primcli 3.0.0-preview.8 → 3.0.0-preview.9

package/dist/oclif/receiver-heal.js

@@ -1,7 +1,7 @@
 import { N as agentProfileDirectory, P as agentProfileName, R as loadConnectedAgentProfile, j as AGENT_PROFILE_ENV } from "../cli-config-Ms_0vNjq.js";
 import { a as backgroundListenStatus, i as backgroundListenRestartable, s as claimBackgroundListenRestart, t as BACKGROUND_LISTEN_RELAUNCH_ENV } from "../listen-background-DyBYca28.js";
-import { d as SESSION_UUID, t as notificationScope } from "../notify-session-CeIflLIX.js";
-import { Lt as detectAgentRuntime } from "../api-command-TUwewvqZ.js";
+import { d as SESSION_UUID, t as notificationScope } from "../notify-session-DHqBICIk.js";
+import { Lt as detectAgentRuntime } from "../api-command-DugUWmZH.js";
 import { d as readMailJson } from "../shared-mail-files-BAQSGxxz.js";
 import { join } from "node:path";
 import { spawn } from "node:child_process";

package/dist/{repeats-Dj_o6c-X-DNbrLjEF.js → repeats-Dj_o6c-X-DqcHvqvW.js}

@@ -131,6 +131,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getEmail: () => getEmail,
 	getEmailReadable: () => getEmailReadable,
 	getEmailRule: () => getEmailRule,
+	getEmailRuleCoveringMe: () => getEmailRuleCoveringMe,
 	getEmailRuleRequest: () => getEmailRuleRequest,
 	getEmailRuleScope: () => getEmailRuleScope,
 	getEmailRuleShare: () => getEmailRuleShare,
@@ -200,6 +201,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	listDomains: () => listDomains,
 	listEmailAttachmentArchiveMembers: () => listEmailAttachmentArchiveMembers,
 	listEmailRuleDecisions: () => listEmailRuleDecisions,
+	listEmailRuleDecisionsOnMyMail: () => listEmailRuleDecisionsOnMyMail,
 	listEmailRuleRequests: () => listEmailRuleRequests,
 	listEmailRuleResults: () => listEmailRuleResults,
 	listEmailRuleScopeOptions: () => listEmailRuleScopeOptions,
@@ -207,6 +209,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	listEmailRuleShares: () => listEmailRuleShares,
 	listEmailRuleVersions: () => listEmailRuleVersions,
 	listEmailRules: () => listEmailRules,
+	listEmailRulesCoveringMe: () => listEmailRulesCoveringMe,
 	listEmails: () => listEmails,
 	listEndpoints: () => listEndpoints,
 	listFilters: () => listFilters,
@@ -639,7 +642,7 @@ const getAccount = (options) => (options?.client ?? client).get({
 /**
 * Update account settings
 *
-* Update the mutable account settings (such as display name and notification preferences) for the authenticated organization.
+* Update the organization's spam threshold (spam_threshold) and whether an email's content is discarded once a webhook confirms receipt (discard_content_on_webhook_confirmed), the opt-in POST /emails/{id}/discard-content needs.
 */
 const updateAccount = (options) => (options.client ?? client).patch({
 	security: [{
@@ -3626,7 +3629,7 @@ const getEmailRuleVocabulary = (options) => (options?.client ?? client).get({
 /**
 * Compile a rule description
 *
-* Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to five yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+* Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to five yes/no questions, asked about an email only after its conditions match; they read its subject, its new text and its attachments' file names, never what is inside an attachment, and warnings say when a question mentions attachments. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default): breadth is that count, and a warning says when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const compileEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3658,9 +3661,9 @@ const testEmailRule = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Write look-alike emails a rule should not match
+* Write look-alike emails a rule should or should not match
 *
-* Writes made-up emails that come close to what a grant rule describes but are private (a personal medical bill, pay for named people, a personal purchase, personal banking or tax, or another near case), and reports what the rule decides for each, as test-sample would. failed means the rule matched it, so it would be shared. Nothing is stored and no mail is read. Keep the ones it must never match with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+* Writes made-up emails that come close to what a grant rule describes, and reports what the rule decides for each, as test-sample would. Most should not match (expected no_match): business near misses from its senders and topic (kind other: an all-clear, a reply with nothing new, a related document, another subject) and private mail (a personal medical bill, pay for named people, a personal purchase, personal banking or tax). By default a third, rounded down, are near cases it should match (expected match, kind other). failed means the rule decided one against expected. Nothing is stored and no mail is read. Keep them, with their expected, with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const generateLookAlikes = (options) => (options.client ?? client).post({
 	security: [{
@@ -3780,7 +3783,7 @@ const listEmailRuleDecisions = (options) => (options.client ?? client).get({
 /**
 * List every rule's result on an email
 *
-* Every rule you can see and what it decided about this email (matched, not matched, or not run, with what is known), in the words of the version that decided. A matched do_not_share rule keeps rules from sharing the email while it is active; what was shared before then stays shared. Only a caller who can read the email gets an answer. classification is what the classifier read from the email, every fact as rule conditions read it, so you can see why a rule did or did not match. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+* What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only); hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleResults = (options) => (options.client ?? client).get({
 	security: [{
@@ -3978,7 +3981,7 @@ const listGivenEmailRuleShares = (options) => (options?.client ?? client).get({
 /**
 * End a rule share
 *
-* Stops sharing. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.
+* Stops sharing; the rule itself is left unchanged, as the answer's note says. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.
 */
 const endEmailRuleShare = (options) => (options.client ?? client).delete({
 	security: [{
@@ -4015,6 +4018,45 @@ const listEmailRuleShareEmails = (options) => (options.client ?? client).get({
 	...options
 });
 /**
+* List the rules over your mail
+*
+* Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const listEmailRulesCoveringMe = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/covering-me",
+	...options
+});
+/**
+* Get a rule over your mail
+*
+* One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const getEmailRuleCoveringMe = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/covering-me/{id}",
+	...options
+});
+/**
+* List what a rule decided about your mail
+*
+* What a rule that covers your mailboxes, or decided on your mail, decided about mail at your own mailboxes, newest first: never about anyone else's mail. Each decision is in the words of the version that made it, which can be earlier than the current one: the questions it asked about that email (question_answers) and the columns its conditions read (parts). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const listEmailRuleDecisionsOnMyMail = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/covering-me/{id}/decisions",
+	...options
+});
+/**
 * Get a domain's Agent Authorization status
 *
 * Whether the domain publishes an Agent Authorization (`_agents`) TXT record that lets agents on Primitive email it, read from DNS with the same engine the send path uses (an answer may be up to five minutes old): published (a record authorizes them), published_unauthorized (a record exists but does not), not_set_up (no record, the default) or inconclusive (the lookup could not tell; retry). The domain is one of the organization's, verified or pending; a credential confined to some mailboxes sees only the domains its scope covers. Needs domains:read.
@@ -5220,7 +5262,7 @@ const updateSearchSettings = (options) => (options.client ?? client).put({
 /**
 * List roles
 *
-* Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Any person (a session or OAuth token); API keys are refused.
+* Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Needs members:read (owners, admins, members and roles that grant it); API keys are refused.
 */
 const listRoles = (options) => (options?.client ?? client).get({
 	security: [{
@@ -5323,7 +5365,7 @@ const leaveOrganization = (options) => (options?.client ?? client).post({
 /**
 * Get the mailbox access mode
 *
-* Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Any person; API keys are refused.
+* Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Needs members:read (owners, admins, members and roles that grant it); API keys are refused.
 */
 const getAccessMode = (options) => (options?.client ?? client).get({
 	security: [{

