lockally 0.3.2__tar.gz → 0.3.3__tar.gz

{lockally-0.3.2 → lockally-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lockally
-Version: 0.3.2
+Version: 0.3.3
 Summary: lockally control plane
 Home-page: 
 Author: lockally support
@@ -52,7 +52,7 @@ Insufficient scope returns `403` with the required scope name in `detail`.
 This Python package is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
 
 - API version: 0.1.0
-- Package version: 0.3.2
+- Package version: 0.3.3
 - Generator version: 7.23.0
 - Build package: org.openapitools.codegen.languages.PythonClientCodegen
 

{lockally-0.3.2 → lockally-0.3.3}/README.md

@@ -32,7 +32,7 @@ Insufficient scope returns `403` with the required scope name in `detail`.
 This Python package is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
 
 - API version: 0.1.0
-- Package version: 0.3.2
+- Package version: 0.3.3
 - Generator version: 7.23.0
 - Build package: org.openapitools.codegen.languages.PythonClientCodegen
 

{lockally-0.3.2 → lockally-0.3.3}/lockally/__init__.py

@@ -15,7 +15,7 @@
 """  # noqa: E501
 
 
-__version__ = "0.3.2"
+__version__ = "0.3.3"
 
 # Define package exports
 __all__ = [

{lockally-0.3.2 → lockally-0.3.3}/lockally/api/admin_api.py

@@ -57,7 +57,7 @@ class AdminApi:
     ) -> AdminLogin200Response:
         """Tenant-admin email+password login
 
-        Exchanges an admin's email + password for a session token. The web console at `app.lockally.com` posts this on form submission and stores the returned token in an httpOnly cookie.  **No enumeration leak.** Wrong-email and wrong-password both return the same 401 with title \"Invalid credentials\". The argon2id verify runs even on lookup miss (well, structurally — the lookup fails fast but the response shape is constant) so timing leaks are bounded.  Tokens are prefixed `adm_sess_` and valid for 7 days. Use as the `Authorization: Bearer` value on all subsequent calls. 
+        Exchanges an admin's email + password for a session token. The web console at `app.lockally.com` posts this on form submission and stores the returned token in an httpOnly cookie.  **No enumeration leak.** Wrong-email and wrong-password both return the same 401 with title \"Invalid credentials\". The argon2id verify runs even on lookup miss (well, structurally, the lookup fails fast but the response shape is constant) so timing leaks are bounded.  Tokens are prefixed `adm_sess_` and valid for 7 days. Use as the `Authorization: Bearer` value on all subsequent calls. 
 
         :param admin_login_request: (required)
         :type admin_login_request: AdminLoginRequest
@@ -127,7 +127,7 @@ class AdminApi:
     ) -> ApiResponse[AdminLogin200Response]:
         """Tenant-admin email+password login
 
-        Exchanges an admin's email + password for a session token. The web console at `app.lockally.com` posts this on form submission and stores the returned token in an httpOnly cookie.  **No enumeration leak.** Wrong-email and wrong-password both return the same 401 with title \"Invalid credentials\". The argon2id verify runs even on lookup miss (well, structurally — the lookup fails fast but the response shape is constant) so timing leaks are bounded.  Tokens are prefixed `adm_sess_` and valid for 7 days. Use as the `Authorization: Bearer` value on all subsequent calls. 
+        Exchanges an admin's email + password for a session token. The web console at `app.lockally.com` posts this on form submission and stores the returned token in an httpOnly cookie.  **No enumeration leak.** Wrong-email and wrong-password both return the same 401 with title \"Invalid credentials\". The argon2id verify runs even on lookup miss (well, structurally, the lookup fails fast but the response shape is constant) so timing leaks are bounded.  Tokens are prefixed `adm_sess_` and valid for 7 days. Use as the `Authorization: Bearer` value on all subsequent calls. 
 
