primcli 3.0.0-preview.7 → 3.0.0-preview.9

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
-import { $ as readEmailInteraction, A as explainPendingMailNotFound, At as cliInvocation, Bt as formatAlreadySentNotice, C as promptLine$2, Ct as sendOutcomeExitCode, D as formatBrowserLoginInstructions, Dt as successfulSendOutcome, E as canOfferCopyHotkey, Et as serializeErrorPayload, F as latestOwnOutbound, Ft as loadSkillLine, G as clearConsumedPendingMail, Gt as classificationFactLines, H as wakeRecipientField, Ht as emptyEmailListHint, I as readThreadContext, It as currentMailSessionKey, J as readPendingMail, Jt as noFactsMessage, K as clearReadPendingMail, Kt as classificationOf, L as sentInThread, Lt as detectAgentRuntime, M as describeWake, N as displayAddress, Nt as generatedAgentName, O as listenForCopyHotkey, Ot as thrownErrorExitCode, P as formatMailWakeLine, Pt as identitySuggestions, Q as interactionNextActions, Qt as ConnectedAgentKeyRequiredError, R as serverMuted, Rt as detectRuntimeSession, S as approveThenRerunHint, St as sendIdentityFields, T as withApproval, Tt as sentHistoryWindowStart, U as wakeRelationship, Ut as mailReach, V as wakeReadCommand, Vt as withFlagSuggestion, W as claimPendingMail, Wt as readCallerMailFor, X as removePendingMail, Xt as ATTACHMENT_WAIT_MAX_MS, Y as recordPendingMail, Yt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Z as interactionHumanLine, Zt as withAttachmentWait, _ as takesStepUp, _n as setKnownCommands, _t as formatPriorRepliesWarning, a as createOperationCommand, an as selectedOrgFromEnv, at as SEND_OUTCOME_HELP, b as STEP_UP_HEADER$1, bt as priorRepliesThatWentOut, c as formatErrorPayload, cn as credentialsFromUserLogin, ct as buildFollowUpCommand, d as isGrantRefusal, dn as revokeUserLogin, dt as classifySendError, en as createAuthenticatedCliApiClient, et as replyExpectation, f as parameterFlagName, fn as roleKeyLabel, ft as deriveSendIdempotencyKey, g as surfaceUnauthorizedHint, gn as sanitizeForTerminal, gt as formatPriorRepliesCheckSkipped, h as runWithTiming, hn as routeWarningLines, ht as formatDeletedEarlierSendNotice, i as TIME_FLAG_DESCRIPTION, in as resolveCliApiRequestConfig, it as MAX_SEND_WAIT_TIMEOUT_MS, j as bareAddress, jt as connectNextSteps, k as openBrowser, l as hasControlCharacter$1, ln as fetchCliOrgs, lt as buildThrownSendFailureEnvelope, m as refusalDetails, mn as switchCurrentOrg, mt as followUpCommandPrefix, n as API_ERROR_CODES, nn as refreshStoredCliCredentials, o as extractErrorCode, on as CliOrgRefusedError, ot as apiResultHttpStatus, p as readTextFileFlag, pn as roleKeyText, pt as excludeSignalReplies, q as pendingMailPath, qt as isEmailId, r as OPERATION_PATH_FLAGS, rn as refuseOrgSelectionForProfile, rt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, s as extractErrorPayload, sn as RESTRICTED_ROLE_NOTE, st as assertValidIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createCliApiClient, tt as replyInteractionWarning, u as headerFlagName, un as isBuiltInRoleKey, ut as checkPriorReplies, v as writeErrorWithHints, vn as operationManifest, vt as formatSendFailureSummary, w as terminalApprovalIo, wt as sendWaitClampNotice, x as STEP_UP_TOKEN_FLAG_DESCRIPTION, xt as reportSendCommandResult, y as BROWSER_FLAG_DESCRIPTION, yt as formatSendRecordFailureSummary, z as serverRelationship, zt as runtimeSessionVariableList } from "../api-command-BXYpylbG.js";
-import { $ as parseFromHeader, $n as startAgentClaim, $t as getSendFrom, A as lateMailReread, An as listWakeSchedules, At as downloadEmailAttachmentArchiveMember, B as ensureSearchReportsReplyState, Bn as resendAgentSignupVerification, Bt as getCreditBalance, C as waitOutRetryAfter, Cn as listRepeatingSends, Ct as createWakeSchedule, D as encodeReceivedAtSearchCursor, Dn as listSentEmails, Dt as deleteRoute, E as cursorFromAcceptedRows, En as listSentAttachmentArchiveMembers, Et as deleteMemory, F as AWAITING_VALUES, Ft as getAccessMode, G as queryUsesAwaiting, Gn as searchEmails, Gt as getFunctionTestRunTrace, H as formatRepliesCell, Hn as rotateKey, Ht as getEmail, I as REPLY_STATE_UNSUPPORTED_CODE, In as redeemCreditCode, It as getAccount, Jn as sendEmail, Jt as getMemory, Kn as searchMemories, Kt as getInboxStatus, L as ReplyStateUnsupportedError, Ln as removeDefaultNetworkMember, Lt as getAgentContactPolicy, M as sinceFromFlags, Mn as pullWebhookEvent, N as sleep$3, Nt as downloadSentAttachmentArchiveMember, O as fetchEmailSearchPage, On as listWakeAuthorizations, Ot as deleteWakeAuthorization, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentByFilename, Q as parseWebhookEvent, Qn as simulateRoute, Qt as getRepeatingSend, R as assertAwaitingFilterRows, Rn as reorderRoutes, S as transientFailure, Sn as listOrganizationPeople, St as createWakeAuthorization, T as collectNewAcceptedEmails, Tn as listRoutes, U as hasReplyState, Un as runWakeSchedule, Ut as getFunction, V as formatAwaitingCell, Vn as revokeCredential, Vt as getDefaultNetworkAgent, W as isAwaitingRejectedError, Wt as getFunctionRouting, X as isEmailReceivedEvent, Xn as setFunctionSecret, Xt as getOutboundStatus, Yn as setFunctionRoute, Yt as getOrgRoutingTopology, Zn as setMemory, Zt as getOwnGrant, _ as describeApiFailure, _n as listFunctionLogs, _t as completeWebhookEvent, a as REPEAT_IDLE_MAX_MINUTES, an as listActivityObjects, ar as updateDefaultNetworkMember, at as automatedRejectedError, b as retryTransient, bn as listKeys, bt as createKey, cn as listAgentNetworks, cr as updateRepeatingSend, d as parseRepeatTick, dn as listDefaultNetworkMembers, dr as updateWakeSchedule, dt as addDefaultNetworkMember, en as getSentEmail, er as startAgentSignup, et as AUTOMATED_FILTER_UNSUPPORTED_CODE, f as preparePresenceAliveEmail, fn as listDomains, fr as verifyAgentClaim, ft as cancelSentEmail, g as WaitDeadlineReached, gn as listEndpoints, gt as cliLogout, hn as listEmails, ht as checkSendability, i as REPEAT_EVERY_MAX_MINUTES, in as leaveOrganization, ir as unsetFunctionRoute, it as assertAutomatedVerdict, j as quoteDslValue, jn as pollCliLogin, jt as downloadEmailAttachmentByFilename, k as filtersFromFlags, kn as listWakeDispatches, kt as deleteWakeSchedule, l as parseInteractionEnvelope, lr as updateRoute, lt as hasAutomatedVerdict, m as repeatStopCommand, mn as listEmailRuleResults, mr as whoami, mt as checkDefaultNetworkContactAdmission, nn as getWakeSchedule, nr as stopRepeatFromEmail, nt as AUTOMATED_VALUES, o as REPEAT_MAX_SENDS_MAX, or as updateFunction, p as prepareSignalEmail, pn as listEmailAttachmentArchiveMembers, pr as verifyAgentSignup, pt as cancelSentEmailByIdempotencyKey, qn as semanticSearch, qt as getKey, rr as testFunction, rt as AutomatedFilterUnsupportedError, s as buildRepeatStopBody, sn as listAgentContacts, sr as updateKey, tn as getThread, tr as startCliLogin, tt as AUTOMATED_FLAG_DESCRIPTION, u as parsePresenceEnvelope, un as listDefaultNetworkAgents, ur as updateWakeAuthorization, ut as isAutomatedRejectedError, vn as listFunctions, vt as createEndpoint, w as SINCE_VALUE_HELP, wn as listRoles, x as retryingOperation, xn as listMailboxAccess, xt as createRoute, y as pauseForTransientFailure, yn as listGroups, yt as createFunction, z as awaitingRejectedError, zn as replyToEmail, zt as getConversation } from "../repeats-Dj_o6c-X-C6tOKAqk.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-Bm59oy4j.js";