package/dist/{scoped-chat-Dd3P8Q-m.js → scoped-chat-BpUAgX4g.js}

@@ -1,4 +1,4 @@
-import { Z as isTrustedSender, b as retryTransient, c as classifySignalContent } from "./repeats-Dj_o6c-X-DNbrLjEF.js";
+import { Z as isTrustedSender, b as retryTransient, c as classifySignalContent } from "./repeats-Dj_o6c-X-DqcHvqvW.js";
 // src/oclif/presence-provenance.ts
 function readPresenceProjection(detail) {
 	if (!detail || typeof detail !== "object") return null;

package/dist/{signal-command-DZQemE9I.js → signal-command-B66YR0-A.js}

@@ -1,15 +1,15 @@
-import { Dn as listSentEmails, Ht as getEmail, Jn as sendEmail, _ as describeApiFailure, h as sendPreparedSignal, p as prepareSignalEmail, vt as createEndpoint } from "./repeats-Dj_o6c-X-DNbrLjEF.js";
-import { Dt as successfulSendOutcome, dt as classifySendError, j as bareAddress, s as extractErrorPayload } from "./api-command-TUwewvqZ.js";
+import { Dn as listSentEmails, Ht as getEmail, Jn as sendEmail, _ as describeApiFailure, h as sendPreparedSignal, p as prepareSignalEmail, vt as createEndpoint } from "./repeats-Dj_o6c-X-DqcHvqvW.js";
+import { Dt as successfulSendOutcome, dt as classifySendError, j as bareAddress, s as extractErrorPayload } from "./api-command-DugUWmZH.js";
 import { recordSentSignal } from "./oclif/auto-signals.js";
 import { _ as acquireListenLock, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, x as listenProcessIdentity, y as listenIdentity } from "./shared-mail-files-BAQSGxxz.js";
-import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-Dd3P8Q-m.js";
+import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-BpUAgX4g.js";
 import { n as tryOwnSharedMail, r as waitForSharedMailChange, t as readSharedMailOwner } from "./shared-mail-watch-BAPMsFNv.js";
 import { Errors } from "@oclif/core";
 import { opendirSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
 import { dirname, join } from "node:path";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-// ../sdk-node/dist/api-DgCLd6eH.js
+// ../sdk-node/dist/api-0hVC21_i.js
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
 	let lastEventId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "3.0.0-preview.8",
+  "version": "3.0.0-preview.9",
   "publishConfig": {
     "tag": "preview"
   },
@@ -191,6 +191,9 @@
       "email-rules": {
         "description": "Rules written in plain English that pick out received mail"
       },
+      "email-rule-oversight": {
+        "description": "The email rules that reach your own mailboxes, whoever wrote them, read-only"
+      },
       "routes": {
         "description": "Manage recipient routes. Bind an address pattern to an endpoint or function: `primitive routes add alice@d --function <id>`, `primitive routes list`, `primitive routes test <recipient>`, `primitive routes remove <id>`."
       },