         :param admin_login_request: (required)
         :type admin_login_request: AdminLoginRequest
@@ -197,7 +197,7 @@ class AdminApi:
     ) -> RESTResponseType:
         """Tenant-admin email+password login
 
-        Exchanges an admin's email + password for a session token. The web console at `app.lockally.com` posts this on form submission and stores the returned token in an httpOnly cookie.  **No enumeration leak.** Wrong-email and wrong-password both return the same 401 with title \"Invalid credentials\". The argon2id verify runs even on lookup miss (well, structurally — the lookup fails fast but the response shape is constant) so timing leaks are bounded.  Tokens are prefixed `adm_sess_` and valid for 7 days. Use as the `Authorization: Bearer` value on all subsequent calls. 
+        Exchanges an admin's email + password for a session token. The web console at `app.lockally.com` posts this on form submission and stores the returned token in an httpOnly cookie.  **No enumeration leak.** Wrong-email and wrong-password both return the same 401 with title \"Invalid credentials\". The argon2id verify runs even on lookup miss (well, structurally, the lookup fails fast but the response shape is constant) so timing leaks are bounded.  Tokens are prefixed `adm_sess_` and valid for 7 days. Use as the `Authorization: Bearer` value on all subsequent calls. 
 
         :param admin_login_request: (required)
         :type admin_login_request: AdminLoginRequest
@@ -339,7 +339,7 @@ class AdminApi:
     ) -> None:
         """Invalidate the current admin session
 
-        Deletes the session row from the database. Idempotent — calling logout on an already-invalid token returns 204 anyway. 
+        Deletes the session row from the database. Idempotent, calling logout on an already-invalid token returns 204 anyway. 
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -404,7 +404,7 @@ class AdminApi:
     ) -> ApiResponse[None]:
         """Invalidate the current admin session
 
-        Deletes the session row from the database. Idempotent — calling logout on an already-invalid token returns 204 anyway. 
+        Deletes the session row from the database. Idempotent, calling logout on an already-invalid token returns 204 anyway. 
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -469,7 +469,7 @@ class AdminApi:
     ) -> RESTResponseType:
         """Invalidate the current admin session
 
-        Deletes the session row from the database. Idempotent — calling logout on an already-invalid token returns 204 anyway. 
+        Deletes the session row from the database. Idempotent, calling logout on an already-invalid token returns 204 anyway. 
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -591,7 +591,7 @@ class AdminApi:
     ) -> GetCurrentAdmin200Response:
         """Get the current admin + tenant
 
-        Returns the admin profile + tenant for the session token presented in `Authorization: Bearer`. Used by the web console's layout load function to populate the sidebar.  Returns 403 if called with an API key (lk_live_*) bearer — admin context only exists for session tokens. 
+        Returns the admin profile + tenant for the session token presented in `Authorization: Bearer`. Used by the web console's layout load function to populate the sidebar.  Returns 403 if called with an API key (lk_live_*) bearer, admin context only exists for session tokens. 
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -656,7 +656,7 @@ class AdminApi:
     ) -> ApiResponse[GetCurrentAdmin200Response]:
         """Get the current admin + tenant
 
-        Returns the admin profile + tenant for the session token presented in `Authorization: Bearer`. Used by the web console's layout load function to populate the sidebar.  Returns 403 if called with an API key (lk_live_*) bearer — admin context only exists for session tokens. 
+        Returns the admin profile + tenant for the session token presented in `Authorization: Bearer`. Used by the web console's layout load function to populate the sidebar.  Returns 403 if called with an API key (lk_live_*) bearer, admin context only exists for session tokens. 
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -721,7 +721,7 @@ class AdminApi:
     ) -> RESTResponseType:
         """Get the current admin + tenant
 
-        Returns the admin profile + tenant for the session token presented in `Authorization: Bearer`. Used by the web console's layout load function to populate the sidebar.  Returns 403 if called with an API key (lk_live_*) bearer — admin context only exists for session tokens. 
+        Returns the admin profile + tenant for the session token presented in `Authorization: Bearer`. Used by the web console's layout load function to populate the sidebar.  Returns 403 if called with an API key (lk_live_*) bearer, admin context only exists for session tokens. 
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request