+import { $ as readEmailInteraction, A as explainPendingMailNotFound, At as cliInvocation, Bt as formatAlreadySentNotice, C as promptLine$2, Ct as sendOutcomeExitCode, D as formatBrowserLoginInstructions, Dt as successfulSendOutcome, E as canOfferCopyHotkey, Et as serializeErrorPayload, F as latestOwnOutbound, Ft as loadSkillLine, G as clearConsumedPendingMail, Gt as classificationFactLines, H as wakeRecipientField, Ht as emptyEmailListHint, I as readThreadContext, It as currentMailSessionKey, J as readPendingMail, Jt as noFactsMessage, K as clearReadPendingMail, Kt as classificationOf, L as sentInThread, Lt as detectAgentRuntime, M as describeWake, N as displayAddress, Nt as generatedAgentName, O as listenForCopyHotkey, Ot as thrownErrorExitCode, P as formatMailWakeLine, Pt as identitySuggestions, Q as interactionNextActions, Qt as ConnectedAgentKeyRequiredError, R as serverMuted, Rt as detectRuntimeSession, S as approveThenRerunHint, St as sendIdentityFields, T as withApproval, Tt as sentHistoryWindowStart, U as wakeRelationship, Ut as mailReach, V as wakeReadCommand, Vt as withFlagSuggestion, W as claimPendingMail, Wt as readCallerMailFor, X as removePendingMail, Xt as ATTACHMENT_WAIT_MAX_MS, Y as recordPendingMail, Yt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Z as interactionHumanLine, Zt as withAttachmentWait, _ as takesStepUp, _n as setKnownCommands, _t as formatPriorRepliesWarning, a as createOperationCommand, an as selectedOrgFromEnv, at as SEND_OUTCOME_HELP, b as STEP_UP_HEADER$1, bt as priorRepliesThatWentOut, c as formatErrorPayload, cn as credentialsFromUserLogin, ct as buildFollowUpCommand, d as isGrantRefusal, dn as revokeUserLogin, dt as classifySendError, en as createAuthenticatedCliApiClient, et as replyExpectation, f as parameterFlagName, fn as roleKeyLabel, ft as deriveSendIdempotencyKey, g as surfaceUnauthorizedHint, gn as sanitizeForTerminal, gt as formatPriorRepliesCheckSkipped, h as runWithTiming, hn as routeWarningLines, ht as formatDeletedEarlierSendNotice, i as TIME_FLAG_DESCRIPTION, in as resolveCliApiRequestConfig, it as MAX_SEND_WAIT_TIMEOUT_MS, j as bareAddress, jt as connectNextSteps, k as openBrowser, l as hasControlCharacter$1, ln as fetchCliOrgs, lt as buildThrownSendFailureEnvelope, m as refusalDetails, mn as switchCurrentOrg, mt as followUpCommandPrefix, n as API_ERROR_CODES, nn as refreshStoredCliCredentials, o as extractErrorCode, on as CliOrgRefusedError, ot as apiResultHttpStatus, p as readTextFileFlag, pn as roleKeyText, pt as excludeSignalReplies, q as pendingMailPath, qt as isEmailId, r as OPERATION_PATH_FLAGS, rn as refuseOrgSelectionForProfile, rt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, s as extractErrorPayload, sn as RESTRICTED_ROLE_NOTE, st as assertValidIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createCliApiClient, tt as replyInteractionWarning, u as headerFlagName, un as isBuiltInRoleKey, ut as checkPriorReplies, v as writeErrorWithHints, vn as operationManifest, vt as formatSendFailureSummary, w as terminalApprovalIo, wt as sendWaitClampNotice, x as STEP_UP_TOKEN_FLAG_DESCRIPTION, xt as reportSendCommandResult, y as BROWSER_FLAG_DESCRIPTION, yt as formatSendRecordFailureSummary, z as serverRelationship, zt as runtimeSessionVariableList } from "../api-command-DugUWmZH.js";
+import { $ as parseFromHeader, $n as startAgentClaim, $t as getSendFrom, A as lateMailReread, An as listWakeSchedules, At as downloadEmailAttachmentArchiveMember, B as ensureSearchReportsReplyState, Bn as resendAgentSignupVerification, Bt as getCreditBalance, C as waitOutRetryAfter, Cn as listRepeatingSends, Ct as createWakeSchedule, D as encodeReceivedAtSearchCursor, Dn as listSentEmails, Dt as deleteRoute, E as cursorFromAcceptedRows, En as listSentAttachmentArchiveMembers, Et as deleteMemory, F as AWAITING_VALUES, Ft as getAccessMode, G as queryUsesAwaiting, Gn as searchEmails, Gt as getFunctionTestRunTrace, H as formatRepliesCell, Hn as rotateKey, Ht as getEmail, I as REPLY_STATE_UNSUPPORTED_CODE, In as redeemCreditCode, It as getAccount, Jn as sendEmail, Jt as getMemory, Kn as searchMemories, Kt as getInboxStatus, L as ReplyStateUnsupportedError, Ln as removeDefaultNetworkMember, Lt as getAgentContactPolicy, M as sinceFromFlags, Mn as pullWebhookEvent, N as sleep$3, Nt as downloadSentAttachmentArchiveMember, O as fetchEmailSearchPage, On as listWakeAuthorizations, Ot as deleteWakeAuthorization, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentByFilename, Q as parseWebhookEvent, Qn as simulateRoute, Qt as getRepeatingSend, R as assertAwaitingFilterRows, Rn as reorderRoutes, S as transientFailure, Sn as listOrganizationPeople, St as createWakeAuthorization, T as collectNewAcceptedEmails, Tn as listRoutes, U as hasReplyState, Un as runWakeSchedule, Ut as getFunction, V as formatAwaitingCell, Vn as revokeCredential, Vt as getDefaultNetworkAgent, W as isAwaitingRejectedError, Wt as getFunctionRouting, X as isEmailReceivedEvent, Xn as setFunctionSecret, Xt as getOutboundStatus, Yn as setFunctionRoute, Yt as getOrgRoutingTopology, Zn as setMemory, Zt as getOwnGrant, _ as describeApiFailure, _n as listFunctionLogs, _t as completeWebhookEvent, a as REPEAT_IDLE_MAX_MINUTES, an as listActivityObjects, ar as updateDefaultNetworkMember, at as automatedRejectedError, b as retryTransient, bn as listKeys, bt as createKey, cn as listAgentNetworks, cr as updateRepeatingSend, d as parseRepeatTick, dn as listDefaultNetworkMembers, dr as updateWakeSchedule, dt as addDefaultNetworkMember, en as getSentEmail, er as startAgentSignup, et as AUTOMATED_FILTER_UNSUPPORTED_CODE, f as preparePresenceAliveEmail, fn as listDomains, fr as verifyAgentClaim, ft as cancelSentEmail, g as WaitDeadlineReached, gn as listEndpoints, gt as cliLogout, hn as listEmails, ht as checkSendability, i as REPEAT_EVERY_MAX_MINUTES, in as leaveOrganization, ir as unsetFunctionRoute, it as assertAutomatedVerdict, j as quoteDslValue, jn as pollCliLogin, jt as downloadEmailAttachmentByFilename, k as filtersFromFlags, kn as listWakeDispatches, kt as deleteWakeSchedule, l as parseInteractionEnvelope, lr as updateRoute, lt as hasAutomatedVerdict, m as repeatStopCommand, mn as listEmailRuleResults, mr as whoami, mt as checkDefaultNetworkContactAdmission, nn as getWakeSchedule, nr as stopRepeatFromEmail, nt as AUTOMATED_VALUES, o as REPEAT_MAX_SENDS_MAX, or as updateFunction, p as prepareSignalEmail, pn as listEmailAttachmentArchiveMembers, pr as verifyAgentSignup, pt as cancelSentEmailByIdempotencyKey, qn as semanticSearch, qt as getKey, rr as testFunction, rt as AutomatedFilterUnsupportedError, s as buildRepeatStopBody, sn as listAgentContacts, sr as updateKey, tn as getThread, tr as startCliLogin, tt as AUTOMATED_FLAG_DESCRIPTION, u as parsePresenceEnvelope, un as listDefaultNetworkAgents, ur as updateWakeAuthorization, ut as isAutomatedRejectedError, vn as listFunctions, vt as createEndpoint, w as SINCE_VALUE_HELP, wn as listRoles, x as retryingOperation, xn as listMailboxAccess, xt as createRoute, y as pauseForTransientFailure, yn as listGroups, yt as createFunction, z as awaitingRejectedError, zn as replyToEmail, zt as getConversation } from "../repeats-Dj_o6c-X-DqcHvqvW.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-DHqBICIk.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-YQWxPePp.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-GItY2PvL.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-Cre9Mt_2.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-BpUAgX4g.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CvEDx8qQ.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-B66YR0-A.js";
 import { a as thrownErrorBody, i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-ch756TXV.js";
 import { a as backgroundListenStatus, c as runBackgroundListen, d as stopBackgroundListen, f as verifyBackgroundListenTarget, o as backgroundListenToken, r as backgroundListenConfiguration, u as startBackgroundListen } from "../listen-background-DyBYca28.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
@@ -219,6 +219,11 @@ const openapiDocument = {
 			"description": "Rules a member writes in plain English to pick out received mail. The organization needs the email rules feature, and the caller must be a member (their own session, or an OAuth or CLI token that is not narrowed) with mail:read.",
 			"x-openapi-spec": "https://api.primitive.dev/v1/openapi/tags/email-rules"
 		},
+		{
+			"name": "Email Rule Oversight",
+			"description": "The email rules that reach your own mailboxes, whoever wrote them, read-only. The organization needs the email rules feature, and the caller must be a member with mail:read on their own dashboard session or the Primitive CLI, not narrowed.",
+			"x-openapi-spec": "https://api.primitive.dev/v1/openapi/tags/email-rule-oversight"
+		},
 		{
 			"name": "Changes",
 			"description": "One replayable long-poll of what changed (ids and kinds) across mail, sent mail, read state, the agent directory and access, so a client can keep its snapshots current without polling every list.",
@@ -1495,7 +1500,7 @@ const openapiDocument = {
 				},
 				"security": [{ "BearerAuth": [] }],
 				"x-primitive-permission": ["account:manage"],
-				"description": "Update the mutable account settings (such as display name and notification preferences) for the authenticated organization."
+				"description": "Update the organization's spam threshold (spam_threshold) and whether an email's content is discarded once a webhook confirms receipt (discard_content_on_webhook_confirmed), the opt-in POST /emails/{id}/discard-content needs."
