current-cli 0.1.28__tar.gz → 0.1.30__tar.gz

{current_cli-0.1.28 → current_cli-0.1.30}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: current-cli
-Version: 0.1.28
+Version: 0.1.30
 Summary: Command line interface for the Current API, generated from its OpenAPI schema at runtime
 Author-email: Orin <your-email@example.com>
 License-Expression: MIT

{current_cli-0.1.28 → current_cli-0.1.30}/current_cli/schema.yml

@@ -63,10 +63,170 @@ paths:
               schema:
                 $ref: '#/components/schemas/Me'
           description: ''
+  /api/accounts/auth/mfa/admin-reset/:
+    post:
+      operationId: accounts_auth_mfa_admin_reset_create
+      description: |-
+        Superadmin-only: clear a user's TOTP enrollment so they can enroll a
+        new device, for when they've lost their authenticator app. There are no
+        recovery codes, so this is the only way back in for such a user.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFAAdminResetRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFAAdminResetRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFAAdminResetRequestRequest'
+        required: true
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DetailResponse'
+          description: ''
+  /api/accounts/auth/mfa/confirm/:
+    post:
+      operationId: accounts_auth_mfa_confirm_create
+      description: |-
+        Confirm enrollment with a code from the authenticator app. Mid-login,
+        this also finishes sign-in (a confirmed device is proof of the second
+        factor); from Account Settings, it just turns MFA on.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFAConfirmRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFAConfirmRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFAConfirmRequestRequest'
+        required: true
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      - {}
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/VerifyMagicLinkResponse'
+          description: ''
+  /api/accounts/auth/mfa/disable/:
+    post:
+      operationId: accounts_auth_mfa_disable_create
+      description: |-
+        Turn off TOTP for the current user. Refused when MFA is still
+        required for this account (platform superadmin, a workspace admin
+        anywhere, or a workspace that requires it of members) — the setting
+        would just be silently re-enforced at the next sign-in otherwise.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFADisableRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFADisableRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFADisableRequestRequest'
+        required: true
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DetailResponse'
+          description: ''
+  /api/accounts/auth/mfa/setup/:
+    post:
+      operationId: accounts_auth_mfa_setup_create
+      description: |-
+        Start (or restart) TOTP enrollment: mints a new secret and returns
+        the otpauth:// URI for the authenticator app's QR scanner. Callable
+        mid-login (with the pending ticket) or from Account Settings (while
+        authenticated) — the secret isn't active until ``confirm`` succeeds.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFATicketRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFATicketRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFATicketRequestRequest'
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      - {}
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MFASetupResponse'
+          description: ''
+  /api/accounts/auth/mfa/verify/:
+    post:
+      operationId: accounts_auth_mfa_verify_create
+      description: |-
+        Complete sign-in with a code from an already-enrolled authenticator
+        app, exchanging the pending-login ticket for a real auth token.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFAVerifyRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFAVerifyRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFAVerifyRequestRequest'
+        required: true
+      security:
+      - {}
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/VerifyMagicLinkResponse'
+          description: ''
   /api/accounts/auth/verify/:
     post:
       operationId: accounts_auth_verify_create
-      description: Exchange a magic-link token for an auth token.
+      description: |-
+        Exchange a magic-link token for an auth token — or, when the account
+        needs a second factor, a short-lived ticket for the MFA challenge/setup
+        step instead. A real auth token is never issued before that second
+        factor is satisfied.
       tags:
       - accounts
       requestBody:
@@ -305,11 +465,8 @@ paths:
     delete:
       operationId: contacts_contacts_addresses_destroy
       description: |-
-        Remove an address. Editing a member contact is admin-only (same