{lockally-0.3.2 → lockally-0.3.3}/lockally/api/admins_api.py

@@ -870,7 +870,7 @@ class AdminsApi:
     ) -> AdminFull:
         """Update an admin
 
-        Supply at least one of `password`, `display_name`, `role`, `disabled`.  **Safety rails.** A session bearer (adm_sess_*) cannot disable itself — use another admin or an API key (which bypasses the self-rail). Disabling the last active admin returns 409 to prevent orphaning the tenant from its console. 
+        Supply at least one of `password`, `display_name`, `role`, `disabled`.  **Safety rails.** A session bearer (adm_sess_*) cannot disable itself, use another admin or an API key (which bypasses the self-rail). Disabling the last active admin returns 409 to prevent orphaning the tenant from its console. 
 
         :param id: (required)
         :type id: UUID
@@ -946,7 +946,7 @@ class AdminsApi:
     ) -> ApiResponse[AdminFull]:
         """Update an admin
 
-        Supply at least one of `password`, `display_name`, `role`, `disabled`.  **Safety rails.** A session bearer (adm_sess_*) cannot disable itself — use another admin or an API key (which bypasses the self-rail). Disabling the last active admin returns 409 to prevent orphaning the tenant from its console. 
+        Supply at least one of `password`, `display_name`, `role`, `disabled`.  **Safety rails.** A session bearer (adm_sess_*) cannot disable itself, use another admin or an API key (which bypasses the self-rail). Disabling the last active admin returns 409 to prevent orphaning the tenant from its console. 
 
         :param id: (required)
         :type id: UUID
@@ -1022,7 +1022,7 @@ class AdminsApi:
     ) -> RESTResponseType:
         """Update an admin
 
-        Supply at least one of `password`, `display_name`, `role`, `disabled`.  **Safety rails.** A session bearer (adm_sess_*) cannot disable itself — use another admin or an API key (which bypasses the self-rail). Disabling the last active admin returns 409 to prevent orphaning the tenant from its console. 
+        Supply at least one of `password`, `display_name`, `role`, `disabled`.  **Safety rails.** A session bearer (adm_sess_*) cannot disable itself, use another admin or an API key (which bypasses the self-rail). Disabling the last active admin returns 409 to prevent orphaning the tenant from its console. 
 
         :param id: (required)
         :type id: UUID

{lockally-0.3.2 → lockally-0.3.3}/lockally/api/agents_api.py

@@ -888,7 +888,7 @@ class AgentsApi:
     ) -> MailboxGrant:
         """Grant a mailbox to a key
 
-        Body: {\"mailbox\": \"email or id\"}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key — the server cannot read E2E mailboxes.
+        Body: {\"mailbox\": \"email or id\"}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key, the server cannot read E2E mailboxes.
 
         :param key_id: (required)
         :type key_id: UUID
@@ -956,7 +956,7 @@ class AgentsApi:
     ) -> ApiResponse[MailboxGrant]:
         """Grant a mailbox to a key
 
-        Body: {\"mailbox\": \"email or id\"}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key — the server cannot read E2E mailboxes.
+        Body: {\"mailbox\": \"email or id\"}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key, the server cannot read E2E mailboxes.
 
         :param key_id: (required)
         :type key_id: UUID
@@ -1024,7 +1024,7 @@ class AgentsApi:
     ) -> RESTResponseType:
         """Grant a mailbox to a key
 
-        Body: {\"mailbox\": \"email or id\"}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key — the server cannot read E2E mailboxes.
+        Body: {\"mailbox\": \"email or id\"}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key, the server cannot read E2E mailboxes.
 