 			}
 		},
 		"/account/storage": { "get": {
@@ -5317,7 +5322,7 @@ const openapiDocument = {
 						} }
 					},
 					"503": {
-						"description": "Local receiving is unavailable",
+						"description": "Local receiving is unavailable (pull_unavailable), or the subscription was too busy to claim from in time (service_unavailable): nothing was claimed, so retry the pull after Retry-After",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					}
 				},
@@ -21978,7 +21983,7 @@ const openapiDocument = {
 		"/email-rules/compile": { "post": {
 			"operationId": "compileEmailRule",
 			"summary": "Compile a rule description",
-			"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to five yes/no questions, asked about an email only after its conditions match; they read its subject, its new text and its attachments' file names, never what is inside an attachment, and warnings say when a question mentions attachments. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22107,7 +22112,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids (with the expected emails), 1 to 100 expected emails none in both lists, and a tree that is valid for the column contract. evaluation_scope, scope_selection and kind go only with tree. A saved rule whose current version no longer renders answers details.reason version_not_renderable; email_ids that with its saved expectations name over 200 emails, too_many_emails.",
+					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids (with the expected emails), 1 to 100 expected emails none in both lists (or only expect.samples, up to 20), and a tree that is valid for the column contract. evaluation_scope, scope_selection and kind go only with tree. A saved rule whose current version no longer renders answers details.reason version_not_renderable; email_ids that with its saved expectations name over 200 emails, too_many_emails.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -22178,6 +22183,111 @@ const openapiDocument = {
 				}
 			}]
 		} },
+		"/email-rules/look-alikes": { "post": {
+			"operationId": "generateLookAlikes",
+			"summary": "Write look-alike emails a rule should or should not match",
+			"description": "Writes made-up emails that come close to what a grant rule describes, and reports what the rule decides for each, as test-sample would. Most should not match (expected no_match): business near misses from its senders and topic (kind other: an all-clear, a reply with nothing new, a related document, another subject) and private mail (a personal medical bill, pay for named people, a personal purchase, personal banking or tax). By default a third, rounded down, are near cases it should match (expected match, kind other). failed means the rule decided one against expected. Nothing is stored and no mail is read. Keep them, with their expected, with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/GenerateLookAlikesRequest" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Write look-alike emails a rule should or should not match",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/GenerateLookAlikesResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"400": {
+					"description": "validation_error: give exactly one of tree, rule_id and request_id, and a tree valid for the column contract; details.reason do_not_share for a do-not-share rule, no_address when no sign-in address was found and no to given, version_not_renderable for a saved version or a request's rule that no longer fits.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_scope_not_readable: scope_selection names something you cannot read.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: rule_id names no rule you can see (details.reason rule_not_found), or request_id no rule request you can see (request_not_found).",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"409": {
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree or a request, you). email_rule_request_not_pending: request_id names a request already decided.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"422": {
+					"description": "email_rule_look_alikes_not_written: the model declined, ran out of room or time, or wrote none that fit (details.reason refused, truncated, deadline or invalid).",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				},
+				"503": {
+					"description": "email_rule_compiler_unavailable: the model, or the classifier that decides each, is not available or could not be reached.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				}
+			},
+			"x-primitive-permission": ["mail:read"],
+			"parameters": [{
+				"name": "Idempotency-Key",
+				"in": "header",
+				"required": false,
+				"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 255
+				}
+			}]
+		} },
 		"/email-rules/test-sample": { "post": {
 			"operationId": "testEmailRuleOnSample",
 			"summary": "Test a rule against a made-up email",
@@ -22279,7 +22389,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRule",
 				"summary": "Create a rule",
-				"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated). You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated), or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -22568,7 +22678,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. forbidden with details.reason covering_view_only (your dashboard session or the Primitive CLI only): you may read this rule only because it covers your mailbox; details.covering_view is where (getEmailRuleCoveringMe).",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -22646,7 +22756,7 @@ const openapiDocument = {
 						}
 					},
 					"400": {
-						"description": "validation_error: invalid body or tree (details.errors), too large (too_large), a version that no longer renders (version_not_renderable), or restore_version names the current version (already_current). no_expectations: if_expectations_pass with no expectations to judge; nothing was saved.",
+						"description": "validation_error: invalid body or tree (details.errors), too large (too_large), a version that no longer renders (version_not_renderable), restore_version names the current version (already_current), or over 20 made-up emails (too_many_expectation_samples). no_expectations: if_expectations_pass with no expectations to judge; nothing was saved.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"401": {
@@ -22669,7 +22779,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden (rule_shared): the rule is shared, so only its author or a member manager can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read. grant_forbidden (mail_depth): if_expectations_pass needs content access to mail.",
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden (rule_shared): the rule is shared, so only its author or a member manager can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read. grant_forbidden (mail_depth): if_expectations_pass needs content access to mail when it judges emails by id.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -22677,7 +22787,7 @@ const openapiDocument = {
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"409": {
-						"description": "email_rule_conflict: the rule changed (details.reason version_moved with current_version, revision_moved with current_revision, expectations_moved or rule_changed); read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope. expectations_failed or expectations_undecided (if_expectations_pass): nothing was saved; details carries current_version, state and expectations_check.",
+						"description": "email_rule_conflict: the rule changed (details.reason version_moved with current_version, revision_moved with current_revision, expectations_moved or rule_changed); read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope. expectations_failed, expectations_unreadable (details.unreadable) or expectations_undecided, with if_expectations_pass: nothing was saved; details carries current_version, state and expectations_check.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -22947,7 +23057,7 @@ const openapiDocument = {
 		"/emails/{id}/rule-results": { "get": {
 			"operationId": "listEmailRuleResults",
 			"summary": "List every rule's result on an email",
-			"description": "Every rule you can see and what it decided about this email (matched, not matched, or not run, with what is known), in the words of the version that decided. A matched do_not_share rule keeps rules from sharing the email while it is active; what was shared before then stays shared. Only a caller who can read the email gets an answer. classification is what the classifier read from the email, every fact as rule conditions read it, so you can see why a rule did or did not match. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only); hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -23695,7 +23805,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEmailRuleRequest",
 				"summary": "Read a rule request",
-				"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -24072,7 +24182,7 @@ const openapiDocument = {
 		"/email-rule-requests/{id}/accept": { "post": {
 			"operationId": "acceptEmailRuleRequest",
 			"summary": "Accept a rule request",
-			"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up, or have look-alikes written for it (POST /v1/email-rules/look-alikes with request_id; primitive email-rules generate-look-alikes). Neither stores anything, and neither needs access beyond testing a rule of your own; the accept keeps any you send as expectation_samples on the rule it writes. Made-up emails sent in expectation_samples are kept on the rule this writes, where GET /v1/email-rules/{id} lists them. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24109,7 +24219,7 @@ const openapiDocument = {
 					}] } } }
 				},
 				"400": {
-					"description": "validation_error: a changed rule needs english and tree together, and a tree that is valid for the column contract. The rule as asked is checked the same way, and must be changed first if it no longer passes.",
+					"description": "validation_error: a changed rule needs english and tree together, and a tree that is valid for the column contract. The rule as asked is checked the same way, and must be changed first if it no longer passes. Made-up emails in expectation_samples are checked as on a rule write (at most 20, each within the sample bounds). Nothing is accepted.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -24510,7 +24620,7 @@ const openapiDocument = {
 			"delete": {
 				"operationId": "endEmailRuleShare",
 				"summary": "End a rule share",
-				"description": "Stops sharing. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.",
+				"description": "Stops sharing; the rule itself is left unchanged, as the answer's note says. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -24718,29 +24828,43 @@ const openapiDocument = {
 			},
 			"x-primitive-permission": ["mail:read"]
 		} },
-		"/domains/{id}/agent-authorization": { "get": {
-			"operationId": "getDomainAgentAuthorization",
-			"summary": "Get a domain's Agent Authorization status",
-			"description": "Whether the domain publishes an Agent Authorization (`_agents`) TXT record that lets agents on Primitive email it, read from DNS with the same engine the send path uses (an answer may be up to five minutes old): published (a record authorizes them), published_unauthorized (a record exists but does not), not_set_up (no record, the default) or inconclusive (the lookup could not tell; retry). The domain is one of the organization's, verified or pending; a credential confined to some mailboxes sees only the domains its scope covers. Needs domains:read.",
-			"tags": ["Domains"],
+		"/email-rules/covering-me": { "get": {
+			"operationId": "listEmailRulesCoveringMe",
+			"summary": "List the rules over your mail",
+			"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
-				"name": "id",
-				"in": "path",
-				"required": true,
-				"description": "The domain id from listDomains.",
+				"name": "limit",
+				"in": "query",
+				"required": false,
+				"description": "Rules per page, from 1 to 100; defaults to 50.",
+				"schema": {
+					"default": 50,
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 100
+				}
+			}, {
+				"name": "cursor",
+				"in": "query",
+				"required": false,
+				"description": "meta.cursor from the preceding page. Omit for the first page.",
 				"schema": {
 					"type": "string",
-					"format": "uuid"
+					"maxLength": 200
 				}
 			}],
 			"responses": {
 				"200": {
-					"description": "Get a domain's Agent Authorization status",
+					"description": "List the rules over your mail",
 					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 						"type": "object",
-						"required": ["data"],
-						"properties": { "data": { "$ref": "#/components/schemas/GetDomainAgentAuthorizationResult" } }
+						"required": ["data", "meta"],
+						"properties": {
+							"data": { "$ref": "#/components/schemas/ListEmailRulesCoveringMeResult" },
+							"meta": { "$ref": "#/components/schemas/CursorPageMeta" }
+						}
 					}] } } },
 					"headers": {
 						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
@@ -24750,7 +24874,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: the id is not a domain id.",
+					"description": "invalid_cursor: a cursor this list did not give you (each is sealed to you and your organization); pass meta.cursor unchanged.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -24773,30 +24897,92 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "Authenticated caller lacks permission for the operation",
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
 					"content": { "application/json": {
 						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
 						"example": {
 							"success": false,
 							"error": {
-								"code": "forbidden",
-								"message": "Insufficient permissions"
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
 							}
 						}
 					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rules/covering-me/{id}": { "get": {
+			"operationId": "getEmailRuleCoveringMe",
+			"summary": "Get a rule over your mail",
+			"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"tags": ["Email Rule Oversight"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "The rule id.",
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Get a rule over your mail",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/GetEmailRuleCoveringMeResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