-        as ``add_address``); removing a *verified* address is admin-only
-        regardless of contact, since verification is what makes an address
-        approval-capable — a member must not be able to unilaterally strip
-        that off their own directory entry.
+        Remove an address. Admin-only regardless of contact type or
+        verification state — a member can neither see nor mutate addresses.
       parameters:
       - in: path
         name: address_id
@@ -477,10 +634,10 @@ paths:
               schema:
                 $ref: '#/components/schemas/FileUrlResponse'
           description: ''
-  /api/inbox/inbox/:
+  /api/inboxes/inboxes/:
     get:
-      operationId: inbox_retrieve
-      description: Fetch (and lazily provision) the workspace's forwarding inbox.
+      operationId: inbox_list
+      description: List (and lazily provision) the workspace's inboxes, one per role.
       parameters:
       - in: query
         name: workspace
@@ -489,7 +646,36 @@ paths:
         description: Workspace UUID
         required: true
       tags:
-      - inbox
+      - inboxes
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/WorkspaceInbox'
+          description: ''
+  /api/inboxes/inboxes/{inbox_id}/allow-lists/:
+    get:
+      operationId: inbox_allow_lists_retrieve
+      description: |-
+        Inbox-scoped AgentMail receive and send allow lists.
+
+        Every workspace member can inspect the effective entries. Only workspace
+        admins can add or remove entries, matching other integration settings.
+      parameters:
+      - in: path
+        name: inbox_id
+        schema:
+          type: string
+          format: uuid
+        required: true
+      tags:
+      - inboxes
       security:
       - MessagingJobTokenAuth: []
       - tokenAuth: []
@@ -498,8 +684,83 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/WorkspaceInbox'
+                $ref: '#/components/schemas/EmailAllowLists'
+          description: ''
+    post:
+      operationId: inbox_allow_lists_create
+      description: |-
+        Inbox-scoped AgentMail receive and send allow lists.
+
+        Every workspace member can inspect the effective entries. Only workspace
+        admins can add or remove entries, matching other integration settings.
+      parameters:
+      - in: path
+        name: inbox_id
+        schema:
+          type: string
+          format: uuid
+        required: true
+      tags:
+      - inboxes
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/EmailAllowListMutationRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/EmailAllowListMutationRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/EmailAllowListMutationRequest'
+        required: true
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/EmailAllowListEntry'
           description: ''
+    delete:
+      operationId: inbox_allow_lists_destroy
+      description: |-
+        Inbox-scoped AgentMail receive and send allow lists.
+
+        Every workspace member can inspect the effective entries. Only workspace
+        admins can add or remove entries, matching other integration settings.
+      parameters:
+      - in: query
+        name: direction
+        schema:
+          type: string
+          enum:
+          - receive
+          - send
+        description: AgentMail allow-list direction
+        required: true
+      - in: query
+        name: entry
+        schema:
+          type: string
+        description: Email address or domain to remove
+        required: true
+      - in: path
+        name: inbox_id
+        schema:
+          type: string
+          format: uuid
+        required: true
+      tags:
+      - inboxes
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      responses:
+        '204':
+          description: No response body
   /api/integrations/connections/:
     get:
       operationId: integrations_connections_list
@@ -786,7 +1047,12 @@ paths:
   /api/integrations/messaging/react/:
     post:
       operationId: integrations_messaging_react
-      description: Add an emoji reaction to the message a reply_ref points at.
+      description: |-
+        Add an emoji reaction to the message a reply_ref points at.
+
+        Email has no reactions and is refused. An email job is not offered the
+        ``react`` tool at all, so reaching here means a caller sent something it
+        should not have.
       tags:
       - integrations
       requestBody:
@@ -821,7 +1087,8 @@ paths:
         the upload's ``initial_comment``). Teams cannot: a bot there has to
         offer each file through a FileConsentCard the recipient accepts, and
         only in a 1:1 chat, so the text posts first and each file follows as
-        its own offer.
+        its own offer. Email is the easy one — attachments are what it is for,
+        and they ride along on the reply.