         :param key_id: (required)
         :type key_id: UUID
@@ -2526,7 +2526,7 @@ class AgentsApi:
     ) -> AgentSendResult:
         """Reply in-thread (agent stream)
 
-        The server builds In-Reply-To/References and defaults recipients + subject from the conversation — a minimal call is {\"text\": \"...\"}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
+        The server builds In-Reply-To/References and defaults recipients + subject from the conversation, a minimal call is {\"text\": \"...\"}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
 
         :param thread_id: (required)
         :type thread_id: UUID
@@ -2597,7 +2597,7 @@ class AgentsApi:
     ) -> ApiResponse[AgentSendResult]:
         """Reply in-thread (agent stream)
 
-        The server builds In-Reply-To/References and defaults recipients + subject from the conversation — a minimal call is {\"text\": \"...\"}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
+        The server builds In-Reply-To/References and defaults recipients + subject from the conversation, a minimal call is {\"text\": \"...\"}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
 
         :param thread_id: (required)
         :type thread_id: UUID
@@ -2668,7 +2668,7 @@ class AgentsApi:
     ) -> RESTResponseType:
         """Reply in-thread (agent stream)
 
-        The server builds In-Reply-To/References and defaults recipients + subject from the conversation — a minimal call is {\"text\": \"...\"}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
+        The server builds In-Reply-To/References and defaults recipients + subject from the conversation, a minimal call is {\"text\": \"...\"}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
 
         :param thread_id: (required)
         :type thread_id: UUID

{lockally-0.3.2 → lockally-0.3.3}/lockally/api/ai_api.py

@@ -62,7 +62,7 @@ class AiApi:
     ) -> ThreadClassification:
         """LLM-classify a thread
 
-        Returns {intent, urgency, summary, suggested_action} via the tenant's AI tier (BYOK or prepaid units — see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh=true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
+        Returns {intent, urgency, summary, suggested_action} via the tenant's AI tier (BYOK or prepaid units, see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh=true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
 
         :param thread_id: (required)
         :type thread_id: UUID
@@ -134,7 +134,7 @@ class AiApi:
     ) -> ApiResponse[ThreadClassification]:
         """LLM-classify a thread
 
-        Returns {intent, urgency, summary, suggested_action} via the tenant's AI tier (BYOK or prepaid units — see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh=true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
+        Returns {intent, urgency, summary, suggested_action} via the tenant's AI tier (BYOK or prepaid units, see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh=true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
 
         :param thread_id: (required)
         :type thread_id: UUID
@@ -206,7 +206,7 @@ class AiApi:
     ) -> RESTResponseType:
         """LLM-classify a thread
 
-        Returns {intent, urgency, summary, suggested_action} via the tenant's AI tier (BYOK or prepaid units — see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh=true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
+        Returns {intent, urgency, summary, suggested_action} via the tenant's AI tier (BYOK or prepaid units, see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh=true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
 
         :param thread_id: (required)
         :type thread_id: UUID

{lockally-0.3.2 → lockally-0.3.3}/lockally/api/aliases_api.py

@@ -345,7 +345,7 @@ class AliasesApi:
     ) -> None:
         """Delete an alias
 
-        Hard-delete (no soft-delete window — aliases are cheap to recreate).
+        Hard-delete (no soft-delete window, aliases are cheap to recreate).
 
         :param address: (required)
         :type address: str
@@ -415,7 +415,7 @@ class AliasesApi:
     ) -> ApiResponse[None]:
         """Delete an alias
 
-        Hard-delete (no soft-delete window — aliases are cheap to recreate).
+        Hard-delete (no soft-delete window, aliases are cheap to recreate).
 
         :param address: (required)
         :type address: str
@@ -485,7 +485,7 @@ class AliasesApi:
     ) -> RESTResponseType:
         """Delete an alias
 
-        Hard-delete (no soft-delete window — aliases are cheap to recreate).
+        Hard-delete (no soft-delete window, aliases are cheap to recreate).
 