 				},
-				"404": {
-					"description": "Resource not found",
+				"401": {
+					"description": "Invalid or missing API key",
 					"content": { "application/json": {
 						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
 						"example": {
 							"success": false,
 							"error": {
-								"code": "not_found",
-								"message": "Resource not found"
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
 							}
 						}
-					} }
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
 					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
@@ -24822,32 +25008,69 @@ const openapiDocument = {
 					} }
 				}
 			},
-			"x-primitive-permission": ["domains:read"]
+			"x-primitive-permission": ["mail:read"]
 		} },
-		"/managed-inbox/vanity/{name}": { "get": {
-			"operationId": "checkVanityInboxName",
-			"summary": "Check a vanity inbox name",
-			"description": "Whether a name can be claimed for the managed inbox (name.primitive.email): available, taken, reserved (a protected word) or invalid (5 to 30 lowercase letters and digits, starting with a letter). Any plan may check; claiming needs Power. Rate limited per organization together with claims. Needs domains:read.",
-			"tags": ["Domains"],
+		"/email-rules/covering-me/{id}/decisions": { "get": {
+			"operationId": "listEmailRuleDecisionsOnMyMail",
+			"summary": "List what a rule decided about your mail",
+			"description": "What a rule that covers your mailboxes, or decided on your mail, decided about mail at your own mailboxes, newest first: never about anyone else's mail. Each decision is in the words of the version that made it, which can be earlier than the current one: the questions it asked about that email (question_answers) and the columns its conditions read (parts). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
-			"parameters": [{
-				"name": "name",
-				"in": "path",
-				"required": true,
-				"description": "The name to check, without the domain.",
-				"schema": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 64
+			"parameters": [
+				{
+					"name": "id",
+					"in": "path",
+					"required": true,
+					"description": "The rule id.",
+					"schema": {
+						"type": "string",
+						"format": "uuid"
+					}
+				},
+				{
+					"name": "limit",
+					"in": "query",
+					"required": false,
+					"description": "Decisions per page, from 1 to 100; defaults to 50.",
+					"schema": {
+						"default": 50,
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 100
+					}
+				},
+				{
+					"name": "cursor",
+					"in": "query",
+					"required": false,
+					"description": "meta.cursor from the preceding page. Omit for the first page.",
+					"schema": {
+						"type": "string",
+						"maxLength": 200
+					}
+				},
+				{
+					"name": "matched",
+					"in": "query",
+					"required": false,
+					"description": "true for matches only, false for the rest.",
+					"schema": {
+						"description": "Only decisions that matched (true) or did not (false).",
+						"type": "string",
+						"enum": ["true", "false"]
+					}
 				}
-			}],
+			],
 			"responses": {
 				"200": {
-					"description": "Check a vanity inbox name",
+					"description": "List what a rule decided about your mail",
 					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 						"type": "object",
-						"required": ["data"],
-						"properties": { "data": { "$ref": "#/components/schemas/CheckVanityInboxNameResult" } }
+						"required": ["data", "meta"],
+						"properties": {
+							"data": { "$ref": "#/components/schemas/ListEmailRuleDecisionsOnMyMailResult" },
+							"meta": { "$ref": "#/components/schemas/CursorPageMeta" }
+						}
 					}] } } },
 					"headers": {
 						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
@@ -24857,7 +25080,202 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: the name parameter is missing or too long.",
+					"description": "validation_error: a cursor not returned in meta.cursor.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead; details.reason first_party_required means this credential is not your dashboard session or the Primitive CLI. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and what a rule decided is read from what emails say.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/domains/{id}/agent-authorization": { "get": {
+			"operationId": "getDomainAgentAuthorization",
+			"summary": "Get a domain's Agent Authorization status",
+			"description": "Whether the domain publishes an Agent Authorization (`_agents`) TXT record that lets agents on Primitive email it, read from DNS with the same engine the send path uses (an answer may be up to five minutes old): published (a record authorizes them), published_unauthorized (a record exists but does not), not_set_up (no record, the default) or inconclusive (the lookup could not tell; retry). The domain is one of the organization's, verified or pending; a credential confined to some mailboxes sees only the domains its scope covers. Needs domains:read.",
+			"tags": ["Domains"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "The domain id from listDomains.",
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Get a domain's Agent Authorization status",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/GetDomainAgentAuthorizationResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"400": {
+					"description": "validation_error: the id is not a domain id.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "Authenticated caller lacks permission for the operation",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "forbidden",
+								"message": "Insufficient permissions"
+							}
+						}
+					} }
+				},
+				"404": {
+					"description": "Resource not found",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "not_found",
+								"message": "Resource not found"
+							}
+						}
+					} }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["domains:read"]
+		} },
+		"/managed-inbox/vanity/{name}": { "get": {
+			"operationId": "checkVanityInboxName",
+			"summary": "Check a vanity inbox name",
+			"description": "Whether a name can be claimed for the managed inbox (name.primitive.email): available, taken, reserved (a protected word) or invalid (5 to 30 lowercase letters and digits, starting with a letter). Any plan may check; claiming needs Power. Rate limited per organization together with claims. Needs domains:read.",
+			"tags": ["Domains"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "name",
+				"in": "path",
+				"required": true,
+				"description": "The name to check, without the domain.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 64
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Check a vanity inbox name",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/CheckVanityInboxNameResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"400": {
+					"description": "validation_error: the name parameter is missing or too long.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -32268,7 +32686,7 @@ const openapiDocument = {
 			"summary": "Revoke a credential",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true and revoked 0, to a caller who could have revoked it; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
+			"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked by the person who holds it, whatever it reaches, or by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. Revoking an API key also revokes the keys it replaced in its rotation that are still in their overlap and that you may revoke (predecessors_revoked_count; predecessors_left counts the rest), so its webhooks stop at once; the keys that replaced it carry its work on. Revoking a key already revoked does the same for those keys. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from, each saying whether anything still acts for it (still_acting, with the key in acting_key_id) and, for a webhook, whether it is still delivering. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true, to a caller who could have revoked it, and revoked counts only the keys it replaced that were revoked now; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session_or_cli" },
 			"parameters": [{
 				"name": "Primitive-Step-Up",
@@ -33382,7 +33800,7 @@ const openapiDocument = {
 			"summary": "Rotate an API key",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 			"x-primitive-person-only": {
 				"access": "step_up",
 				"step_up_purpose": "keys.create",
@@ -33549,7 +33967,7 @@ const openapiDocument = {
 				"summary": "Change an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. The one exception is suspending a key (suspended true with no other change; expected_grant_ref may accompany it), which the person who holds it may do whatever the key reaches, calling as themself rather than through another app; lifting a suspension is a change like any other. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 				"x-primitive-person-only": {
 					"access": "step_up",
 					"step_up_purpose": "keys.create",
@@ -35310,7 +35728,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "listRoles",
 				"summary": "List roles",
-				"description": "Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Any person (a session or OAuth token); API keys are refused.",
+				"description": "Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Needs members:read (owners, admins, members and roles that grant it); API keys are refused.",
 				"tags": ["Roles and members"],
 				"security": [{ "BearerAuth": [] }],
 				"responses": {
@@ -36111,7 +36529,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getAccessMode",
 				"summary": "Get the mailbox access mode",
-				"description": "Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Any person; API keys are refused.",
+				"description": "Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Needs members:read (owners, admins, members and roles that grant it); API keys are refused.",
 				"tags": ["Roles and members"],
 				"security": [{ "BearerAuth": [] }],
 				"responses": {
@@ -37365,7 +37783,7 @@ const openapiDocument = {
 		"/access-suspensions/{id}/decision": { "post": {
 			"operationId": "decideSuspension",
 			"summary": "Decide a suspension",
-			"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
+			"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it needs the decider to cover it, and so does revoking an API key unless the decider holds it and decides as themself rather than through another app (revoking an uncovered key someone else holds is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
 			"tags": ["Roles and members"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -39289,6 +39707,7 @@ const openapiDocument = {
 									"email_rule_author_unresolvable",
 									"email_rule_compiler_unavailable",
 									"email_rule_conflict",
+									"email_rule_look_alikes_not_written",
 									"email_rule_not_compiled",
 									"email_rule_request_limit",
 									"email_rule_request_not_pending",
@@ -39304,6 +39723,7 @@ const openapiDocument = {
 									"entitlement",
 									"expectations_failed",
 									"expectations_undecided",
+									"expectations_unreadable",
 									"expired",
 									"feature_not_enabled",
 									"fresh_send_not_authorized",
@@ -39430,6 +39850,7 @@ const openapiDocument = {
 									"semantic_search_not_enabled",
 									"send_failed",
 									"sender_not_authorized",
+									"sending_ip_warmup_cap",
 									"sent_email_tail_unavailable",
 									"sent_mail_search_unavailable",
 									"shopping_binding_conflict",
@@ -42764,12 +43185,12 @@ const openapiDocument = {
 					},
 					"hold": {
 						"type": "object",
-						"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+						"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 						"required": ["reason", "since"],
 						"properties": {
 							"reason": {
 								"type": "string",
-								"description": "Open: credential_reuse_hold."
+								"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 							},
 							"since": {
 								"type": ["string", "null"],
@@ -43359,12 +43780,12 @@ const openapiDocument = {
 					},
 					"hold": {
 						"type": "object",
-						"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+						"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 						"required": ["reason", "since"],
 						"properties": {
 							"reason": {
 								"type": "string",
-								"description": "Open: credential_reuse_hold."
+								"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 							},
 							"since": {
 								"type": ["string", "null"],
@@ -43808,12 +44229,12 @@ const openapiDocument = {
 					},
 					"hold": {
 						"type": "object",
-						"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+						"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 						"required": ["reason", "since"],
 						"properties": {
 							"reason": {
 								"type": "string",
-								"description": "Open: credential_reuse_hold."
+								"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 							},
 							"since": {
 								"type": ["string", "null"],
@@ -46164,7 +46585,10 @@ const openapiDocument = {
 						"type": "string",
 						"format": "uuid"
 					},
-					"endpoint_url": { "type": "string" },
+					"endpoint_url": {
+						"type": "string",
+						"description": "Where it was sent: a webhook's scheme and host, followed by \"/... (path and query hidden)\" when its URL has more (GET /endpoints/{id} has the whole URL), function://<id> for a Function, or pull: for a pull subscription."
+					},
 					"status": {
 						"type": "string",
 						"enum": [
@@ -46217,7 +46641,7 @@ const openapiDocument = {
 					},
 					"response_body": {
 						"type": ["string", "null"],
-						"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent."
+						"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent. Null for a redirect (3xx), whose body repeats its Location; otherwise the webhook URL's path and query are hidden wherever it repeats them."
 					},
 					"latest_attempt": {
 						"type": "boolean",
@@ -49427,7 +49851,7 @@ const openapiDocument = {
 					"questions": {
 						"type": "array",
 						"items": { "type": "string" },
-						"description": "Yes/no questions asked once the conditions match; all must be yes."
