primcli 3.0.0-preview.8 → 3.0.0-preview.9

package/dist/{api-command-TUwewvqZ.js → api-command-DugUWmZH.js}

@@ -1,4 +1,4 @@
-import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-DNbrLjEF.js";
+import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-DqcHvqvW.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
 import { a as thrownErrorBody } from "./json-output-ch756TXV.js";
@@ -602,7 +602,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-account",
-		"description": "Update the mutable account settings (such as display name and notification preferences) for the authenticated organization.",
+		"description": "Update the organization's spam threshold (spam_threshold) and whether an email's content is discarded once a webhook confirms receipt (discard_content_on_webhook_confirmed), the opt-in POST /emails/{id}/discard-content needs.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateAccount",
@@ -7128,12 +7128,12 @@ const operationManifest = [
 												},
 												"hold": {
 													"type": "object",
-													"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+													"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 													"required": ["reason", "since"],
 													"properties": {
 														"reason": {
 															"type": "string",
-															"description": "Open: credential_reuse_hold."
+															"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 														},
 														"since": {
 															"type": ["string", "null"],
@@ -10698,7 +10698,7 @@ const operationManifest = [
 							"id": { "type": "string" },
 							"label": {
 								"type": "string",
-								"description": "A webhook's URL, a pull subscription's name (or pull when it has none), a route's or filter's pattern, or a wake schedule's command and the address it wakes (command to address). A Function trigger's label is function: look it up by id."
+								"description": "A webhook's scheme and host, followed by \"/... (path and query hidden)\" when its URL has more (GET /v1/endpoints/{id} has the whole URL), a pull subscription's name (or pull when it has none), a route's or filter's pattern, or a wake schedule's command and the address it wakes (command to address). A Function trigger's label is function: look it up by id."
 							},
 							"org_owned": {
 								"type": "boolean",
@@ -12947,6 +12947,458 @@ const operationManifest = [
 		"tag": "Domains",
 		"tagCommand": "domains"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-email-rule-covering-me",
+		"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getEmailRuleCoveringMe",
+		"path": "/email-rules/covering-me/{id}",
+		"pathParams": [{
+			"description": "The rule id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"name": {
+					"description": "Null when covers_now is false: its name now may describe something else.",
+					"type": ["string", "null"]
+				},
+				"state": {
+					"type": "string",
+					"enum": [
+						"draft",
+						"observe",
+						"active"
+					],
+					"description": "draft: it decides nothing. observe: it decides and records, and shares nothing. active: it decides and, for a grant rule, shares what it matches."
+				},
+				"kind": {
+					"type": "string",
+					"enum": ["grant", "do_not_share"],
+					"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
+				},
+				"author": {
+					"type": "object",
+					"properties": {
+						"user_id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"name": {
+							"description": "Their name; null when they have none set.",
+							"type": ["string", "null"]
+						},
+						"email": {
+							"description": "Sign-in email; null unless you can list member emails or this is you.",
+							"type": ["string", "null"]
+						}
+					},
+					"required": [
+						"user_id",
+						"name",
+						"email"
+					]
+				},
+				"is_author": {
+					"type": "boolean",
+					"description": "Whether you wrote it."
+				},
+				"covers": {
+					"description": "Null when it no longer covers your mailboxes and you see it because it decided on your mail.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" },
+								"description": "Your own mailboxes (your member mailbox and your personal agents' addresses) it reaches now, lowercase."
+							},
+							"via": {
+								"type": "string",
+								"enum": [
+									"author_reach",
+									"selected",
+									"own_mailboxes"
+								],
+								"description": "author_reach: it runs over everything its author can read, which includes these. selected: it names these mailboxes or their domain. own_mailboxes: it is your own rule over your own mail."
+							}
+						},
+						"required": ["addresses", "via"]
+					}, { "type": "null" }]
+				},
+				"current_version": {
+					"type": ["integer", "null"],
+					"exclusiveMinimum": 0,
+					"description": "Null when covers_now is false."
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"covers_now": {
+					"type": "boolean",
+					"description": "Whether it covers one of your own mailboxes now. False for a rule you see only because it decided on mail at your own mailbox before."
+				},
+				"current": {
+					"description": "Its current version: what it asks of each email. When covers_now is false, the newest version that decided on your mail instead.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "integer",
+								"exclusiveMinimum": 0
+							},
+							"english": {
+								"type": "string",
+								"description": "What its author asked for, in their words."
+							},
+							"tree": {
+								"type": "object",
+								"properties": {
+									"version": {
+										"type": "number",
+										"const": 1
+									},
+									"vocabulary": {
+										"type": "string",
+										"description": "Vocabulary version, such as v1."
+									},
+									"when": {
+										"type": "object",
+										"propertyNames": { "type": "string" },
+										"additionalProperties": {},
+										"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+									},
+									"questions": {
+										"type": "array",
+										"items": { "type": "string" },
+										"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
+									}
+								},
+								"required": [
+									"version",
+									"vocabulary",
+									"when",
+									"questions"
+								]
+							},
+							"explanation": {
+								"type": "string",
+								"description": "What the rule matches, as compiled."
+							},
+							"assumptions": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"compiled_by": { "type": "string" },
+							"vocabulary": { "type": "string" },
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"version",
+							"english",
+							"tree",
+							"explanation",
+							"assumptions",
+							"compiled_by",
+							"vocabulary",
+							"created_at"
+						]
+					}, { "type": "null" }]
+				},
+				"note": {
+					"description": "Present when covers_now is false: what is withheld, and why.",
+					"type": "string"
+				}
+			},
+			"required": [
+				"id",
+				"name",
+				"state",
+				"kind",
+				"author",
+				"is_author",
+				"covers",
+				"current_version",
+				"created_at",
+				"covers_now",
+				"current"
+			]
+		},
+		"sdkName": "getEmailRuleCoveringMe",
+		"summary": "Get a rule over your mail",
+		"tag": "Email Rule Oversight",
+		"tagCommand": "email-rule-oversight"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rule-decisions-on-my-mail",
+		"description": "What a rule that covers your mailboxes, or decided on your mail, decided about mail at your own mailboxes, newest first: never about anyone else's mail. Each decision is in the words of the version that made it, which can be earlier than the current one: the questions it asked about that email (question_answers) and the columns its conditions read (parts). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRuleDecisionsOnMyMail",
+		"path": "/email-rules/covering-me/{id}/decisions",
+		"pathParams": [{
+			"description": "The rule id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [
+			{
+				"default": 50,
+				"description": "Decisions per page, from 1 to 100; defaults to 50.",
+				"enum": null,
+				"maximum": 100,
+				"minimum": 1,
+				"name": "limit",
+				"required": false,
+				"type": "integer"
+			},
+			{
+				"description": "meta.cursor from the preceding page. Omit for the first page.",
+				"enum": null,
+				"name": "cursor",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "true for matches only, false for the rest.",
+				"enum": ["true", "false"],
+				"name": "matched",
+				"required": false,
+				"type": "string"
+			}
+		],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"email_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"rule_version": {
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
+					"classification_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"matched": { "type": "boolean" },
+					"near_miss": {
+						"type": "boolean",
+						"description": "Not matched, but nearly. False when detail_withheld is true."