       tags:
       - integrations
       requestBody:
@@ -896,6 +1163,10 @@ paths:
         ``append``/``stop`` replace the card in full, rebuilt from the chunks —
         the sandbox always sends its complete state, so the relay stays
         stateless.
+
+        Email has no live message to evolve and is refused. An email job builds
+        no reporter, so reaching here means a caller sent something it should
+        not have.
       tags:
       - integrations
       requestBody:
@@ -1263,8 +1534,10 @@ paths:
   /api/projects/projects/:
     get:
       operationId: projects_projects_list
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: query
         name: workspace
@@ -1287,8 +1560,10 @@ paths:
           description: ''
     post:
       operationId: projects_projects_create
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       tags:
       - projects
       requestBody:
@@ -1316,8 +1591,10 @@ paths:
   /api/projects/projects/{id}/:
     get:
       operationId: projects_projects_retrieve
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: path
         name: id
@@ -1340,8 +1617,10 @@ paths:
           description: ''
     put:
       operationId: projects_projects_update
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: path
         name: id
@@ -1376,8 +1655,10 @@ paths:
           description: ''
     patch:
       operationId: projects_projects_partial_update
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: path
         name: id
@@ -1411,8 +1692,10 @@ paths:
           description: ''
     delete:
       operationId: projects_projects_destroy
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: path
         name: id
@@ -2311,8 +2594,10 @@ paths:
   /api/workflows/workflows/:
     get:
       operationId: workflows_workflows_list
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: query
         name: workspace
@@ -2335,8 +2620,10 @@ paths:
           description: ''
     post:
       operationId: workflows_workflows_create
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       tags:
       - workflows
       requestBody:
@@ -2364,8 +2651,10 @@ paths:
   /api/workflows/workflows/{id}/:
     get:
       operationId: workflows_workflows_retrieve
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: path
         name: id
@@ -2388,8 +2677,10 @@ paths:
           description: ''
     put:
       operationId: workflows_workflows_update
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: path
         name: id
@@ -2424,8 +2715,10 @@ paths:
           description: ''
     patch:
       operationId: workflows_workflows_partial_update
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: path
         name: id
@@ -2459,8 +2752,10 @@ paths:
           description: ''
     delete:
       operationId: workflows_workflows_destroy
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: path
         name: id
@@ -3103,6 +3398,7 @@ components:
           type: array
           items:
             $ref: '#/components/schemas/ContactAddress'
+          nullable: true
           readOnly: true
         created_at:
           type: string
@@ -3166,18 +3462,6 @@ components:
       required:
       - kind
       - value
-    ContactAddressRequest:
-      type: object
-      properties:
-        kind:
-          $ref: '#/components/schemas/KindEnum'
-        value:
-          type: string
-          minLength: 1
-          maxLength: 255
-      required:
-      - kind
-      - value
     ContactListResponse:
       type: object
       description: |-
@@ -3246,6 +3530,64 @@ components:
           format: uuid
       required:
       - workspace
+    DetailResponse:
+      type: object
+      properties:
+        detail:
+          type: string
+      required:
+      - detail
+    DirectionEnum:
+      enum:
+      - receive
+      - send
+      type: string
+      description: |-
+        * `receive` - receive
+        * `send` - send
+    EmailAllowListEntry:
+      type: object
+      properties:
+        entry:
+          type: string
+        entry_type:
+          $ref: '#/components/schemas/EntryTypeEnum'
+        read_only:
+          type: boolean
+          default: false
+        created_at:
+          type: string
+          format: date-time
+      required:
+      - created_at
+      - entry
+      - entry_type
+    EmailAllowListMutationRequest:
+      type: object
+      properties:
+        direction:
+          $ref: '#/components/schemas/DirectionEnum'
+        entry:
+          type: string
+          minLength: 1
+          maxLength: 254
+      required:
+      - direction
+      - entry
+    EmailAllowLists:
+      type: object
+      properties:
+        receive:
+          type: array
+          items:
+            $ref: '#/components/schemas/EmailAllowListEntry'
+        send:
+          type: array
+          items:
+            $ref: '#/components/schemas/EmailAllowListEntry'
+      required:
+      - receive
+      - send
     EmojiEnum:
       enum:
       - eyes
@@ -3256,6 +3598,14 @@ components:
         * `eyes` - eyes
         * `heart` - heart
         * `thumbsup` - thumbsup
+    EntryTypeEnum:
+      enum:
+      - email
+      - domain
+      type: string
+      description: |-
+        * `email` - email
+        * `domain` - domain
     ErrorDetail:
       type: object
       properties:
@@ -3469,6 +3819,14 @@ components:
       required:
       - path
       - url
+    InboxRoleEnum:
+      enum:
+      - interaction
+      - ingest
+      type: string
+      description: |-
+        * `interaction` - Interaction
+        * `ingest` - Ingest
     IntegrationConnection:
       type: object
       description: |-
@@ -3588,6 +3946,67 @@ components:
           type: string
       required:
       - detail
+    MFAAdminResetRequestRequest:
+      type: object
+      properties:
+        email:
+          type: string
+          format: email
+          minLength: 1
+      required:
+      - email
+    MFAConfirmRequestRequest:
+      type: object
+      properties:
+        ticket:
+          type: string
+        code:
+          type: string
+          minLength: 1
+          maxLength: 8
+      required:
+      - code
+    MFADisableRequestRequest:
+      type: object
+      properties:
+        code:
+          type: string
+          minLength: 1
+          maxLength: 8
+      required:
+      - code
+    MFASetupResponse:
+      type: object
+      properties:
+        secret:
+          type: string
+        otpauth_url:
+          type: string
+      required:
+      - otpauth_url
+      - secret
+    MFATicketRequestRequest:
+      type: object
+      description: |-
+        A setup/confirm call during login carries the pending ticket instead
+        of an auth token, since issuing a real token before the second factor is
+        verified would defeat the point.
+      properties:
+        ticket:
+          type: string
+    MFAVerifyRequestRequest:
+      type: object
+      properties:
+        ticket:
+          type: string
+          minLength: 1
+        code:
+          type: string
+          minLength: 1
+          maxLength: 8
+      required:
+      - code
+      - ticket
     ManifestEntry:
       type: object
       properties:
@@ -3635,6 +4054,12 @@ components:
         is_superadmin:
           type: boolean
           readOnly: true
+        mfa_enabled:
+          type: boolean
+          readOnly: true
+        mfa_required:
+          type: boolean
+          readOnly: true
       required:
       - email
       - first_name
@@ -3642,6 +4067,8 @@ components:
       - is_superadmin
       - last_name
       - memberships
+      - mfa_enabled
+      - mfa_required
     MeMembership:
       type: object
       description: Inline workspace + role for the /auth/me/ payload.
@@ -4053,6 +4480,8 @@ components:
           type: string
           minLength: 1
           maxLength: 64
+        require_mfa_for_members:
+          type: boolean
     Project:
       type: object
       properties:
@@ -4894,14 +5323,25 @@ components:
       - token
     VerifyMagicLinkResponse:
       type: object
+      description: |-
+        Either a completed sign-in (``token`` + ``user``) or an MFA challenge
+        (``mfa_required`` true, with a ``ticket`` to carry into the next call).
       properties:
+        mfa_required:
+          type: boolean
+        mfa_enrolled:
+          type: boolean
+        ticket:
+          type: string
         token:
           type: string
+          nullable: true
         user:
-          $ref: '#/components/schemas/User'
+          allOf:
+          - $ref: '#/components/schemas/User'
+          nullable: true
       required:
-      - token
-      - user
+      - mfa_required
     Workflow:
       type: object
       properties:
@@ -5259,6 +5699,8 @@ components:
         timezone:
           type: string
           maxLength: 64
+        require_mfa_for_members:
+          type: boolean
       required:
       - created_at
       - id
@@ -5277,6 +5719,11 @@ components:
         address:
           type: string
           readOnly: true
+        role:
+          allOf:
+          - $ref: '#/components/schemas/InboxRoleEnum'
+          readOnly: true
+          default: interaction
         created_at:
           type: string
           format: date-time
@@ -5285,6 +5732,7 @@ components:
       - address
       - created_at
       - id
+      - role
       - workspace
     WorkspaceInvite:
       type: object
@@ -5388,6 +5836,8 @@ components:
           type: string
           minLength: 1
           maxLength: 64
+        require_mfa_for_members:
+          type: boolean
       required:
       - name
   securitySchemes:

{current_cli-0.1.28 → current_cli-0.1.30}/llms.txt

@@ -52,9 +52,68 @@ Current user with workspace memberships.
 
 GET /api/accounts/auth/me/
 
+### current accounts auth mfa admin-reset create
+
+Superadmin-only: clear a user's TOTP enrollment so they can enroll a
+new device, for when they've lost their authenticator app. There are no
+recovery codes, so this is the only way back in for such a user.
+
+POST /api/accounts/auth/mfa/admin-reset/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
+### current accounts auth mfa confirm create
+
+Confirm enrollment with a code from the authenticator app. Mid-login,
+this also finishes sign-in (a confirmed device is proof of the second
+factor); from Account Settings, it just turns MFA on.
+
+POST /api/accounts/auth/mfa/confirm/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
+### current accounts auth mfa disable create
+
+Turn off TOTP for the current user. Refused when MFA is still
+required for this account (platform superadmin, a workspace admin
+anywhere, or a workspace that requires it of members) — the setting
+would just be silently re-enforced at the next sign-in otherwise.
+
+POST /api/accounts/auth/mfa/disable/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
+### current accounts auth mfa setup create
+
+Start (or restart) TOTP enrollment: mints a new secret and returns
+the otpauth:// URI for the authenticator app's QR scanner. Callable
+mid-login (with the pending ticket) or from Account Settings (while
+authenticated) — the secret isn't active until ``confirm`` succeeds.
+
+POST /api/accounts/auth/mfa/setup/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
+### current accounts auth mfa verify create
+
+Complete sign-in with a code from an already-enrolled authenticator
+app, exchanging the pending-login ticket for a real auth token.
+
+POST /api/accounts/auth/mfa/verify/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
 ### current accounts auth verify create
 
-Exchange a magic-link token for an auth token.
+Exchange a magic-link token for an auth token — or, when the account
+needs a second factor, a short-lived ticket for the MFA challenge/setup
+step instead. A real auth token is never issued before that second
+factor is satisfied.
 
 POST /api/accounts/auth/verify/
 
@@ -86,11 +145,8 @@ Options:
 
 ### current contacts addresses destroy <id> <address_id>
 
-Remove an address. Editing a member contact is admin-only (same
-as ``add_address``); removing a *verified* address is admin-only
-regardless of contact, since verification is what makes an address
-approval-capable — a member must not be able to unilaterally strip
-that off their own directory entry.
+Remove an address. Admin-only regardless of contact type or
+verification state — a member can neither see nor mutate addresses.
 
 DELETE /api/contacts/contacts/{id}/addresses/{address_id}/
 
@@ -185,11 +241,45 @@ POST /api/files/upload-url/
 Options:
 - `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
 
-### current inbox retrieve
+### current inboxes allow-lists create <inbox_id>
+
+Inbox-scoped AgentMail receive and send allow lists.
+
+Every workspace member can inspect the effective entries. Only workspace
+admins can add or remove entries, matching other integration settings.
+
+POST /api/inboxes/inboxes/{inbox_id}/allow-lists/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
+### current inboxes allow-lists destroy <inbox_id>
 
-Fetch (and lazily provision) the workspace's forwarding inbox.
+Inbox-scoped AgentMail receive and send allow lists.
 
-GET /api/inbox/inbox/
+Every workspace member can inspect the effective entries. Only workspace
+admins can add or remove entries, matching other integration settings.
+
+DELETE /api/inboxes/inboxes/{inbox_id}/allow-lists/
+
+Options:
+- `--direction` - AgentMail allow-list direction
+- `--entry` - Email address or domain to remove
+
+### current inboxes allow-lists retrieve <inbox_id>
+
+Inbox-scoped AgentMail receive and send allow lists.
+
+Every workspace member can inspect the effective entries. Only workspace
+admins can add or remove entries, matching other integration settings.
+
+GET /api/inboxes/inboxes/{inbox_id}/allow-lists/
+
+### current inboxes list
+
+List (and lazily provision) the workspace's inboxes, one per role.
+
+GET /api/inboxes/inboxes/
 
 Options:
 - `--workspace` - Workspace UUID
@@ -308,6 +398,10 @@ Options:
 
 Add an emoji reaction to the message a reply_ref points at.
 