         :param address: (required)
         :type address: str

{lockally-0.3.2 → lockally-0.3.3}/lockally/api/api_keys_api.py

@@ -58,7 +58,7 @@ class ApiKeysApi:
     ) -> CreateApiKey201Response:
         """Create an API key
 
-        Provisions a fresh API key for the calling tenant.  **The full `secret` is included in this response ONLY** — store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
+        Provisions a fresh API key for the calling tenant.  **The full `secret` is included in this response ONLY**, store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
 
         :param create_api_key_request: (required)
         :type create_api_key_request: CreateApiKeyRequest
@@ -128,7 +128,7 @@ class ApiKeysApi:
     ) -> ApiResponse[CreateApiKey201Response]:
         """Create an API key
 
-        Provisions a fresh API key for the calling tenant.  **The full `secret` is included in this response ONLY** — store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
+        Provisions a fresh API key for the calling tenant.  **The full `secret` is included in this response ONLY**, store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
 
         :param create_api_key_request: (required)
         :type create_api_key_request: CreateApiKeyRequest
@@ -198,7 +198,7 @@ class ApiKeysApi:
     ) -> RESTResponseType:
         """Create an API key
 
-        Provisions a fresh API key for the calling tenant.  **The full `secret` is included in this response ONLY** — store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
+        Provisions a fresh API key for the calling tenant.  **The full `secret` is included in this response ONLY**, store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
 
         :param create_api_key_request: (required)
         :type create_api_key_request: CreateApiKeyRequest
@@ -341,7 +341,7 @@ class ApiKeysApi:
     ) -> ListApiKeys200Response:
         """List API keys
 
-        Returns all API keys (active and revoked) belonging to the calling tenant. The `secret` is **never** returned — only prefix + metadata. 
+        Returns all API keys (active and revoked) belonging to the calling tenant. The `secret` is **never** returned, only prefix + metadata. 
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -406,7 +406,7 @@ class ApiKeysApi:
     ) -> ApiResponse[ListApiKeys200Response]:
         """List API keys
 
-        Returns all API keys (active and revoked) belonging to the calling tenant. The `secret` is **never** returned — only prefix + metadata. 
+        Returns all API keys (active and revoked) belonging to the calling tenant. The `secret` is **never** returned, only prefix + metadata. 
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -471,7 +471,7 @@ class ApiKeysApi:
     ) -> RESTResponseType:
         """List API keys
 
-        Returns all API keys (active and revoked) belonging to the calling tenant. The `secret` is **never** returned — only prefix + metadata. 
+        Returns all API keys (active and revoked) belonging to the calling tenant. The `secret` is **never** returned, only prefix + metadata. 
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -595,7 +595,7 @@ class ApiKeysApi:
     ) -> None:
         """Revoke an API key
 
-        Soft-deletes (sets `revoked_at`) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call — that would lock you out. Use a different `tenant:admin` key. 
+        Soft-deletes (sets `revoked_at`) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call, that would lock you out. Use a different `tenant:admin` key. 
 
         :param id: (required)
         :type id: UUID
@@ -666,7 +666,7 @@ class ApiKeysApi:
     ) -> ApiResponse[None]:
         """Revoke an API key
 
-        Soft-deletes (sets `revoked_at`) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call — that would lock you out. Use a different `tenant:admin` key. 
+        Soft-deletes (sets `revoked_at`) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call, that would lock you out. Use a different `tenant:admin` key. 
 
         :param id: (required)
         :type id: UUID
@@ -737,7 +737,7 @@ class ApiKeysApi:
     ) -> RESTResponseType:
         """Revoke an API key
 
-        Soft-deletes (sets `revoked_at`) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call — that would lock you out. Use a different `tenant:admin` key. 
+        Soft-deletes (sets `revoked_at`) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call, that would lock you out. Use a different `tenant:admin` key. 
 