+					},
+					"parts": {
+						"type": "array",
+						"items": {},
+						"description": "How each top-level part of the rule decided."
+					},
+					"question_answers": {
+						"type": "array",
+						"items": {},
+						"description": "The answers to the rule's own questions, when they were asked."
+					},
+					"detail_withheld": {
+						"description": "Present, as true, when the email's content cannot be read: matched still says what the rule decided, and parts and question_answers are empty.",
+						"type": "boolean",
+						"const": true
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"from_address": {
+						"description": "The email's sender address, as GET /v1/emails/{id} shows it.",
+						"type": ["string", "null"]
+					},
+					"subject": { "type": ["string", "null"] },
+					"received_at": {
+						"type": ["string", "null"],
+						"format": "date-time",
+						"description": "When the email arrived. Null, with the other two, when you are not shown the email (it awaits sender authentication)."
+					}
+				},
+				"required": [
+					"id",
+					"email_id",
+					"rule_version",
+					"classification_id",
+					"matched",
+					"near_miss",
+					"parts",
+					"question_answers",
+					"created_at",
+					"from_address",
+					"subject",
+					"received_at"
+				]
+			}
+		},
+		"sdkName": "listEmailRuleDecisionsOnMyMail",
+		"summary": "List what a rule decided about your mail",
+		"tag": "Email Rule Oversight",
+		"tagCommand": "email-rule-oversight"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rules-covering-me",
+		"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRulesCoveringMe",
+		"path": "/email-rules/covering-me",
+		"pathParams": [],
+		"queryParams": [{
+			"default": 50,
+			"description": "Rules per page, from 1 to 100; defaults to 50.",
+			"enum": null,
+			"maximum": 100,
+			"minimum": 1,
+			"name": "limit",
+			"required": false,
+			"type": "integer"
+		}, {
+			"description": "meta.cursor from the preceding page. Omit for the first page.",
+			"enum": null,
+			"name": "cursor",
+			"required": false,
+			"type": "string"
+		}],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"name": { "type": "string" },
+					"state": {
+						"type": "string",
+						"enum": [
+							"draft",
+							"observe",
+							"active"
+						],
+						"description": "draft: it decides nothing. observe: it decides and records, and shares nothing. active: it decides and, for a grant rule, shares what it matches."
+					},
+					"kind": {
+						"type": "string",
+						"enum": ["grant", "do_not_share"],
+						"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
+					},
+					"author": {
+						"type": "object",
+						"properties": {
+							"user_id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"name": {
+								"description": "Their name; null when they have none set.",
+								"type": ["string", "null"]
+							},
+							"email": {
+								"description": "Sign-in email; null unless you can list member emails or this is you.",
+								"type": ["string", "null"]
+							}
+						},
+						"required": [
+							"user_id",
+							"name",
+							"email"
+						]
+					},
+					"is_author": {
+						"type": "boolean",
+						"description": "Whether you wrote it."
+					},
+					"covers": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" },
+								"description": "Your own mailboxes (your member mailbox and your personal agents' addresses) it reaches now, lowercase."
+							},
+							"via": {
+								"type": "string",
+								"enum": [
+									"author_reach",
+									"selected",
+									"own_mailboxes"
+								],
+								"description": "author_reach: it runs over everything its author can read, which includes these. selected: it names these mailboxes or their domain. own_mailboxes: it is your own rule over your own mail."
+							}
+						},
+						"required": ["addresses", "via"]
+					},
+					"current_version": {
+						"type": ["integer", "null"],
+						"exclusiveMinimum": 0
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"name",
+					"state",
+					"kind",
+					"author",
+					"is_author",
+					"covers",
+					"current_version",
+					"created_at"
+				]
+			}
+		},
+		"sdkName": "listEmailRulesCoveringMe",
+		"summary": "List the rules over your mail",
+		"tag": "Email Rule Oversight",
+		"tagCommand": "email-rule-oversight"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -13006,7 +13458,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -13219,7 +13671,7 @@ const operationManifest = [
 								"questions": {
 									"type": "array",
 									"items": { "type": "string" },
-									"description": "Yes/no questions asked once the conditions match; all must be yes."
+									"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 								}
 							},
 							"required": [
@@ -13383,7 +13835,7 @@ const operationManifest = [
 							"enum": ["grant", "do_not_share"]
 						},
 						"protection_note": {
-							"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+							"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
 							"type": "string"
 						},
 						"evaluation_scope": {
@@ -13489,7 +13941,7 @@ const operationManifest = [
 											"questions": {
 												"type": "array",
 												"items": { "type": "string" },
-												"description": "Yes/no questions asked once the conditions match; all must be yes."
+												"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 											}
 										},
 										"required": [
@@ -13819,7 +14271,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "compile-email-rule",
-		"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to five yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to five yes/no questions, asked about an email only after its conditions match; they read its subject, its new text and its attachments' file names, never what is inside an attachment, and warnings say when a question mentions attachments. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "compileEmailRule",
@@ -13880,7 +14332,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -14189,7 +14641,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -14282,7 +14734,7 @@ const operationManifest = [
 					"enum": ["grant", "do_not_share"]
 				},
 				"protection_note": {
-					"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
 					"type": "string"
 				},
 				"evaluation_scope": {
@@ -14388,7 +14840,7 @@ const operationManifest = [
 									"questions": {
 										"type": "array",
 										"items": { "type": "string" },
-										"description": "Yes/no questions asked once the conditions match; all must be yes."