+Email has no reactions and is refused. An email job is not offered the
+``react`` tool at all, so reaching here means a caller sent something it
+should not have.
+
 POST /api/integrations/messaging/react/
 
 Options:
@@ -322,7 +416,8 @@ Slack shares the files and the text as one message (the text becomes
 the upload's ``initial_comment``). Teams cannot: a bot there has to
 offer each file through a FileConsentCard the recipient accepts, and
 only in a 1:1 chat, so the text posts first and each file follows as
-its own offer.
+its own offer. Email is the easy one — attachments are what it is for,
+and they ride along on the reply.
 
 POST /api/integrations/messaging/respond/
 
@@ -360,6 +455,10 @@ toggleable activity section) and returns its activity id as ``ts``;
 the sandbox always sends its complete state, so the relay stays
 stateless.
 
+Email has no live message to evolve and is refused. An email job builds
+no reporter, so reaching here means a caller sent something it should
+not have.
+
 POST /api/integrations/messaging/stream/
 
 Options:
@@ -427,7 +526,9 @@ GET /api/observations/observations/{id}/
 
 ### current projects create
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 POST /api/projects/projects/
 
@@ -436,7 +537,9 @@ Options:
 
 ### current projects destroy <id>
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 DELETE /api/projects/projects/{id}/
 
@@ -506,7 +609,9 @@ Options:
 
 ### current projects list
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 GET /api/projects/projects/
 
@@ -515,7 +620,9 @@ Options:
 
 ### current projects partial-update <id>
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 PATCH /api/projects/projects/{id}/
 
@@ -524,7 +631,9 @@ Options:
 
 ### current projects retrieve <id>
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 GET /api/projects/projects/{id}/
 
@@ -554,7 +663,9 @@ Options:
 
 ### current projects update <id>
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 PUT /api/projects/projects/{id}/
 
@@ -661,7 +772,9 @@ Show the current user and workspace memberships.
 
 ### current workflows create
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 POST /api/workflows/workflows/
 
@@ -702,13 +815,17 @@ GET /api/workflows/definitions/{id}/
 
 ### current workflows destroy <id>
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 DELETE /api/workflows/workflows/{id}/
 
 ### current workflows list
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 GET /api/workflows/workflows/
 
@@ -717,7 +834,9 @@ Options:
 
 ### current workflows partial-update <id>
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 PATCH /api/workflows/workflows/{id}/
 
@@ -726,7 +845,9 @@ Options:
 
 ### current workflows retrieve <id>
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 GET /api/workflows/workflows/{id}/
 
@@ -827,7 +948,9 @@ POST /api/workflows/runs/{id}/unarchive/
 
 ### current workflows update <id>
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 PUT /api/workflows/workflows/{id}/
 

{current_cli-0.1.28 → current_cli-0.1.30}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "current-cli"
-version = "0.1.28"
+version = "0.1.30"
 description = "Command line interface for the Current API, generated from its OpenAPI schema at runtime"
 readme = "README.md"
 requires-python = ">=3.10"

{current_cli-0.1.28 → current_cli-0.1.30}/tests/test_command_tree.py

@@ -45,7 +45,7 @@ def test_expected_command_paths(cli):
         ["workspaces", "members", "list"],
         ["workspaces", "invites", "accept", "create"],
         ["integrations", "connections", "channels", "list"],
-        ["inbox", "retrieve"],
+        ["inboxes", "list"],
     ]:
         _resolve(cli, parts)
 

{current_cli-0.1.28 → current_cli-0.1.30}/tests/test_requests.py

@@ -64,7 +64,7 @@ def test_default_workspace_fallback(cli, runner, transport_factory):
     config.set_value("default_workspace", "default-ws")
     transport = transport_factory(ok({}))
 
-    result = runner.invoke(cli, ["inbox", "retrieve"])
+    result = runner.invoke(cli, ["inboxes", "list"])
 
     assert result.exit_code == 0, result.output
     assert transport.requests[0].url.params["workspace"] == "default-ws"
@@ -73,7 +73,7 @@ def test_default_workspace_fallback(cli, runner, transport_factory):
 def test_required_workspace_missing_fails(cli, runner, transport_factory):
     transport = transport_factory(ok({}))
 
-    result = runner.invoke(cli, ["inbox", "retrieve"])
+    result = runner.invoke(cli, ["inboxes", "list"])
 
     assert result.exit_code != 0
     assert "--workspace" in result.output