         :param id: (required)
         :type id: UUID

{lockally-0.3.2 → lockally-0.3.3}/lockally/api/domains_api.py

@@ -59,7 +59,7 @@ class DomainsApi:
     ) -> Domain:
         """Register a domain
 
-        Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to `mx1`/`mx2.lockally.com`, DMARC seed).  **Idempotent** — re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant's published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
+        Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to `mx1`/`mx2.lockally.com`, DMARC seed).  **Idempotent**, re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant's published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
 
         :param create_domain_request: (required)
         :type create_domain_request: CreateDomainRequest
@@ -131,7 +131,7 @@ class DomainsApi:
     ) -> ApiResponse[Domain]:
         """Register a domain
 
-        Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to `mx1`/`mx2.lockally.com`, DMARC seed).  **Idempotent** — re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant's published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
+        Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to `mx1`/`mx2.lockally.com`, DMARC seed).  **Idempotent**, re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant's published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
 
         :param create_domain_request: (required)
         :type create_domain_request: CreateDomainRequest
@@ -203,7 +203,7 @@ class DomainsApi:
     ) -> RESTResponseType:
         """Register a domain
 
-        Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to `mx1`/`mx2.lockally.com`, DMARC seed).  **Idempotent** — re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant's published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
+        Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to `mx1`/`mx2.lockally.com`, DMARC seed).  **Idempotent**, re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant's published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
 
         :param create_domain_request: (required)
         :type create_domain_request: CreateDomainRequest
@@ -349,7 +349,7 @@ class DomainsApi:
     ) -> None:
         """Delete a domain
 
-        Removes the domain registration. Refuses with 409 if any mailbox is still attached — delete the mailboxes first. 
+        Removes the domain registration. Refuses with 409 if any mailbox is still attached, delete the mailboxes first. 
 
         :param domain: (required)
         :type domain: str
@@ -420,7 +420,7 @@ class DomainsApi:
     ) -> ApiResponse[None]:
         """Delete a domain
 
-        Removes the domain registration. Refuses with 409 if any mailbox is still attached — delete the mailboxes first. 
+        Removes the domain registration. Refuses with 409 if any mailbox is still attached, delete the mailboxes first. 
 
         :param domain: (required)
         :type domain: str
@@ -491,7 +491,7 @@ class DomainsApi:
     ) -> RESTResponseType:
         """Delete a domain
 
-        Removes the domain registration. Refuses with 409 if any mailbox is still attached — delete the mailboxes first. 
+        Removes the domain registration. Refuses with 409 if any mailbox is still attached, delete the mailboxes first. 
 
         :param domain: (required)
         :type domain: str
@@ -1958,7 +1958,7 @@ class DomainsApi:
     ) -> Domain:
         """Force-poll DNS verification
 
-        Synchronously checks the `_lockally-verify.<domain>` TXT record against the stored verification token. Returns 200 either way: the returned `verified` boolean tells you whether DNS now confirms. Caller polls until `verified: true`. In v2 a background worker auto-polls and fires a `domain.verified` webhook. 
+        Synchronously checks the `_lockally-verify.<domain>` TXT record against the stored verification token. Returns 200 either way: the returned `verified` boolean tells you whether DNS now confirms. Caller polls until `verified: true`. A later version may have the platform auto-polls and fires a `domain.verified` webhook. 
 
         :param domain: (required)
         :type domain: str
@@ -2029,7 +2029,7 @@ class DomainsApi:
     ) -> ApiResponse[Domain]:
         """Force-poll DNS verification
 
-        Synchronously checks the `_lockally-verify.<domain>` TXT record against the stored verification token. Returns 200 either way: the returned `verified` boolean tells you whether DNS now confirms. Caller polls until `verified: true`. In v2 a background worker auto-polls and fires a `domain.verified` webhook. 
+        Synchronously checks the `_lockally-verify.<domain>` TXT record against the stored verification token. Returns 200 either way: the returned `verified` boolean tells you whether DNS now confirms. Caller polls until `verified: true`. A later version may have the platform auto-polls and fires a `domain.verified` webhook. 
 
         :param domain: (required)
         :type domain: str
@@ -2100,7 +2100,7 @@ class DomainsApi:
     ) -> RESTResponseType:
         """Force-poll DNS verification
 
-        Synchronously checks the `_lockally-verify.<domain>` TXT record against the stored verification token. Returns 200 either way: the returned `verified` boolean tells you whether DNS now confirms. Caller polls until `verified: true`. In v2 a background worker auto-polls and fires a `domain.verified` webhook. 
+        Synchronously checks the `_lockally-verify.<domain>` TXT record against the stored verification token. Returns 200 either way: the returned `verified` boolean tells you whether DNS now confirms. Caller polls until `verified: true`. A later version may have the platform auto-polls and fires a `domain.verified` webhook. 
 