+										"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 									}
 								},
 								"required": [
@@ -14764,7 +15216,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -14873,7 +15325,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -15102,7 +15554,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -15349,7 +15801,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "end-email-rule-share",
-		"description": "Stops sharing. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.",
+		"description": "Stops sharing; the rule itself is left unchanged, as the answer's note says. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.",
 		"hasJsonBody": false,
 		"method": "DELETE",
 		"operationId": "endEmailRuleShare",
@@ -15368,8 +15820,13 @@ const operationManifest = [
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
-			"properties": { "ended": { "type": "boolean" } },
-			"required": ["ended"]
+			"properties": {
+				"ended": { "type": "boolean" },
+				"rule_id": { "type": "string" },
+				"note": { "type": "string" }
+			},
+			"required": ["ended"],
+			"additionalProperties": {}
 		},
 		"sdkName": "endEmailRuleShare",
 		"summary": "End a rule share",
@@ -15380,7 +15837,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "generate-look-alikes",
-		"description": "Writes made-up emails that come close to what a grant rule describes but are private (a personal medical bill, pay for named people, a personal purchase, personal banking or tax, or another near case), and reports what the rule decides for each, as test-sample would. failed means the rule matched it, so it would be shared. Nothing is stored and no mail is read. Keep the ones it must never match with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Writes made-up emails that come close to what a grant rule describes, and reports what the rule decides for each, as test-sample would. Most should not match (expected no_match): business near misses from its senders and topic (kind other: an all-clear, a reply with nothing new, a related document, another subject) and private mail (a personal medical bill, pay for named people, a personal purchase, personal banking or tax). By default a third, rounded down, are near cases it should match (expected match, kind other). failed means the rule decided one against expected. Nothing is stored and no mail is read. Keep them, with their expected, with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "generateLookAlikes",
@@ -15417,7 +15874,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -15493,7 +15950,7 @@ const operationManifest = [
 					"maximum": 8
 				},
 				"kinds": {
-					"description": "Which kinds, taken in turn; all by default, the private ones first.",
+					"description": "Which kinds, taken in turn, all expected no_match; other is a business near miss. Left out, a default mix.",
 					"minItems": 1,
 					"maxItems": 5,
 					"type": "array",
@@ -15509,7 +15966,7 @@ const operationManifest = [
 					}
 				},
 				"to": {
-					"description": "The mailbox they arrive in; by default the rule author's (a request's target's) sign-in address when you may see it, else yours.",
+					"description": "The mailbox they arrive in; by default the first address (alphabetically) a selected scope names that a made-up email can be sent to, preferring one the author still reads; else the rule author's (a request's target's) sign-in address when you may see it, else yours.",
 					"type": "string",
 					"maxLength": 254,
 					"format": "email",
@@ -15555,9 +16012,14 @@ const operationManifest = [
 									"other"
 								]
 							},
+							"expected": {
+								"type": "string",
+								"enum": ["match", "no_match"],
+								"description": "match: a near case the rule should match; no_match: one it should not."
+							},
 							"why": {
 								"type": "string",
-								"description": "Why the rule should not match it."
+								"description": "Why the rule should, or should not, match it."
 							},
 							"email": {
 								"type": "object",
@@ -15615,7 +16077,7 @@ const operationManifest = [
 									"failed",
 									"undecided"
 								],
-								"description": "failed: the rule matched it, so it would be shared. undecided: the rule reads a spam score, which it cannot carry, whatever it decided; or not matched on something it could not decide (not classified, a fact or answer missing, or not reached in time)."
+								"description": "failed: the rule decided it against expected (shared one it should not, or missed one it should match). undecided: the rule reads a spam score, which it cannot carry, whatever it decided; or not matched on something it could not decide (not classified, a fact or answer missing, or not reached in time)."
 							},
 							"question_answers": {
 								"type": "array",
@@ -15637,6 +16099,7 @@ const operationManifest = [
 						},
 						"required": [
 							"kind",
+							"expected",
 							"why",
 							"email",
 							"outcome",
@@ -15663,7 +16126,7 @@ const operationManifest = [
 						"dropped": {
 							"type": "integer",
 							"minimum": 0,
-							"description": "Asked for but not returned: not written, outside the sample bounds, or of a kind not asked for."
+							"description": "Asked for but not returned: not written, outside the sample bounds, or of a kind and expected not asked for."
 						}
 					},
 					"required": [
@@ -15686,7 +16149,7 @@ const operationManifest = [
 			]
 		},
 		"sdkName": "generateLookAlikes",
-		"summary": "Write look-alike emails a rule should not match",
+		"summary": "Write look-alike emails a rule should or should not match",
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
@@ -15739,7 +16202,7 @@ const operationManifest = [
 					"enum": ["grant", "do_not_share"]
 				},
 				"protection_note": {
-					"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
 					"type": "string"
 				},
 				"evaluation_scope": {
@@ -15845,7 +16308,7 @@ const operationManifest = [
 									"questions": {
 										"type": "array",
 										"items": { "type": "string" },
-										"description": "Yes/no questions asked once the conditions match; all must be yes."
+										"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 									}
 								},
 								"required": [
@@ -16107,7 +16570,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -16814,7 +17277,7 @@ const operationManifest = [
 					"matched": { "type": "boolean" },
 					"near_miss": {
 						"type": "boolean",
-						"description": "Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). Decisions recorded under the earlier definition counted an exclusion too."
+						"description": "Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). Decisions recorded under the earlier definition counted an exclusion too."
 					},
 					"parts": {
 						"type": "array",
@@ -16997,7 +17460,7 @@ const operationManifest = [
 							"questions": {
 								"type": "array",
 								"items": { "type": "string" },
-								"description": "Yes/no questions asked once the conditions match; all must be yes."
+								"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 							}
 						},
 						"required": [
@@ -17149,7 +17612,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-results",
-		"description": "Every rule you can see and what it decided about this email (matched, not matched, or not run, with what is known), in the words of the version that decided. A matched do_not_share rule keeps rules from sharing the email while it is active; what was shared before then stays shared. Only a caller who can read the email gets an answer. classification is what the classifier read from the email, every fact as rule conditions read it, so you can see why a rule did or did not match. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only); hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleResults",
@@ -17208,7 +17671,7 @@ const operationManifest = [
 								"type": "string",
 								"format": "uuid"
 							},
-							"name": { "type": "string" },
+							"name": { "type": ["string", "null"] },
 							"state": {
 								"type": "string",
 								"enum": [
@@ -17232,7 +17695,7 @@ const operationManifest = [
 									},
 									"matched": { "type": "boolean" },
 									"near_miss": {
-										"description": "Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). False when detail_withheld is true. Decisions recorded under the earlier definition counted an exclusion too.",
+										"description": "Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). False when detail_withheld is true. Decisions recorded under the earlier definition counted an exclusion too.",
 										"type": "boolean"
 									},
 									"parts": {
@@ -17298,7 +17761,7 @@ const operationManifest = [
 												"questions": {
 													"type": "array",
 													"items": { "type": "string" },
-													"description": "Yes/no questions asked once the conditions match; all must be yes."