+						"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 					}
 				},
 				"required": [
@@ -49491,7 +49915,7 @@ const openapiDocument = {
 					"warnings": {
 						"type": "array",
 						"items": { "type": "string" },
-						"description": "Parts of the description the column contract cannot express, and how the rule handles them. When the rule reads automated or from_mailing_list, it also has a note on what that column reads and what it misses. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
+						"description": "Parts of the description the column contract cannot express, and how the rule handles them. It also has notes on reading automated, from_mailing_list or sender_relationship, a sender address the description does not give, and a grant worded as a prohibition. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
 					},
 					"compiled_by": {
 						"type": "string",
@@ -49552,6 +49976,67 @@ const openapiDocument = {
 					"message"
 				]
 			},
+			"EmailRuleSampleJudgment": {
+				"type": "object",
+				"properties": {
+					"index": {
+						"type": "integer",
+						"minimum": 0
+					},
+					"sample_id": {
+						"type": ["string", "null"],
+						"format": "uuid"
+					},
+					"label": { "type": ["string", "null"] },
+					"expected": {
+						"type": "string",
+						"enum": ["match", "no_match"]
+					},
+					"outcome": {
+						"type": "string",
+						"enum": [
+							"matched",
+							"near_miss",
+							"no_match",
+							"not_decided"
+						]
+					},
+					"status": {
+						"type": "string",
+						"enum": [
+							"passed",
+							"failed",
+							"undecided"
+						]
+					},
+					"question_answers": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"question": { "type": "string" },
+								"answer": { "type": ["boolean", "null"] },
+								"probability": { "type": ["number", "null"] },
+								"error_class": { "type": "string" }
+							},
+							"required": [
+								"question",
+								"answer",
+								"probability"
+							]
+						}
+					}
+				},
+				"required": [
+					"index",
+					"sample_id",
+					"label",
+					"expected",
+					"outcome",
+					"status",
+					"question_answers"
+				]
+			},
 			"EmailRuleTreeInput": {
 				"type": "object",
 				"properties": {
@@ -49570,7 +50055,7 @@ const openapiDocument = {
 						"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 					},
 					"questions": {
-						"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+						"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 						"type": "array",
 						"items": { "type": "string" }
 					}
@@ -49609,6 +50094,107 @@ const openapiDocument = {
 				"additionalProperties": false,
 				"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
 			},
+			"EmailRuleExpectationSampleInput": {
+				"type": "object",
+				"properties": {
+					"expected": {
+						"type": "string",
+						"enum": ["match", "no_match"]
+					},
+					"label": {
+						"type": ["string", "null"],
+						"minLength": 1,
+						"maxLength": 200,
+						"pattern": "^[^\\u0000]*$",
+						"description": "What the email stands for, such as a personal medical bill."
+					},
+					"email": { "$ref": "#/components/schemas/EmailRuleSavedSampleEmail" },
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"created_at": { "type": "string" }
+				},
+				"required": ["expected", "email"],
+				"additionalProperties": false
+			},
+			"EmailRuleSavedSampleEmail": {
+				"type": "object",
+				"properties": {
+					"from": {
+						"type": "object",
+						"properties": {
+							"address": {
+								"type": "string",
+								"maxLength": 254,
+								"format": "email",
+								"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+							},
+							"name": {
+								"type": "string",
+								"maxLength": 200,
+								"pattern": "^[^\\u0000]*$"
+							}
+						},
+						"required": ["address"]
+					},
+					"to": {
+						"minItems": 1,
+						"maxItems": 10,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"maxLength": 254,
+							"format": "email",
+							"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+						}
+					},
+					"cc": {
+						"maxItems": 10,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"maxLength": 254,
+							"format": "email",
+							"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+						}
+					},
+					"subject": {
+						"type": "string",
+						"maxLength": 998,
+						"pattern": "^[^\\u0000]*$"
+					},
+					"text": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 4e3,
+						"pattern": "^[^\\u0000]*$"
+					},
+					"attachment_types": {
+						"maxItems": 10,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 255,
+							"pattern": "^[^\\u0000]*$"
+						}
+					},
+					"automated": { "type": "boolean" },
+					"from_mailing_list": { "type": "boolean" },
+					"spam_score": {
+						"type": "number",
+						"minimum": -1e3,
+						"maximum": 1e3
+					}
+				},
+				"required": [
+					"from",
+					"to",
+					"text"
+				],
+				"description": "A made-up email, as POST /email-rules/test-sample takes it."
+			},
 			"TestEmailRuleRequest": {
 				"type": "object",
 				"properties": {
@@ -49668,10 +50254,15 @@ const openapiDocument = {
 									"type": "string",
 									"format": "uuid"
 								}
+							},
+							"samples": {
+								"maxItems": 20,
+								"type": "array",
+								"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" }
 							}
 						},
 						"additionalProperties": false,
-						"description": "Emails the rule must match and must not, at most 100 in all, always tested whatever their age: added to email_ids, or to the recent window, which gives up a place for each. The answer's expectations judge each."
+						"description": "Emails the rule must match and must not (at most 100), always tested whatever their age, and made-up emails (samples, at most 20). Given, it replaces a saved rule's own."
 					}
 				},
 				"additionalProperties": false
@@ -49818,7 +50409,7 @@ const openapiDocument = {
 										"skipped",
 										"not_found"
 									],
-									"description": "near_miss: Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). skipped: an email you can see that cannot be tested; skipped_reason says why. not_found: no such email, or not one the rule can read (or not settled, or awaiting sender authentication)."
+									"description": "near_miss: Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). skipped: an email you can see that cannot be tested; skipped_reason says why. not_found: no such email, or not one the rule can read (or not settled, or awaiting sender authentication)."
 								},
 								"received_at": {
 									"type": "string",
@@ -50028,7 +50619,7 @@ const openapiDocument = {
 						"items": { "$ref": "#/components/schemas/EmailRuleScopeWarning" }
 					},
 					"expectations": {
-						"description": "Present when expect was given, or for a saved rule with saved expectations.",
+						"description": "Present when expect was given, or for a saved rule with saved expectations or made-up emails.",
 						"type": "object",
 						"properties": {
 							"passed": {
@@ -50098,6 +50689,11 @@ const openapiDocument = {
 									]
 								},
 								"description": "match first, then no_match, each in the order given (saved expectations by email id)."
+							},
+							"samples": {
+								"description": "Made-up emails judged (expect.samples, or a saved rule's), in order; counts include them.",
+								"type": "array",
+								"items": { "$ref": "#/components/schemas/EmailRuleSampleJudgment" }
 							}
 						},
 						"required": [
@@ -50116,6 +50712,250 @@ const openapiDocument = {
 					"results"
 				]
 			},
+			"EmailRuleLookAlike": {
+				"type": "object",
+				"properties": {
+					"kind": {
+						"type": "string",
+						"enum": [
+							"medical",
+							"payroll",
+							"personal_purchase",
+							"bank_tax",
+							"other"
+						]
+					},
+					"expected": {
+						"type": "string",
+						"enum": ["match", "no_match"],
+						"description": "match: a near case the rule should match; no_match: one it should not."
+					},
+					"why": {
+						"type": "string",
+						"description": "Why the rule should, or should not, match it."
+					},
+					"email": {
+						"type": "object",
+						"properties": {
+							"from": {
+								"type": "object",
+								"properties": {
+									"address": { "type": "string" },
+									"name": { "type": "string" }
+								},
+								"required": ["address"]
+							},
+							"to": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"cc": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"subject": { "type": "string" },
+							"text": { "type": "string" },
+							"attachment_types": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"automated": { "type": "boolean" },
+							"from_mailing_list": { "type": "boolean" }
+						},
+						"required": [
+							"from",
+							"to",
+							"cc",
+							"subject",
+							"text",
+							"attachment_types",
+							"automated",
+							"from_mailing_list"
+						],
+						"description": "A made-up email, as test-sample takes it."
+					},
+					"outcome": {
+						"type": "string",
+						"enum": [
+							"matched",
+							"near_miss",
+							"no_match",
+							"not_decided"
+						]
+					},
+					"status": {
+						"type": "string",
+						"enum": [
+							"passed",
+							"failed",
+							"undecided"
+						],
+						"description": "failed: the rule decided it against expected (shared one it should not, or missed one it should match). undecided: the rule reads a spam score, which it cannot carry, whatever it decided; or not matched on something it could not decide (not classified, a fact or answer missing, or not reached in time)."
+					},
+					"question_answers": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"question": { "type": "string" },
+								"answer": { "type": ["boolean", "null"] },
+								"probability": { "type": ["number", "null"] },
+								"error_class": { "type": "string" }
+							},
+							"required": [
+								"question",
+								"answer",
+								"probability"
+							]
+						}
+					}
+				},
+				"required": [
+					"kind",
+					"expected",
+					"why",
+					"email",
+					"outcome",
+					"status",
+					"question_answers"
+				]
+			},
+			"GenerateLookAlikesRequest": {
+				"type": "object",
+				"properties": {
+					"tree": {
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give tree or rule_id, not both.",
+						"$ref": "#/components/schemas/EmailRuleTreeInput"
+					},
+					"english": {
+						"description": "What the tree is meant to match; without it, the tree is described in words.",
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 2e3
+					},
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those mail:share_own lets you share). author: all you can read, inboxes added later included. selected: what scope_selection names."
+					},
+					"scope_selection": { "$ref": "#/components/schemas/EmailRuleScopeSelection" },
+					"rule_id": {
+						"description": "A saved rule you can see: its current version and words.",
+						"type": "string",
+						"format": "uuid"
+					},
+					"request_id": {
+						"description": "A rule request you can see: its rule as asked.",
+						"type": "string",
+						"format": "uuid"
+					},
+					"kind": {
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
+					"count": {
+						"description": "How many, 1 to 8; 6 by default.",
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 8
+					},
+					"kinds": {
+						"description": "Which kinds, taken in turn, all expected no_match; other is a business near miss. Left out, a default mix.",
+						"minItems": 1,
+						"maxItems": 5,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"enum": [
+								"medical",
+								"payroll",
+								"personal_purchase",
+								"bank_tax",
+								"other"
+							]
+						}
+					},
+					"to": {
+						"description": "The mailbox they arrive in; by default the first address (alphabetically) a selected scope names that a made-up email can be sent to, preferring one the author still reads; else the rule author's (a request's target's) sign-in address when you may see it, else yours.",
+						"type": "string",
+						"maxLength": 254,
+						"format": "email",
+						"pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+					}
+				},
+				"additionalProperties": false
+			},
+			"GenerateLookAlikesResult": {
+				"type": "object",
+				"properties": {
+					"rule": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": ["string", "null"],
+								"format": "uuid"
+							},
+							"version": {
+								"type": ["integer", "null"],
+								"exclusiveMinimum": 0
+							},
+							"vocabulary": { "type": "string" }
+						},
+						"required": [
+							"id",
+							"version",
+							"vocabulary"
+						]
+					},
+					"look_alikes": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleLookAlike" }
+					},
+					"counts": {
+						"type": "object",
+						"properties": {
+							"passed": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"failed": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"undecided": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"dropped": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Asked for but not returned: not written, outside the sample bounds, or of a kind and expected not asked for."
+							}
+						},
+						"required": [
+							"passed",
+							"failed",
+							"undecided",
+							"dropped"
+						]
+					},
+					"note": {
+						"type": "string",
+						"description": "That the emails are made up and were never sent or stored."
+					}
+				},
+				"required": [
+					"rule",
+					"look_alikes",
+					"counts",
+					"note"
+				]
+			},
 			"TestEmailRuleOnSampleRequest": {
 				"type": "object",
 				"properties": {
@@ -50266,7 +51106,7 @@ const openapiDocument = {
 							"near_miss",
 							"no_match"
 						],
-						"description": "near_miss: Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false)."