         :param domain: (required)
         :type domain: str

{lockally-0.3.2 → lockally-0.3.3}/lockally/api/mailboxes_api.py

@@ -370,7 +370,7 @@ class MailboxesApi:
     ) -> Mailbox:
         """Create a mailbox
 
-        Creates a mailbox on a tenant-verified domain. If `password` is omitted, lockally generates a 16-char password and returns it in the response — shown once.  **Gate.** The mailbox's domain must already be registered AND verified for this tenant (via `/v1/domains` + `/v1/domains/{domain}/verify`).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED — password is NOT regenerated. To change a password, use PATCH instead. 
+        Creates a mailbox on a tenant-verified domain. If `password` is omitted, lockally generates a 16-char password and returns it in the response, shown once.  **Gate.** The mailbox's domain must already be registered AND verified for this tenant (via `/v1/domains` + `/v1/domains/{domain}/verify`).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED, password is NOT regenerated. To change a password, use PATCH instead. 
 
         :param create_mailbox_request: (required)
         :type create_mailbox_request: CreateMailboxRequest
@@ -442,7 +442,7 @@ class MailboxesApi:
     ) -> ApiResponse[Mailbox]:
         """Create a mailbox
 
-        Creates a mailbox on a tenant-verified domain. If `password` is omitted, lockally generates a 16-char password and returns it in the response — shown once.  **Gate.** The mailbox's domain must already be registered AND verified for this tenant (via `/v1/domains` + `/v1/domains/{domain}/verify`).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED — password is NOT regenerated. To change a password, use PATCH instead. 
+        Creates a mailbox on a tenant-verified domain. If `password` is omitted, lockally generates a 16-char password and returns it in the response, shown once.  **Gate.** The mailbox's domain must already be registered AND verified for this tenant (via `/v1/domains` + `/v1/domains/{domain}/verify`).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED, password is NOT regenerated. To change a password, use PATCH instead. 
 
         :param create_mailbox_request: (required)
         :type create_mailbox_request: CreateMailboxRequest
@@ -514,7 +514,7 @@ class MailboxesApi:
     ) -> RESTResponseType:
         """Create a mailbox
 
-        Creates a mailbox on a tenant-verified domain. If `password` is omitted, lockally generates a 16-char password and returns it in the response — shown once.  **Gate.** The mailbox's domain must already be registered AND verified for this tenant (via `/v1/domains` + `/v1/domains/{domain}/verify`).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED — password is NOT regenerated. To change a password, use PATCH instead. 
+        Creates a mailbox on a tenant-verified domain. If `password` is omitted, lockally generates a 16-char password and returns it in the response, shown once.  **Gate.** The mailbox's domain must already be registered AND verified for this tenant (via `/v1/domains` + `/v1/domains/{domain}/verify`).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED, password is NOT regenerated. To change a password, use PATCH instead. 
 
         :param create_mailbox_request: (required)
         :type create_mailbox_request: CreateMailboxRequest
@@ -930,7 +930,7 @@ class MailboxesApi:
     ) -> None:
         """Remove the vacation responder
 
-        Idempotent — 204 whether or not a row existed.
+        Idempotent, 204 whether or not a row existed.
 
         :param email: (required)
         :type email: str
@@ -999,7 +999,7 @@ class MailboxesApi:
     ) -> ApiResponse[None]:
         """Remove the vacation responder
 
-        Idempotent — 204 whether or not a row existed.
+        Idempotent, 204 whether or not a row existed.
 