+													"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 												}
 											},
 											"required": [
@@ -17375,6 +17838,33 @@ const operationManifest = [
 								"description": "On a do-not-share rule whose author is no longer a member of the organization: it blocks nothing now, whatever it decided. Absent otherwise.",
 								"type": "boolean",
 								"const": true
+							},
+							"read_only": {
+								"description": "Another member's rule that decided on your own mail; dashboard and CLI only. name is null once it no longer covers you.",
+								"type": "boolean",
+								"const": true
+							},
+							"author": {
+								"type": "object",
+								"properties": {
+									"user_id": {
+										"type": "string",
+										"format": "uuid"
+									},
+									"name": {
+										"description": "Their name; null when they have none set.",
+										"type": ["string", "null"]
+									},
+									"email": {
+										"description": "Sign-in email; null unless you can list member emails or this is you.",
+										"type": ["string", "null"]
+									}
+								},
+								"required": [
+									"user_id",
+									"name",
+									"email"
+								]
 							}
 						},
 						"required": [
@@ -17385,12 +17875,17 @@ const operationManifest = [
 							"not_run_reason"
 						]
 					},
-					"description": "Every rule the caller can see: those that matched this email, then those that did not, then those that have not run on it; newest rule first within each."
+					"description": "Rules you can see, and read_only ones: matched first, then not matched, then not run; newest first within each."
 				},
 				"hidden": {
 					"type": "integer",
 					"minimum": 0,
-					"description": "How many more rules the caller can see that are not listed."
+					"description": "Rules that decided on this email that you cannot see."
+				},
+				"not_listed": {
+					"description": "Rules you can see past the 50 listed.",
+					"type": "integer",
+					"minimum": 0
 				},
 				"classification": {
 					"type": ["object", "null"],
@@ -18131,7 +18626,7 @@ const operationManifest = [
 							"questions": {
 								"type": "array",
 								"items": { "type": "string" },
-								"description": "Yes/no questions asked once the conditions match; all must be yes."
+								"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 							}
 						},
 						"required": [
@@ -18258,7 +18753,7 @@ const operationManifest = [
 						"enum": ["grant", "do_not_share"]
 					},
 					"protection_note": {
-						"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+						"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
 						"type": "string"
 					},
 					"evaluation_scope": {
@@ -18603,7 +19098,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -18947,7 +19442,7 @@ const operationManifest = [
 									"skipped",
 									"not_found"
 								],
-								"description": "near_miss: Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). skipped: an email you can see that cannot be tested; skipped_reason says why. not_found: no such email, or not one the rule can read (or not settled, or awaiting sender authentication)."
+								"description": "near_miss: Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). skipped: an email you can see that cannot be tested; skipped_reason says why. not_found: no such email, or not one the rule can read (or not settled, or awaiting sender authentication)."
 							},
 							"received_at": {
 								"type": "string",
@@ -19381,7 +19876,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -19562,7 +20057,7 @@ const operationManifest = [
 						"near_miss",
 						"no_match"
 					],
-					"description": "near_miss: Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false)."
+					"description": "near_miss: Not matched, but nearly: its conditions held and its questions did not match it, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false)."
 				},
 				"parts": {
 					"type": "array",
@@ -19749,7 +20244,7 @@ const operationManifest = [
 							"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
 						},
 						"questions": {
-							"description": "Yes/no questions asked once the conditions match; all must be yes. Left out, none.",
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes. Left out, none.",
 							"type": "array",
 							"items": { "type": "string" }
 						}
@@ -20094,7 +20589,7 @@ const operationManifest = [
 					"maximum": 2147483647
 				},
 				"if_expectations_pass": {
-					"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; undecided: 409 expectations_undecided (both with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
+					"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; on emails the rule cannot read: 409 expectations_unreadable; undecided: 409 expectations_undecided (each with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
 					"type": "boolean"
 				},
 				"restore_version": {
@@ -20128,7 +20623,7 @@ const operationManifest = [
 					"enum": ["grant", "do_not_share"]
 				},
 				"protection_note": {
-					"description": "On a do_not_share rule only: it protects nothing yet (not active), or a classifier fact narrows it.",
+					"description": "On a do_not_share rule only: it protects nothing yet (not active), a classifier fact narrows it, or its several questions are alternatives.",
 					"type": "string"
 				},
 				"evaluation_scope": {
@@ -20234,7 +20729,7 @@ const operationManifest = [
 									"questions": {
 										"type": "array",
 										"items": { "type": "string" },
-										"description": "Yes/no questions asked once the conditions match; all must be yes."
+										"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 									}
 								},
 								"required": [
@@ -20604,7 +21099,7 @@ const operationManifest = [
 						"questions": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "Yes/no questions asked once the conditions match; all must be yes."
+							"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
 						}
 					},
 					"required": [
@@ -21258,12 +21753,12 @@ const operationManifest = [
 							},
 							"hold": {
 								"type": "object",
-								"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+								"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 								"required": ["reason", "since"],
 								"properties": {
 									"reason": {
 										"type": "string",
-										"description": "Open: credential_reuse_hold."
+										"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 									},
 									"since": {
 										"type": ["string", "null"],
@@ -37002,7 +37497,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-access-mode",
-		"description": "Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Any person; API keys are refused.",
+		"description": "Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Needs members:read (owners, admins, members and roles that grant it); API keys are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getAccessMode",
@@ -37264,7 +37759,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-roles",
-		"description": "Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Any person (a session or OAuth token); API keys are refused.",
+		"description": "Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Needs members:read (owners, admins, members and roles that grant it); API keys are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listRoles",
@@ -39808,12 +40303,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -40041,12 +40536,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -40506,12 +41001,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -40739,12 +41234,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -41720,12 +42215,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -41953,12 +42448,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -42585,12 +43080,12 @@ const operationManifest = [
 					},
 					"hold": {
 						"type": "object",
-						"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+						"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 						"required": ["reason", "since"],
 						"properties": {
 							"reason": {
 								"type": "string",
-								"description": "Open: credential_reuse_hold."
+								"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 							},
 							"since": {
 								"type": ["string", "null"],
@@ -43070,12 +43565,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -43303,12 +43798,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -44091,12 +44586,12 @@ const operationManifest = [
 						},
 						"hold": {
 							"type": "object",
-							"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+							"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 							"required": ["reason", "since"],
 							"properties": {
 								"reason": {
 									"type": "string",
-									"description": "Open: credential_reuse_hold."
+									"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 								},
 								"since": {
 									"type": ["string", "null"],
@@ -44324,12 +44819,12 @@ const operationManifest = [
 				},
 				"hold": {
 					"type": "object",
-					"description": "Only on a held scheduled send: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. Status stays scheduled.",
+					"description": "Only on a scheduled send that is not going out yet; status stays scheduled. credential_reuse_hold: its OAuth grant was revoked after refresh token reuse, so it waits until released (POST /sent-emails/{id}/release) or canceled; canceled after 7 days. sending_ip_warmup_cap: your dedicated sending address is at today's warm-up limit or paused, so it goes out on its own within the hour after the limit resets at 00:00 UTC (fails with sending_ip_warmup_cap after 7 such holds); no release needed. On sent-email reads and conversation messages.",
 					"required": ["reason", "since"],
 					"properties": {
 						"reason": {
 							"type": "string",
-							"description": "Open: credential_reuse_hold."