+						"description": "near_miss: Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false)."
 					},
 					"parts": {
 						"type": "array",
@@ -50407,6 +51247,10 @@ const openapiDocument = {
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -50458,8 +51302,13 @@ const openapiDocument = {
 						"type": "array",
 						"items": { "$ref": "#/components/schemas/EmailRuleScopeWarning" }
 					},
+					"expectation_samples": {
+						"description": "Its saved made-up emails, when this write set or added some.",
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSample" }
+					},
 					"expectations_check": {
-						"description": "After a write that saved a version or changed its expectations, if it has some: them, judged on that version from stored classifications without asking its questions. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed). Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
+						"description": "After a write that saved a version or changed its expectations or made-up emails, if it has some: the emails by id judged on that version from stored classifications without asking its questions, and any made-up emails listed as undecided. Undecided: one that needs answers not yet kept for that version, is unclassified, skipped or not reached, or that its author does not read. Absent when it could not be judged (the rule changed again, its author cannot be resolved, your access shows headers only, it could not finish in time, or the check failed), and after a write that changed only made-up emails on a rule with emails by id. Test by rule_id for the rest. With if_expectations_pass, the judgment made before the save, which passed.",
 						"type": "object",
 						"properties": {
 							"version": {
@@ -50471,7 +51320,7 @@ const openapiDocument = {
 								"type": ["boolean", "null"]
 							},
 							"decided": {
-								"description": "Whether every expectation was judged (undecided is empty). Absent from a server that predates it.",
+								"description": "Whether every expectation was judged (undecided and undecided_samples are empty). Absent from a server that predates it.",
 								"type": "boolean"
 							},
 							"failed": {
@@ -50488,8 +51337,24 @@ const openapiDocument = {
 									"format": "uuid"
 								}
 							},
+							"failed_samples": {
+								"description": "Made-up emails that failed, by index in the set judged (saved oldest first, then added; or as sent).",
+								"type": "array",
+								"items": {
+									"type": "integer",
+									"minimum": 0
+								}
+							},
+							"undecided_samples": {
+								"description": "Made-up emails not decided, by index. Only a write sent with if_expectations_pass that saves a version or activates the rule judges them.",
+								"type": "array",
+								"items": {
+									"type": "integer",
+									"minimum": 0
+								}
+							},
 							"note": {
-								"description": "On an update that saved a version that did not pass: that it was saved anyway, is current, and whether it is live.",
+								"description": "On an update that saved a version that did not pass, or a do_not_share rule created active: that it was saved anyway, is current, and whether it is live.",
 								"type": "string"
 							}
 						},
@@ -50640,6 +51505,32 @@ const openapiDocument = {
 					"created_at"
 				]
 			},
+			"EmailRuleExpectationSample": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"expected": {
+						"type": "string",
+						"enum": ["match", "no_match"]
+					},
+					"label": { "type": ["string", "null"] },
+					"email": { "$ref": "#/components/schemas/EmailRuleSavedSampleEmail" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"expected",
+					"label",
+					"email",
+					"created_at"
+				]
+			},
 			"CreateEmailRuleRequest": {
 				"type": "object",
 				"properties": {
@@ -50655,9 +51546,13 @@ const openapiDocument = {
 						"enum": ["grant", "do_not_share"]
 					},
 					"state": {
-						"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated.",
+						"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated; active only for a do_not_share rule.",
 						"type": "string",
-						"enum": ["draft", "observe"]
+						"enum": [
+							"draft",
+							"observe",
+							"active"
+						]
 					},
 					"evaluation_scope": {
 						"type": "string",
@@ -50692,6 +51587,13 @@ const openapiDocument = {
 						"additionalProperties": false,
 						"description": "Emails it must match and must not (at most 100): a test by rule_id judges them unless expect is given, and each version it saves is checked against them."
 					},
+					"expectation_samples": {
+						"description": "Made-up emails it must match or not (at most 20).",
+						"minItems": 1,
+						"maxItems": 20,
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" }
+					},
 					"english": {
 						"type": "string",
 						"minLength": 1,
@@ -50768,6 +51670,10 @@ const openapiDocument = {
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -50862,6 +51768,10 @@ const openapiDocument = {
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -50928,6 +51838,11 @@ const openapiDocument = {
 							}
 						},
 						"required": ["match", "no_match"]
+					},
+					"expectation_samples": {
+						"description": "Its saved made-up emails, oldest first.",
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSample" }
 					}
 				},
 				"required": [
@@ -51045,6 +51960,19 @@ const openapiDocument = {
 						"additionalProperties": false,
 						"description": "Replaces its saved expectations (author only); null removes them."
 					},
+					"expectation_samples": {
+						"maxItems": 20,
+						"type": ["array", "null"],
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" },
+						"description": "Replaces its saved made-up emails (author only); null or [] removes them."
+					},
+					"add_expectation_samples": {
+						"description": "Adds made-up emails to those saved (author only), up to 20 in all.",
+						"minItems": 1,
+						"maxItems": 20,
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" }
+					},
 					"if_revision": {
 						"description": "The revision you read: if the rule was updated since, nothing is saved (409 email_rule_conflict, revision_moved).",
 						"type": "integer",
@@ -51052,7 +51980,7 @@ const openapiDocument = {
 						"maximum": 2147483647
 					},
 					"if_expectations_pass": {
-						"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; undecided: 409 expectations_undecided (both with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
+						"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; on emails the rule cannot read: 409 expectations_unreadable; undecided: 409 expectations_undecided (each with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
 						"type": "boolean"
 					},
 					"restore_version": {
@@ -51152,7 +52080,7 @@ const openapiDocument = {
 						"matched": { "type": "boolean" },
 						"near_miss": {
 							"type": "boolean",
-							"description": "Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). Decisions recorded under the earlier definition counted an exclusion too."
+							"description": "Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). Decisions recorded under the earlier definition counted an exclusion too."
 						},
 						"parts": {
 							"type": "array",
@@ -51210,6 +52138,28 @@ const openapiDocument = {
 					]
 				}
 			},
+			"EmailRuleCoveringAuthor": {
+				"type": "object",
+				"properties": {
+					"user_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"name": {
+						"description": "Their name; null when they have none set.",
+						"type": ["string", "null"]
+					},
+					"email": {
+						"description": "Sign-in email; null unless you can list member emails or this is you.",
+						"type": ["string", "null"]
+					}
+				},
+				"required": [
+					"user_id",
+					"name",
+					"email"
+				]
+			},
 			"ListEmailRuleResultsResult": {
 				"type": "object",
 				"properties": {
@@ -51252,7 +52202,7 @@ const openapiDocument = {
 									"type": "string",
 									"format": "uuid"
 								},
-								"name": { "type": "string" },
+								"name": { "type": ["string", "null"] },
 								"state": {
 									"type": "string",
 									"enum": [
@@ -51276,7 +52226,7 @@ const openapiDocument = {
 										},
 										"matched": { "type": "boolean" },
 										"near_miss": {
-											"description": "Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). False when detail_withheld is true. Decisions recorded under the earlier definition counted an exclusion too.",
+											"description": "Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). False when detail_withheld is true. Decisions recorded under the earlier definition counted an exclusion too.",
 											"type": "boolean"
 										},
 										"parts": {
@@ -51367,6 +52317,15 @@ const openapiDocument = {
 									"description": "On a do-not-share rule whose author is no longer a member of the organization: it blocks nothing now, whatever it decided. Absent otherwise.",
 									"type": "boolean",
 									"const": true
+								},
+								"read_only": {
+									"description": "Another member's rule that decided on your own mail; dashboard and CLI only. name is null once it no longer covers you.",
+									"type": "boolean",
+									"const": true
+								},
+								"author": {
+									"description": "With read_only: who wrote it.",
+									"$ref": "#/components/schemas/EmailRuleCoveringAuthor"
 								}
 							},
 							"required": [
@@ -51377,12 +52336,17 @@ const openapiDocument = {
 								"not_run_reason"
 							]
 						},
-						"description": "Every rule the caller can see: those that matched this email, then those that did not, then those that have not run on it; newest rule first within each."
+						"description": "Rules you can see, and read_only ones: matched first, then not matched, then not run; newest first within each."
 					},
 					"hidden": {
 						"type": "integer",
 						"minimum": 0,
-						"description": "How many more rules the caller can see that are not listed."
+						"description": "Rules that decided on this email that you cannot see."
+					},
+					"not_listed": {
+						"description": "Rules you can see past the 50 listed.",
+						"type": "integer",
+						"minimum": 0
 					},
 					"classification": {
 						"type": ["object", "null"],
@@ -51748,6 +52712,14 @@ const openapiDocument = {
 						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 						"type": ["string", "null"]
 					},
+					"edited_on_accept": {
+						"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+						"type": ["boolean", "null"]
+					},
+					"notice": {
+						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"type": ["string", "null"]
+					},
 					"target_can_accept": {
 						"description": "Whether the member asked can accept it now under their role. Null unless you can list members and their roles (members:read), or when it could not be read.",
 						"type": ["boolean", "null"]
@@ -51905,6 +52877,14 @@ const openapiDocument = {
 					"decline_reason": {
 						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
 						"type": ["string", "null"]
+					},
+					"edited_on_accept": {
+						"description": "Once accepted: whether the rule was changed first, as on the share. Null until then, or when unreadable.",
+						"type": ["boolean", "null"]
+					},
+					"notice": {
+						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"type": ["string", "null"]
 					}
 				},
 				"required": [
@@ -51973,6 +52953,10 @@ const openapiDocument = {
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
+					"protection_note": {
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
+						"type": "string"
+					},
 					"evaluation_scope": {
 						"description": "Whose mail it runs over, as stored (GET /email-rules/{id}/scope: what that is now).",
 						"type": "string",
@@ -52245,6 +53229,13 @@ const openapiDocument = {
 					"breadth": {
 						"description": "Ignored (the compile answer's breadth).",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"expectation_samples": {
+						"description": "Made-up emails the rule must match or not, such as look-alikes it must never match, kept on the rule this accept writes.",
+						"minItems": 1,
+						"maxItems": 20,
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/EmailRuleExpectationSampleInput" }
 					}
 				},
 				"additionalProperties": false
@@ -52254,7 +53245,11 @@ const openapiDocument = {
 				"properties": {
 					"request": { "$ref": "#/components/schemas/EmailRuleRequest" },
 					"rule": { "$ref": "#/components/schemas/EmailRuleWithVersion" },
-					"share": { "$ref": "#/components/schemas/EmailRuleShare" }
+					"share": { "$ref": "#/components/schemas/EmailRuleShare" },
+					"notice": {
+						"description": "What is now shared, in words.",
+						"type": "string"
+					}
 				},
 				"required": [
 					"request",
@@ -52544,8 +53539,274 @@ const openapiDocument = {
 			},
 			"EndEmailRuleShareResult": {
 				"type": "object",
-				"properties": { "ended": { "type": "boolean" } },
-				"required": ["ended"]
+				"properties": {
+					"ended": { "type": "boolean" },
+					"rule_id": { "type": "string" },
+					"note": { "type": "string" }
+				},
+				"required": ["ended"],
+				"additionalProperties": {}
+			},
+			"EmailRuleCoveringMe": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"name": { "type": "string" },
+					"state": {
+						"type": "string",
+						"enum": [
+							"draft",
+							"observe",
+							"active"
+						],
+						"description": "draft: it decides nothing. observe: it decides and records, and shares nothing. active: it decides and, for a grant rule, shares what it matches."
