kept on the rule this accept writes, such as the look-alikes of the request, each keeping whether it must match.` }),
+			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG]) })
+		},
+		bodyFields: samplesBodyFields(false),
+		bodyProperties: ["expectation_samples"]
+	},
 	compileEmailRule: {
 		flags: {},
 		report: compileEmailRuleReport
 	},
+	endEmailRuleShare: {
+		flags: {},
+		report: endEmailRuleShareReport
+	},
 	getEmailRule: {
 		flags: {},
 		report: getEmailRuleReport
 	},
+	listEmailRules: {
+		flags: {},
+		report: listEmailRulesReport
+	},
 	getEmailRuleScope: {
 		flags: {},
 		report: emailRuleScopeReport
@@ -51004,7 +53469,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-YQWxPePp.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-Cre9Mt_2.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)
@@ -52111,7 +54576,7 @@ const OPERATION_ERROR_HINTS = {
 	inviteOrganizationMember: (code, body, payload) => inviteRefusalHint(code, body, payload),
 	createEndpoint: (code, body, payload) => createEndpointRuleRequestHint(code, body, payload),
 	updateEndpoint: (code, body, payload) => updateEndpointRuleRequestHint(code, body, payload),
-	updateEmailRule: (code, body, payload, path) => updateEmailRuleErrorHint(code, payload, path?.id, body),
+	updateEmailRule: (code, body, payload, path, flags) => updateEmailRuleErrorHint(code, payload, path?.id, body, flags),
 	verifyDomain: (code, _body, payload) => code === "dns_verification_failed" ? domainVerificationFailedHint(payload) : void 0,
 	addDomain: (code, body) => {
 		if (code === "mail_relay_unavailable") return MAIL_RELAY_UNAVAILABLE_MESSAGE;
@@ -52314,7 +54779,7 @@ function createOperationCommand(operation) {
 				}) : await callOperation();
 				if (result.error) {
 					const errorPayload = extractErrorPayload(result.error);
-					const operationErrorHint = OPERATION_ERROR_HINTS[operation.sdkName]?.(extractErrorCode(errorPayload), body, errorPayload, collectValues(operation.pathParams, parsedFlags, operation.sdkName));
+					const operationErrorHint = OPERATION_ERROR_HINTS[operation.sdkName]?.(extractErrorCode(errorPayload), body, errorPayload, collectValues(operation.pathParams, parsedFlags, operation.sdkName), parsedFlags);
 					writeErrorWithHints(errorPayload, result.response, { codeHint: !(operationErrorHint && OPERATION_ERROR_HINTS_REPLACING_CODE_HINT.has(operation.sdkName)) });
 					if (operationErrorHint) process.stderr.write(`${operationErrorHint}\n`);
 					if (stepUpUrl) process.stderr.write(approveThenRerunHint(stepUpUrl));
@@ -52399,7 +54864,7 @@ function createOperationCommand(operation) {
 						...tail ? { pastFlag: "--since" } : query.cursor !== void 0 ? { pastFlag: "--cursor" } : {},
 						nextCursor: tail ? null : more,
 						caller: tail || more ? null : await readCallerMailFor(auth, apiClient.client)
-					}) : EMPTY_RESULT_HINTS[operation.sdkName];
+					}) : emptyRuleListHint(operation.sdkName, query) ?? EMPTY_RESULT_HINTS[operation.sdkName];
 					if (hint && jsonOutput) summary.push(hint);
 					else if (hint) process.stderr.write(`${hint}\n`);
 				}
@@ -52476,6 +54941,30 @@ const EMPTY_RESULT_HINTS = {
 	listFilters: "(no results) No filter rules configured.",
 	listFunctions: "(no results) No Functions configured yet. Start with `primitive functions templates`, then `primitive functions init --template <template>` and `primitive functions deploy --name <name> --file <bundle>`."
 };
+/**
+* An empty rule request or share list, read by the filters the call left at
+* their defaults: each list shows only part of what you can see by default
+* (pending requests made to you; live shares made with you), so an empty
+* answer says which flags widen it. Undefined for any other list, when every
+* filter was given, or on a later page (--cursor), which is empty only past
+* the end.
+*/
+function emptyRuleListHint(sdkName, query) {
+	if (query.cursor !== void 0) return void 0;
+	const unset = (name) => query[name] === void 0;
+	const said = (noun, phrase, flags) => phrase === null ? void 0 : `(no results) No ${noun} match. By default this lists only ${phrase}: add \`${flags.join(" ")}\` to widen it.`;
+	if (sdkName === "listEmailRuleRequests") {
+		const box = unset("box");
+		const status = unset("status");
+		return said("requests", box && status ? "pending requests made to you" : box ? "requests made to you" : status ? "pending requests" : null, [...box ? ["--box all"] : [], ...status ? ["--status any"] : []]);
+	}
+	if (sdkName === "listEmailRuleShares") {
+		const box = unset("box");
+		const live = unset("live");
+		return said("shares", box && live ? "live shares made with you" : box ? "shares made with you" : live ? "live shares" : null, [...box ? ["--box all"] : [], ...live ? ["--live any"] : []]);
+	}
+	if (sdkName === "listGivenEmailRuleShares") return said("shares", unset("live") ? "live shares of your mail" : null, ["--live any"]);
+}
 function canonicalizeCliReferences(description) {
 	return description.replaceAll("`primitive emails:latest`", "`primitive emails latest`").replaceAll("`primitive describe emails:get-email | jq '.responseSchema.properties'`", "`primitive describe emails:get | jq '.responseSchema.properties'`");
 }