+							"description": "Open: credential_reuse_hold, sending_ip_warmup_cap."
 						},
 						"since": {
 							"type": ["string", "null"],
@@ -48041,7 +48536,10 @@ const operationManifest = [
 					"format": "uuid",
 					"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
 				},
-				"endpoint_url": { "type": "string" },
+				"endpoint_url": {
+					"type": "string",
+					"description": "Where it was sent: a webhook's scheme and host, followed by \"/... (path and query hidden)\" when its URL has more (GET /endpoints/{id} has the whole URL), function://<id> for a Function, or pull: for a pull subscription."
+				},
 				"status": { "type": "string" },
 				"attempt_count": { "type": "integer" },
 				"duration_ms": { "type": ["integer", "null"] },
@@ -48052,7 +48550,7 @@ const operationManifest = [
 					"description": "The HTTP status the endpoint answered this attempt with: a webhook's own answer, or for a Function what its runtime answered, which is the platform's own error when the Function could not be run. Null when no answer came back (a network error, a timeout, an attempt refused or not sent) and on attempts recorded before this field."
 				},
 				"response_body": {
-					"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent.",
+					"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent. Null for a redirect (3xx), whose body repeats its Location; otherwise the webhook URL's path and query are hidden wherever it repeats them.",
 					"type": ["string", "null"]
 				},
 				"created_at": { "type": "string" },
@@ -48105,7 +48603,7 @@ const operationManifest = [
 								"description": "The HTTP status the endpoint answered this attempt with: a webhook's own answer, or for a Function what its runtime answered, which is the platform's own error when the Function could not be run. Null when no answer came back (a network error, a timeout, an attempt refused or not sent) and on attempts recorded before this field."
 							},
 							"response_body": {
-								"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent.",
+								"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent. Null for a redirect (3xx), whose body repeats its Location; otherwise the webhook URL's path and query are hidden wherever it repeats them.",
 								"type": ["string", "null"]
 							},
 							"retry_scheduled": {
@@ -48262,7 +48760,10 @@ const operationManifest = [
 						"type": "string",
 						"format": "uuid"
 					},
-					"endpoint_url": { "type": "string" },
+					"endpoint_url": {
+						"type": "string",
+						"description": "Where it was sent: a webhook's scheme and host, followed by \"/... (path and query hidden)\" when its URL has more (GET /endpoints/{id} has the whole URL), function://<id> for a Function, or pull: for a pull subscription."
+					},
 					"status": {
 						"type": "string",
 						"enum": [
@@ -48315,7 +48816,7 @@ const operationManifest = [
 					},
 					"response_body": {
 						"type": ["string", "null"],
-						"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent."
+						"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent. Null for a redirect (3xx), whose body repeats its Location; otherwise the webhook URL's path and query are hidden wherever it repeats them."
 					},
 					"latest_attempt": {
 						"type": "boolean",
@@ -49577,9 +50078,18 @@ function cutLabel(text, max) {
 	return (/[\uD800-\uDBFF]$/.test(cut) ? cut.slice(0, -1) : cut).trimEnd();
 }
 /**
-* A look-alike as a must-not-match sample: the email as written, labelled
-* with its kind and why the rule should not match it ("medical: ..."), or
-* the why alone when both do not fit a label.
+* Whether a look-alike is one the rule should match: its `expected` as the
+* API gives it. An answer without one (an older server) is must-not-match,
+* as every look-alike was.
+*/
+function lookAlikeExpected(lookAlike) {
+	return lookAlike.expected === "match" ? "match" : "no_match";
+}
+/**
+* A look-alike as a sample, keeping its `expected` (most must not match; a
+* near case the rule should take must match): the email as written,
+* labelled with its kind and why ("medical: ..."), or the why alone when
+* both do not fit a label.
 */
 function lookAlikeSample(lookAlike) {
 	if (!isRecord$1(lookAlike) || !isRecord$1(lookAlike.email)) return null;
@@ -49588,7 +50098,7 @@ function lookAlikeSample(lookAlike) {
 	const both = kind && why ? `${kind}: ${why}` : kind || why;
 	const label = both.length <= SAMPLE_LABEL_MAX ? both : why.length <= SAMPLE_LABEL_MAX ? why : `${cutLabel(why, 197)}...`;
 	return {
-		expected: "no_match",
+		expected: lookAlikeExpected(lookAlike),
 		...label ? { label } : {},
 		email: lookAlike.email
 	};
@@ -49665,8 +50175,8 @@ const SAMPLE_KEYS = /* @__PURE__ */ new Set([
 /**
 * The samples a file holds: a JSON array of samples, as --samples-file
 * writes them, or a generate-look-alikes answer saved as the command printed
-* it (with or without --json), whose look-alikes become must-not-match
-* samples numbered as its report numbered them. Only a literal [] holds no
+* it (with or without --json), whose look-alikes become samples, each
+* keeping whether it must match, numbered as its report numbered them. Only a literal [] holds no
 * samples; an answer with none is refused, so it never empties a rule's.
 */
 function samplesFromJson(value, source) {
@@ -49794,19 +50304,25 @@ function expectSamples(flags) {
 function pickFlagHelp(flags) {
 	return `Take only these samples from ${flags.map((flag) => `--${flag}`).join(" or ")}, by their numbers from 1 as generate-look-alikes printed them: --pick 2,4. A number the file does not hold is refused.`;
 }
-/** What the rule decided for a look-alike, and what its status makes of it. */
-function decidedLine(outcome, status) {
+/**
+* What the rule decided for a look-alike, and what its status makes of it,
+* against what it should do: leave it (`no_match`), or take it (`match`).