+					},
+					"kind": {
+						"type": "string",
+						"enum": ["grant", "do_not_share"],
+						"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
+					},
+					"author": {
+						"description": "Who wrote it.",
+						"$ref": "#/components/schemas/EmailRuleCoveringAuthor"
+					},
+					"is_author": {
+						"type": "boolean",
+						"description": "Whether you wrote it."
+					},
+					"covers": { "$ref": "#/components/schemas/EmailRuleCoverage" },
+					"current_version": {
+						"type": ["integer", "null"],
+						"exclusiveMinimum": 0
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"name",
+					"state",
+					"kind",
+					"author",
+					"is_author",
+					"covers",
+					"current_version",
+					"created_at"
+				]
+			},
+			"EmailRuleCoverage": {
+				"type": "object",
+				"properties": {
+					"addresses": {
+						"type": "array",
+						"items": { "type": "string" },
+						"description": "Your own mailboxes (your member mailbox and your personal agents' addresses) it reaches now, lowercase."
+					},
+					"via": {
+						"type": "string",
+						"enum": [
+							"author_reach",
+							"selected",
+							"own_mailboxes"
+						],
+						"description": "author_reach: it runs over everything its author can read, which includes these. selected: it names these mailboxes or their domain. own_mailboxes: it is your own rule over your own mail."
+					}
+				},
+				"required": ["addresses", "via"]
+			},
+			"ListEmailRulesCoveringMeResult": {
+				"type": "array",
+				"items": { "$ref": "#/components/schemas/EmailRuleCoveringMe" }
+			},
+			"EmailRuleCoveringMeRead": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"name": {
+						"description": "Null when covers_now is false: its name now may describe something else.",
+						"type": ["string", "null"]
+					},
+					"state": {
+						"type": "string",
+						"enum": [
+							"draft",
+							"observe",
+							"active"
+						],
+						"description": "draft: it decides nothing. observe: it decides and records, and shares nothing. active: it decides and, for a grant rule, shares what it matches."
+					},
+					"kind": {
+						"type": "string",
+						"enum": ["grant", "do_not_share"],
+						"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
+					},
+					"author": {
+						"description": "Who wrote it.",
+						"$ref": "#/components/schemas/EmailRuleCoveringAuthor"
+					},
+					"is_author": {
+						"type": "boolean",
+						"description": "Whether you wrote it."
+					},
+					"covers": {
+						"description": "Null when it no longer covers your mailboxes and you see it because it decided on your mail.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleCoverage" }, { "type": "null" }]
+					},
+					"current_version": {
+						"type": ["integer", "null"],
+						"exclusiveMinimum": 0,
+						"description": "Null when covers_now is false."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"covers_now": {
+						"type": "boolean",
+						"description": "Whether it covers one of your own mailboxes now. False for a rule you see only because it decided on mail at your own mailbox before."
+					},
+					"current": {
+						"description": "Its current version: what it asks of each email. When covers_now is false, the newest version that decided on your mail instead.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleCoveringMeVersion" }, { "type": "null" }]
+					},
+					"note": {
+						"description": "Present when covers_now is false: what is withheld, and why.",
+						"type": "string"
+					}
+				},
+				"required": [
+					"id",
+					"name",
+					"state",
+					"kind",
+					"author",
+					"is_author",
+					"covers",
+					"current_version",
+					"created_at",
+					"covers_now",
+					"current"
+				]
+			},
+			"EmailRuleCoveringMeVersion": {
+				"type": "object",
+				"properties": {
+					"version": {
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
+					"english": {
+						"type": "string",
+						"description": "What its author asked for, in their words."
+					},
+					"tree": { "$ref": "#/components/schemas/EmailRuleTree" },
+					"explanation": {
+						"type": "string",
+						"description": "What the rule matches, as compiled."
+					},
+					"assumptions": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"compiled_by": { "type": "string" },
+					"vocabulary": { "type": "string" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"version",
+					"english",
+					"tree",
+					"explanation",
+					"assumptions",
+					"compiled_by",
+					"vocabulary",
+					"created_at"
+				]
+			},
+			"GetEmailRuleCoveringMeResult": { "$ref": "#/components/schemas/EmailRuleCoveringMeRead" },
+			"EmailRuleDecisionOnMyMail": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"email_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"rule_version": {
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
+					"classification_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"matched": { "type": "boolean" },
+					"near_miss": {
+						"type": "boolean",
+						"description": "Not matched, but nearly. False when detail_withheld is true."
+					},
+					"parts": {
+						"type": "array",
+						"items": {},
+						"description": "How each top-level part of the rule decided."
+					},
+					"question_answers": {
+						"type": "array",
+						"items": {},
+						"description": "The answers to the rule's own questions, when they were asked."
+					},
+					"detail_withheld": {
+						"description": "Present, as true, when the email's content cannot be read: matched still says what the rule decided, and parts and question_answers are empty.",
+						"type": "boolean",
+						"const": true
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"from_address": {
+						"description": "The email's sender address, as GET /v1/emails/{id} shows it.",
+						"type": ["string", "null"]
+					},
+					"subject": { "type": ["string", "null"] },
+					"received_at": {
+						"type": ["string", "null"],
+						"format": "date-time",
+						"description": "When the email arrived. Null, with the other two, when you are not shown the email (it awaits sender authentication)."
+					}
+				},
+				"required": [
+					"id",
+					"email_id",
+					"rule_version",
+					"classification_id",
+					"matched",
+					"near_miss",
+					"parts",
+					"question_answers",
+					"created_at",
+					"from_address",
+					"subject",
+					"received_at"
+				]
+			},
+			"ListEmailRuleDecisionsOnMyMailResult": {
+				"type": "array",
+				"items": { "$ref": "#/components/schemas/EmailRuleDecisionOnMyMail" }
 			},
 			"GetDomainAgentAuthorizationResult": {
 				"type": "object",
@@ -54459,7 +55720,10 @@ const openapiDocument = {
 						"format": "uuid",
 						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
 					},
-					"endpoint_url": { "type": "string" },
+					"endpoint_url": {
+						"type": "string",
+						"description": "Where it was sent: a webhook's scheme and host, followed by \"/... (path and query hidden)\" when its URL has more (GET /endpoints/{id} has the whole URL), function://<id> for a Function, or pull: for a pull subscription."
+					},
 					"status": { "type": "string" },
 					"attempt_count": { "type": "integer" },
 					"duration_ms": { "type": ["integer", "null"] },
@@ -54470,7 +55734,7 @@ const openapiDocument = {
 						"description": "The HTTP status the endpoint answered this attempt with: a webhook's own answer, or for a Function what its runtime answered, which is the platform's own error when the Function could not be run. Null when no answer came back (a network error, a timeout, an attempt refused or not sent) and on attempts recorded before this field."
 					},
 					"response_body": {
-						"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent.",
+						"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent. Null for a redirect (3xx), whose body repeats its Location; otherwise the webhook URL's path and query are hidden wherever it repeats them.",
 						"type": ["string", "null"]
 					},
 					"created_at": { "type": "string" },
@@ -54523,7 +55787,7 @@ const openapiDocument = {
 									"description": "The HTTP status the endpoint answered this attempt with: a webhook's own answer, or for a Function what its runtime answered, which is the platform's own error when the Function could not be run. Null when no answer came back (a network error, a timeout, an attempt refused or not sent) and on attempts recorded before this field."
 								},
 								"response_body": {
-									"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent.",
+									"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent. Null for a redirect (3xx), whose body repeats its Location; otherwise the webhook URL's path and query are hidden wherever it repeats them.",
 									"type": ["string", "null"]
 								},
 								"retry_scheduled": {
@@ -56427,7 +57691,7 @@ const openapiDocument = {
 						}
 					},
 					"already_revoked": {
-						"description": "true when the API key was already revoked, so nothing changed and revoked is 0. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
+						"description": "true when the API key was already revoked. revoked then counts only the keys it replaced that were revoked now. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
 						"type": "boolean"
 					},
 					"keep_failed": {
@@ -56455,11 +57719,23 @@ const openapiDocument = {
 								"id": { "type": "string" },
 								"label": {
 									"type": "string",
-									"description": "A webhook's URL, a pull subscription's name (or pull when it has none), a route's or filter's pattern, or a wake schedule's command and the address it wakes (command to address). A Function trigger's label is function: look it up by id."
+									"description": "A webhook's scheme and host, followed by \"/... (path and query hidden)\" when its URL has more (GET /v1/endpoints/{id} has the whole URL), a pull subscription's name (or pull when it has none), a route's or filter's pattern, or a wake schedule's command and the address it wakes (command to address). A Function trigger's label is function: look it up by id."
 								},
 								"org_owned": {
 									"type": "boolean",
 									"description": "true: the organization owns it, and it keeps working. false: the credential owns it itself, as with everything a third-party app or agent delegate made, a webhook made with a narrowed API key, or a wake schedule made with a key that does not cover super_admin. It keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to or kept it. Revoking a third-party app or agent delegate turns these off, except that a block filter it made keeps blocking, within the reach the app had, unless the person revoking chose to stop it."