+*/
+function decidedLine(outcome, status, expected) {
 	if (outcome === "not_decided") return "The rule did not decide it: it was not reached in time, or deciding it failed.";
-	if (outcome === "matched") return status === "undecided" ? "The rule matched it, but it reads a spam score, which a look-alike does not carry, so this one is undecided." : "The rule matched it, so mail like it would be shared.";
+	if (outcome === "matched") return status === "undecided" ? "The rule matched it, but it reads a spam score, which a look-alike does not carry, so this one is undecided." : expected === "match" ? "The rule matched it, as it should." : "The rule matched it, so mail like it would be shared.";
 	const decided = outcome === "near_miss" ? "The rule nearly matched it, but did not" : "The rule did not match it";
-	return status === "undecided" ? `${decided}, on something it could not decide (its classification failed, a fact or a question's answer is missing, or it reads a spam score, which a look-alike does not carry), so this one is undecided.` : `${decided}.`;
+	if (status === "undecided") return `${decided}, on something it could not decide (its classification failed, a fact or a question's answer is missing, or it reads a spam score, which a look-alike does not carry), so this one is undecided.`;
+	if (expected === "no_match") return `${decided}.`;
+	return `${decided}, ${outcome === "near_miss" ? "though" : "but"} it should: mail like it would be missed.`;
 }
 /**
 * The stderr report of generate-look-alikes: each look-alike numbered as the
 * samples file numbers it, with its status, kind, subject, sender, why the
-* rule should not match it and what the rule decided; the counts; the
-* answer's note; and how to save the ones you choose. With --samples-file it
-* writes every look-alike there as a must-not-match sample, in that order.
+* rule should (or should not) match it and what the rule decided; the
+* counts; the answer's note; and how to save the ones you choose. With
+* --samples-file it writes every look-alike there as a sample keeping its
+* expected, in that order.
 */
 function lookAlikesReport(data, request) {
 	const file = request.flags?.[LOOK_ALIKES_SAMPLES_FILE_FLAG];
@@ -49831,9 +50347,10 @@ function lookAlikesReport(data, request) {
 		const status = typeof lookAlike.status === "string" ? lookAlike.status : "undecided";
 		const kind = typeof lookAlike.kind === "string" ? lookAlike.kind : "other";
 		const outcome = typeof lookAlike.outcome === "string" ? lookAlike.outcome : "not_decided";
+		const expected = lookAlikeExpected(lookAlike);
 		lines.push(`${index + 1}. ${status}  ${kind}  ${subject} from ${from}`);
-		if (typeof lookAlike.why === "string" && lookAlike.why.trim()) lines.push(`   Why it should not match: ${lookAlike.why.trim()}`);
-		lines.push(`   ${decidedLine(outcome, status)}`);
+		if (typeof lookAlike.why === "string" && lookAlike.why.trim()) lines.push(`   Why it should ${expected === "match" ? "" : "not "}match: ${lookAlike.why.trim()}`);
+		lines.push(`   ${decidedLine(outcome, status, expected)}`);
 	});
 	const counts = isRecord$1(data.counts) ? data.counts : {};
 	const count = (key) => typeof counts[key] === "number" ? counts[key] : 0;
@@ -49841,9 +50358,12 @@ function lookAlikesReport(data, request) {
 	lines.push(`Counts: ${count("passed")} passed, ${count("failed")} failed, ${count("undecided")} undecided${dropped > 0 ? `; ${dropped} asked for did not come back` : ""}.`);
 	if (typeof data.note === "string" && data.note.trim()) lines.push(data.note.trim());
 	const numbered = (status) => entries.map(({ lookAlike }, index) => lookAlike.status === status ? index + 1 : 0).filter((n) => n > 0);
-	const matched = numbered("failed");
+	const wanted = (n) => entries[n - 1]?.sample.expected === "match";
+	const failed = numbered("failed");
+	const missed = failed.filter(wanted);
+	const matched = failed.filter((n) => !wanted(n));
 	const undecided = numbered("undecided");
-	const chosen = matched.length > 0 ? matched : undecided.length > 0 ? numbered("passed") : [];
+	const chosen = failed.length > 0 ? failed : undecided.length > 0 ? numbered("passed") : [];
 	const pick = chosen.length > 0 ? ` --pick ${chosen.join(",")}` : "";
 	const body = isRecord$1(request.body) ? request.body : {};
 	const ruleId = typeof body.rule_id === "string" ? body.rule_id : null;
@@ -49852,8 +50372,10 @@ function lookAlikesReport(data, request) {
 	const save = ruleId ? `\`primitive email-rules update-email-rule ${ruleId} --${ADD_SAMPLES_FILE_FLAG} ${target}${pick}\`` : requestId ? `\`primitive email-rules accept-email-rule-request ${requestId} --${SAMPLES_FILE_FLAG} ${target}${pick}\` when the member the request asks accepts it` : `\`primitive email-rules create-email-rule ... --${SAMPLES_FILE_FLAG} ${target}${pick}\` when you save the rule`;
 	const one = (count, single, many) => count === 1 ? single : many;
 	const noneDecided = entries.length > 0 && undecided.length === entries.length ? `None of them was decided (each says why above), so saved as they are they may stay undecided; if the rule reads a spam score, give each email a spam_score${typeof file === "string" ? " in the file" : ""} first.` : "";
-	const which = matched.length > 0 ? `Keep ${one(matched.length, "the one it matched as an email", "the ones it matched as emails")} it must not match` : chosen.length > 0 ? `Keep ${one(chosen.length, "the one it did not match as an email", "the ones it did not match as emails")} it must not match (an undecided one may stay undecided as a sample)` : `Keep ${one(entries.length, "it as an email", "them as emails")} the rule must not match`;
-	const test = matched.length > 0 ? ` Test an edited rule on ${one(matched.length, "it", "them")} with \`primitive email-rules test-email-rule ${ruleId ? `--rule-id ${ruleId}` : "--body-file <body.json>"} --${EXPECT_SAMPLES_FILE_FLAG} ${target}${pick}\`.` : "";
+	const keepMatched = `${one(matched.length, "the one it matched as an email", "the ones it matched as emails")} it must not match`;
+	const keepMissed = `${one(missed.length, "the one it missed as an email", "the ones it missed as emails")} it must match`;
+	const which = failed.length > 0 ? `Keep ${matched.length > 0 && missed.length > 0 ? `${keepMatched}, and ${keepMissed}` : matched.length > 0 ? keepMatched : keepMissed}` : chosen.length > 0 ? chosen.some(wanted) ? `Keep ${one(chosen.length, "the one", "the ones")} it decided as expected (each keeps whether it must match; an undecided one may stay undecided as a sample)` : `Keep ${one(chosen.length, "the one it did not match as an email", "the ones it did not match as emails")} it must not match (an undecided one may stay undecided as a sample)` : entries.some((_, index) => wanted(index + 1)) ? `Keep ${one(entries.length, "it as an email", "them as emails")} the rule must match or not, as each says` : `Keep ${one(entries.length, "it as an email", "them as emails")} the rule must not match`;
+	const test = failed.length > 0 ? ` Test an edited rule on ${one(failed.length, "it", "them")} with \`primitive email-rules test-email-rule ${ruleId ? `--rule-id ${ruleId}` : "--body-file <body.json>"} --${EXPECT_SAMPLES_FILE_FLAG} ${target}${pick}\`.` : "";
 	if (typeof file === "string") {
 		const samples = entries.map((entry) => entry.sample);
 		if (samples.length === 0) {
@@ -49885,7 +50407,7 @@ function lookAlikesReport(data, request) {
 			};
 		}
 		const wrote = `Wrote ${one(samples.length, "the look-alike", `the ${samples.length} look-alikes`)} to ${file}, numbered as above.`;
-		lines.push(noneDecided ? `${wrote} ${noneDecided}` : `${wrote} ${which} with ${save}; --pick takes any of the numbers.${test}`);
+		lines.push(noneDecided ? `${wrote} ${noneDecided}` : `${wrote} ${which}, with ${save}; --pick takes any of the numbers.${test}`);
 	} else if (noneDecided) lines.push(noneDecided);
 	else if (entries.length > 0) lines.push(`${which}: save the JSON printed above to a file and give it to ${save}; --pick takes any of the numbers above.${test}`);
 	return { lines };
@@ -50562,8 +51084,8 @@ function readAgain(id) {
 * The hint for update-email-rule's refusals: an email_rule_conflict by its
 * details.reason (version_moved, revision_moved, expectations_moved,
 * rule_changed), and the expectations guard's expectations_failed,
-* expectations_undecided and no_expectations. Nothing was saved in any of
-* them.
+* expectations_undecided, expectations_unreadable and no_expectations.
+* Nothing was saved in any of them.
 */
 function updateEmailRuleErrorHint(code, payload, ruleId, body, flags) {
 	const id = typeof ruleId === "string" && ruleId ? ruleId : "<rule-id>";
@@ -50595,6 +51117,13 @@ function updateEmailRuleErrorHint(code, payload, ruleId, body, flags) {
 		const byReason = reason !== "none" && Object.hasOwn(UNDECIDED_NEXT_STEP, reason) ? UNDECIDED_NEXT_STEP[reason] : UNDECIDED_NEXT_STEP.none;
 		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved.${which}${code === "expectations_failed" ? "" : samplesMayStay ? `${undecided.length > 0 ? ` ${byReason}` : ""} ${UNDECIDED_SAMPLES_NEXT_STEP} ${refusedSampleTest(body, id)}` : ` ${byReason}`} The command exits ${updateEmailRuleErrorExitCode(payload) ?? 1}.`;
 	}
+	if (code === "expectations_unreadable") {
+		const unreadable = Array.isArray(details.unreadable) ? details.unreadable.filter((entry) => entry !== null && entry !== void 0 && entry !== "").map(String) : [];
+		const one = unreadable.length === 1;
+		const named = unreadable.length > 0 ? `: ${unreadable.join(", ")}` : "";
+		const them = one ? "it" : "them";
+		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved. ${one ? "An expectation names an email" : "Expectations name emails"} this rule cannot read (deleted, or outside its scope or its author's mail)${named}. Sending the write again will not decide ${them}: send --expectations-file without ${them}, or an evaluation_scope that reads ${them}. The command exits 1.`;
+	}
 	if (code === "no_expectations") return "Hint: nothing was saved. Give the rule expectations with --expectations-file or made-up emails with --expectation-samples-file or --add-expectation-samples-file (in this write or before it), or send the write without if_expectations_pass (--fail-on-expectations or --if-expectations-pass).";
 }
 /** The reasons a guard's undecided judgment can be decided by sending the write again. */
@@ -50631,13 +51160,14 @@ const UNDECIDED_NEXT_STEP = {
 };
 /**
 * update-email-rule's exit code for the expectations guard's refusals: 1 when
-* one failed, or when they may not be decided by trying again (the rule
-* cannot run as its author, or a made-up email is undecided for no reason
-* the answer gives); 3 when trying again later can decide them.
+* one failed, or when they may not be decided by trying again (an expectation
+* names an email the rule cannot read, the rule cannot run as its author, or
+* a made-up email is undecided for no reason the answer gives); 3 when trying
+* again later can decide them.
 */
 function updateEmailRuleErrorExitCode(payload) {
 	const code = isRecord(payload) ? payload.code : void 0;
-	if (code === "expectations_failed") return 1;
+	if (code === "expectations_failed" || code === "expectations_unreadable") return 1;
 	if (code !== "expectations_undecided") return void 0;
 	const details = errorDetails(payload);
 	if (details.reason === "author_unresolvable") return 1;
@@ -50687,7 +51217,7 @@ function listEmailRulesReport(data) {
 /** create-email-rule's --fail-on-expectations: the exit code follows the check made after saving. */
 const FAIL_ON_EXPECTATIONS_HELP = "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). A create does not judge made-up emails, so with some it exits 3. Without it the command exits 0 whatever the check says.";
 /** update-email-rule's --fail-on-expectations: the server refuses the write. */
-const UPDATE_FAIL_ON_EXPECTATIONS_HELP = "Refuse the write unless the rule, as this write would leave it, passes its expectations. It sends if_expectations_pass (over any in --body-file or --raw-body), so the server judges a new version, a restored one, a new scope or turning the rule active before saving, on its emails by id and its made-up emails, and saves nothing when one failed (exit 1), one is undecided (exit 3, or 1 when the rule cannot run as its author or a made-up email is undecided for no reason the answer gives) or the rule has none (exit 1). It can take as long as a test of the rule; the command waits for it. Judging needs a credential that reads the mail's content. A write the server does not judge (one changing only expectations, say) is saved, and the exit code then follows the answer's expectations_check, as on create. With --json, a refused write's document holds the API's error alone; a saved write's holds the rule.";
+const UPDATE_FAIL_ON_EXPECTATIONS_HELP = "Refuse the write unless the rule, as this write would leave it, passes its expectations. It sends if_expectations_pass (over any in --body-file or --raw-body), so the server judges a new version, a restored one, a new scope or turning the rule active before saving, on its emails by id and its made-up emails, and saves nothing when one failed (exit 1), one names an email the rule cannot read (exit 1, since sending again never decides it), one is undecided (exit 3, or 1 when the rule cannot run as its author or a made-up email is undecided for no reason the answer gives) or the rule has none (exit 1). It can take as long as a test of the rule; the command waits for it. Judging needs a credential that reads the mail's content. A write the server does not judge (one changing only expectations, say) is saved, and the exit code then follows the answer's expectations_check, as on create. With --json, a refused write's document holds the API's error alone; a saved write's holds the rule.";
 /** What a samples file flag reads. */
 const SAMPLES_FILE_SHAPE = "A JSON file of made-up emails the rule must match or not: an array such as [{\"expected\": \"no_match\", \"label\": \"a personal bill\", \"email\": {...}}], with email as test-email-rule-on-sample takes it (text up to 4,000 characters, at most 10 each of to, cc and attachment_types), like the one generate-look-alikes --samples-file writes, or a generate-look-alikes answer saved as it printed it.";
 const EXPECTATION_FLAG_NOTE = "Replaces any expect in --body-file or --raw-body. The answer reports them in expectations (passed, counts, results) and the exit code follows it; see --help-full.";
@@ -50704,6 +51234,15 @@ function expectationsGuardBodyFields(flags) {
 		value: true
 	}];
 }
+/**
+* The stderr report of end-email-rule-share: the answer's note, which says
+* the rule itself is left as it was (ending a share does not turn it off)
+* and, to the member who shared, how to stop it.