+								},
+								"still_acting": {
+									"description": "For an API key: whether anything still acts for it after this revoke (the organization, a key of the same rotation that still works, or whoever took it over). Null when that could not be read.",
+									"type": ["boolean", "null"]
+								},
+								"acting_key_id": {
+									"description": "For an API key: the key that still acts for it, shown to a caller who may read the organization's API keys. Null otherwise, and when no key does.",
+									"type": ["string", "null"]
+								},
+								"delivering": {
+									"description": "For an API key's webhook: whether it is still sent received mail, as GET /v1/endpoints/{id} delivery.delivering says. Null when that could not be read.",
+									"type": ["boolean", "null"]
 								}
 							},
 							"required": [
@@ -56470,6 +57746,28 @@ const openapiDocument = {
 							],
 							"additionalProperties": {}
 						}
+					},
+					"predecessors_revoked_count": {
+						"description": "For an API key: how many keys it replaced in its rotation, still in their overlap, were revoked with it. Keys that replaced it never are.",
+						"type": "integer",
+						"minimum": -9007199254740991,
+						"maximum": 9007199254740991
+					},
+					"predecessors_left": {
+						"description": "For an API key: how many such keys were left working because you may not revoke them. They work until their overlap ends.",
+						"type": "integer",
+						"minimum": -9007199254740991,
+						"maximum": 9007199254740991
+					},
+					"predecessors_revoked": {
+						"description": "The ids of the keys counted in predecessors_revoked_count, to a caller who may read the organization's API keys.",
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"predecessors_not_revoked": {
+						"description": "The ids of the keys counted in predecessors_left, to a caller who may read the organization's API keys.",
+						"type": "array",
+						"items": { "type": "string" }
 					}
 				},
 				"required": [
@@ -71295,8 +72593,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.7";
-const CLI_VERSION_RANGE = "^3.0.0-preview.7";
+const SDK_VERSION_RANGE = "^3.0.0-preview.9";
+const CLI_VERSION_RANGE = "^3.0.0-preview.9";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -75072,7 +76370,7 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 			multiple: true
 		}),
 		rule: Flags.string({
-			description: "An email rule id whose matching mail the key reaches (repeatable).",
+			description: "An email rule id whose matching mail the key reaches (repeatable). An --address or --domain given beside it is read in full, not only the rule's mail.",
 			multiple: true
 		}),
 		"all-mailboxes": Flags.boolean({ description: "A key with --permission that reaches every mailbox." }),
@@ -75119,7 +76417,10 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 			return;
 		}
 		const key = result.data;
-		if (!flags.json) writeWarnings(key.warnings);
+		if (!flags.json) {
+			writeWarnings(key.warnings);
+			writeWarnings(key.address_warnings);
+		}
 		printSecret(this, Boolean(flags.json), key, key.key, [
 			`Created API key ${key.name ?? "(unnamed)"} (${key.id}), prefix ${key.key_prefix}.`,
 			`Permissions: ${describePermissions({
@@ -75345,6 +76646,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 			return;
 		}
 		writeWarnings(result.data.warnings);
+		writeWarnings(result.data.address_warnings);
 		const changed = result.data.changed;
 		this.log(changed.length > 0 ? `Updated key ${args.id}: ${changed.join(", ")}.` : `Key ${args.id} already matched; nothing changed.`);
 		if (after?.ok) {
@@ -75368,8 +76670,84 @@ function standingSummary(standing) {
 	const kept = standing.length - keyOwned;
 	return `${[...kept > 0 ? [`${kept} item(s) the organization owns keep working.`] : [], ...keyOwned > 0 ? [`${keyOwned} item(s) the key owned itself or carried on for the keys it was rotated from, such as its own webhooks, which keep working only while someone can still act for them, such as a key of the same rotation that still works.`] : []].join(" ")} Review them with --json.`;
 }
+/** How many standing objects the summary lists one by one. */
+const STANDING_LIST_LIMIT = 10;
+const STANDING_KIND_LABELS = {
+	endpoint: "webhook",
+	function_trigger: "Function trigger",
+	pull_subscription: "pull subscription",
+	recipient_route: "route",
+	filter_rule: "filter",
+	wake_schedule: "wake schedule"
+};
+/** Whether a revoke answer says, per item, what still acts for it or delivers. */
+function reportsCascade(standing) {
+	return standing.some((item) => "still_acting" in item || "delivering" in item);
+}
+/**
+* A standing object's label. A Function trigger's label is only "function" and
+* an unnamed pull subscription's only "pull", so those carry their id. A
+* webhook's label is its URL's scheme and host (the server hides the path and
+* query); against an older server, which sent the whole URL, it is cut at
+* `?` or `#`, which can hold a token.
+*/
+function standingLabel(item) {
+	const id = typeof item.id === "string" ? item.id : String(item.id);
+	const label = typeof item.label === "string" && item.label ? item.label : id;
+	if (item.kind === "function_trigger") return id;
+	if (item.kind === "pull_subscription") return label === id || label === "pull" ? id : `${label} (${id})`;
+	if (item.kind === "endpoint") {
+		const cut = label.search(/[?#]/);
+		return cut >= 0 ? `${label.slice(0, cut)}?...` : label;
+	}
+	return label;
+}
+/** One standing object, with who still acts for it and whether it delivers. */
+function standingLine(item, leftWorking) {
+	const kind = typeof item.kind === "string" ? STANDING_KIND_LABELS[item.kind] ?? item.kind : "item";
+	let acting;
+	if (item.org_owned !== false) acting = "the organization owns it, so revoking does not stop it";
+	else if (item.still_acting === true) {
+		const by = typeof item.acting_key_id === "string" && item.acting_key_id ? item.acting_key_id : null;
+		acting = !by ? "owned by the revoked key; someone still acts for it, so it keeps working while they do" : leftWorking.has(by) ? `owned by the revoked key; key ${by} still acts for it until that key's overlap ends` : `owned by the revoked key; key ${by} still acts for it, so it keeps working while that key does`;
+	} else if (item.still_acting === false) acting = "owned by the revoked key; nothing acts for it, so it does not work";
+	else if (item.still_acting === null) acting = "owned by the revoked key; whether anything still acts for it could not be read, and it works only while something does";
+	else acting = "owned by the revoked key; it keeps working only while someone can still act for it";
+	const delivering = item.delivering === true ? "; still delivering received mail" : item.delivering === false ? "; not delivering received mail" : item.delivering === null ? "; whether it still delivers could not be read" : "";
+	return `  ${kind} ${standingLabel(item)}: ${acting}${delivering}.`;
+}
+/**
+* What a revoke did beyond the key itself, from the answer: the keys it
+* replaced that were revoked with it or left working, and, for each item the
+* key set up or owns, whether anything still acts for it and whether it still
+* delivers. Lines, empty when the answer has none of these. An answer from a
+* server that does not report them per item falls back to standingSummary.
+*/
+function revokeCascadeLines(data) {
+	if (!data || typeof data !== "object") return [];
+	const answer = data;
+	const lines = [];
+	const ids = (value) => Array.isArray(value) ? value.filter((id) => typeof id === "string") : [];
+	const named = (list) => list.length > 0 ? `: ${list.join(", ")}` : "";
+	const revoked = answer.predecessors_revoked_count;
+	if (typeof revoked === "number" && revoked > 0) lines.push(`Also revoked ${revoked === 1 ? "1 key" : `${revoked} keys`} it replaced, still in ${revoked === 1 ? "its" : "their"} rotation overlap${named(ids(answer.predecessors_revoked))}.`);
+	const left = answer.predecessors_left;
+	if (typeof left === "number" && left > 0) lines.push(`${left === 1 ? "1 key" : `${left} keys`} it replaced ${left === 1 ? "is" : "are"} left working until ${left === 1 ? "its" : "their"} overlap ends, because you may not revoke ${left === 1 ? "it" : "them"}${named(ids(answer.predecessors_not_revoked))}; what ${left === 1 ? "it acts" : "they act"} for keeps working until then.`);
+	const leftWorking = new Set(ids(answer.predecessors_not_revoked));
+	const standing = Array.isArray(answer.standing_objects) ? answer.standing_objects.filter((item) => item !== null && typeof item === "object") : [];
+	if (standing.length > 0 && reportsCascade(standing)) {
+		lines.push("What it set up, owns or carried on for the keys it replaced (revoking deletes none of it):");
+		for (const item of standing.slice(0, STANDING_LIST_LIMIT)) lines.push(standingLine(item, leftWorking));
+		const more = standing.length - STANDING_LIST_LIMIT;
+		if (more > 0) lines.push(`  ${more} more; --json lists them all.`);
+	} else {
+		const summary = standingSummary(answer.standing_objects);
+		if (summary) lines.push(summary);
+	}
+	return lines;
+}
 var KeysRevokeCommand = class KeysRevokeCommand extends Command {
-	static description = `Revoke an API key. It stops working at once. What the organization owns keeps working; what the key itself owns, such as its own webhooks, keeps working only while someone can still act for it, such as a key of the same rotation that still works. What it set up or owns is listed for review.
+	static description = `Revoke an API key. It stops working at once. What the organization owns keeps working; what the key itself owns, such as its own webhooks, keeps working only while someone can still act for it, such as a key of the same rotation that still works. What it set up or owns is listed for review, each with whether anything still acts for it and, for a webhook, whether it still delivers received mail. Keys it replaced that are still in their rotation overlap are revoked with it, except any you may not revoke; the output counts both, and names them and the key acting for each item when you may read the organization's keys.
 
   Asks for confirmation first; pass --yes to skip the prompt in scripts. Revoking runs directly. If your organization requires approval, the command prints the approval link, opens it where it can and waits for the one-time token; in a script, approve and run it again with --step-up-token.`;
 	static summary = "Revoke an API key";
@@ -75418,9 +76796,10 @@ var KeysRevokeCommand = class KeysRevokeCommand extends Command {
 			this.log(JSON.stringify(result.data, null, 2));
 			return;
 		}
-		this.log(result.data.already_revoked === true ? `Key ${args.id} was already revoked; nothing changed.` : `Revoked key ${args.id}.`);
-		const summary = standingSummary(result.data.standing_objects);
-		if (summary) this.log(summary);
+		const replaced = result.data.predecessors_revoked_count;
+		const alsoRevoked = typeof replaced === "number" && replaced > 0;
+		this.log(result.data.already_revoked === true ? alsoRevoked ? `Key ${args.id} was already revoked.` : `Key ${args.id} was already revoked; nothing changed.` : `Revoked key ${args.id}.`);
+		for (const line of revokeCascadeLines(result.data)) this.log(line);
 	}
 };
 const hash = (value) => createHash("sha256").update(value).digest("hex");