+*/
+function endEmailRuleShareReport(data) {
+	const note = isRecord(data) && typeof data.note === "string" ? data.note.trim() : "";
+	return { lines: note ? [note] : [] };
+}
 const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	testEmailRule: {
 		flags: {
@@ -50773,12 +51312,12 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 		report: writtenEmailRuleReport
 	},
 	generateLookAlikes: {
-		flags: { [LOOK_ALIKES_SAMPLES_FILE_FLAG]: Flags.string({ description: `Also write the look-alikes to this JSON file as made-up emails the rule must not match, a JSON array numbered from 1 in the order the report prints them. Save the ones you choose with create-email-rule --${SAMPLES_FILE_FLAG}, update-email-rule --${ADD_SAMPLES_FILE_FLAG} or, for a request, accept-email-rule-request --${SAMPLES_FILE_FLAG}, with --pick; test an edited rule on them with test-email-rule --${EXPECT_SAMPLES_FILE_FLAG}. Replaces the file if it exists, once the call succeeds; when no look-alikes came back it leaves the file as it was and exits 1.` }) },
+		flags: { [LOOK_ALIKES_SAMPLES_FILE_FLAG]: Flags.string({ description: `Also write the look-alikes to this JSON file as made-up emails the rule must match or not (each keeps its expected: most must not match, and a near case it should take must match), a JSON array numbered from 1 in the order the report prints them. Save the ones you choose with create-email-rule --${SAMPLES_FILE_FLAG}, update-email-rule --${ADD_SAMPLES_FILE_FLAG} or, for a request, accept-email-rule-request --${SAMPLES_FILE_FLAG}, with --pick; test an edited rule on them with test-email-rule --${EXPECT_SAMPLES_FILE_FLAG}. Replaces the file if it exists, once the call succeeds; when no look-alikes came back it leaves the file as it was and exits 1. The numbered report is printed on stderr, and only without --json, which prints exactly one JSON document and nothing on stderr; the answer's look_alikes and this file hold the same emails in the same order, so with --json the file still gives the numbered set to --pick from.` }) },
 		report: lookAlikesReport
 	},
 	acceptEmailRuleRequest: {
 		flags: {
-			[SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expectation_samples (at most 20), over any in --body-file or --raw-body: they are kept on the rule this accept writes, such as the look-alikes of the request it must never match.` }),
+			[SAMPLES_FILE_FLAG]: Flags.string({ description: `${SAMPLES_FILE_SHAPE} Sets expectation_samples (at most 20), over any in --body-file or --raw-body: they are kept on the rule this accept writes, such as the look-alikes of the request, each keeping whether it must match.` }),
 			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG]) })
 		},
 		bodyFields: samplesBodyFields(false),
@@ -50788,6 +51327,10 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 		flags: {},
 		report: compileEmailRuleReport
 	},
+	endEmailRuleShare: {
+		flags: {},
+		report: endEmailRuleShareReport
+	},
 	getEmailRule: {
 		flags: {},
 		report: getEmailRuleReport
@@ -52926,7 +53469,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-DNnNhhFr.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-Cre9Mt_2.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)
@@ -54321,7 +54864,7 @@ function createOperationCommand(operation) {
 						...tail ? { pastFlag: "--since" } : query.cursor !== void 0 ? { pastFlag: "--cursor" } : {},
 						nextCursor: tail ? null : more,
 						caller: tail || more ? null : await readCallerMailFor(auth, apiClient.client)
-					}) : EMPTY_RESULT_HINTS[operation.sdkName];
+					}) : emptyRuleListHint(operation.sdkName, query) ?? EMPTY_RESULT_HINTS[operation.sdkName];
 					if (hint && jsonOutput) summary.push(hint);
 					else if (hint) process.stderr.write(`${hint}\n`);
 				}
@@ -54398,6 +54941,30 @@ const EMPTY_RESULT_HINTS = {
 	listFilters: "(no results) No filter rules configured.",
 	listFunctions: "(no results) No Functions configured yet. Start with `primitive functions templates`, then `primitive functions init --template <template>` and `primitive functions deploy --name <name> --file <bundle>`."
 };
+/**
+* An empty rule request or share list, read by the filters the call left at
+* their defaults: each list shows only part of what you can see by default
+* (pending requests made to you; live shares made with you), so an empty
+* answer says which flags widen it. Undefined for any other list, when every
+* filter was given, or on a later page (--cursor), which is empty only past
+* the end.
+*/
+function emptyRuleListHint(sdkName, query) {
+	if (query.cursor !== void 0) return void 0;
+	const unset = (name) => query[name] === void 0;
+	const said = (noun, phrase, flags) => phrase === null ? void 0 : `(no results) No ${noun} match. By default this lists only ${phrase}: add \`${flags.join(" ")}\` to widen it.`;
+	if (sdkName === "listEmailRuleRequests") {
+		const box = unset("box");
+		const status = unset("status");
+		return said("requests", box && status ? "pending requests made to you" : box ? "requests made to you" : status ? "pending requests" : null, [...box ? ["--box all"] : [], ...status ? ["--status any"] : []]);
+	}
+	if (sdkName === "listEmailRuleShares") {
+		const box = unset("box");
+		const live = unset("live");
+		return said("shares", box && live ? "live shares made with you" : box ? "shares made with you" : live ? "live shares" : null, [...box ? ["--box all"] : [], ...live ? ["--live any"] : []]);
+	}
+	if (sdkName === "listGivenEmailRuleShares") return said("shares", unset("live") ? "live shares of your mail" : null, ["--live any"]);
+}
 function canonicalizeCliReferences(description) {
 	return description.replaceAll("`primitive emails:latest`", "`primitive emails latest`").replaceAll("`primitive describe emails:get-email | jq '.responseSchema.properties'`", "`primitive describe emails:get | jq '.responseSchema.properties'`");
 }