         :param email: (required)
         :type email: str
@@ -1068,7 +1068,7 @@ class MailboxesApi:
     ) -> RESTResponseType:
         """Remove the vacation responder
 
-        Idempotent — 204 whether or not a row existed.
+        Idempotent, 204 whether or not a row existed.
 
         :param email: (required)
         :type email: str
@@ -1198,7 +1198,7 @@ class MailboxesApi:
     ) -> bytes:
         """Download a previously-issued mailbox export
 
-        Public endpoint (no Authorization header). Validates the one-shot token from the URL, marks it used, and streams an mbox file. Second GET with the same token returns 404 — tokens are single-use. 
+        Public endpoint (no Authorization header). Validates the one-shot token from the URL, marks it used, and streams an mbox file. Second GET with the same token returns 404, tokens are single-use. 
 
         :param email: (required)
         :type email: str
@@ -1272,7 +1272,7 @@ class MailboxesApi:
     ) -> ApiResponse[bytes]:
         """Download a previously-issued mailbox export
 
-        Public endpoint (no Authorization header). Validates the one-shot token from the URL, marks it used, and streams an mbox file. Second GET with the same token returns 404 — tokens are single-use. 
+        Public endpoint (no Authorization header). Validates the one-shot token from the URL, marks it used, and streams an mbox file. Second GET with the same token returns 404, tokens are single-use. 
 
         :param email: (required)
         :type email: str
@@ -1346,7 +1346,7 @@ class MailboxesApi:
     ) -> RESTResponseType:
         """Download a previously-issued mailbox export
 
-        Public endpoint (no Authorization header). Validates the one-shot token from the URL, marks it used, and streams an mbox file. Second GET with the same token returns 404 — tokens are single-use. 
+        Public endpoint (no Authorization header). Validates the one-shot token from the URL, marks it used, and streams an mbox file. Second GET with the same token returns 404, tokens are single-use. 
 
         :param email: (required)
         :type email: str
@@ -1484,7 +1484,7 @@ class MailboxesApi:
     ) -> ExportMailbox201Response:
         """Request a mailbox export
 
-        Issues a one-shot \"presigned\" download URL for the mailbox's content in mbox format. The URL works without an Authorization header — the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (from `lockally.messages`). v2 swaps in Stalwart's export primitive for full inbox + folder structure + flags. The endpoint contract stays unchanged.  **Scope changed:** this used to accept `mailboxes:read`. It takes any mailbox in the tenant and returns that mailbox's mail, so it now requires `tenant:admin`, matching `POST /v1/ediscovery/export`. A key scoped `mailboxes:read` gets 403 and has to be reissued; admin console sessions are unaffected. 
+        Issues a one-shot \"presigned\" download URL for the mailbox's content in mbox format. The URL works without an Authorization header, the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (sent mail only). A later version will cover received mail for full inbox + folder structure + flags. The endpoint contract stays unchanged.  **Scope changed:** this used to accept `mailboxes:read`. It takes any mailbox in the tenant and returns that mailbox's mail, so it now requires `tenant:admin`, matching `POST /v1/ediscovery/export`. A key scoped `mailboxes:read` gets 403 and has to be reissued; admin console sessions are unaffected. 
 
         :param email: (required)
         :type email: str
@@ -1554,7 +1554,7 @@ class MailboxesApi:
     ) -> ApiResponse[ExportMailbox201Response]:
         """Request a mailbox export
 
-        Issues a one-shot \"presigned\" download URL for the mailbox's content in mbox format. The URL works without an Authorization header — the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (from `lockally.messages`). v2 swaps in Stalwart's export primitive for full inbox + folder structure + flags. The endpoint contract stays unchanged.  **Scope changed:** this used to accept `mailboxes:read`. It takes any mailbox in the tenant and returns that mailbox's mail, so it now requires `tenant:admin`, matching `POST /v1/ediscovery/export`. A key scoped `mailboxes:read` gets 403 and has to be reissued; admin console sessions are unaffected. 
+        Issues a one-shot \"presigned\" download URL for the mailbox's content in mbox format. The URL works without an Authorization header, the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (sent mail only). A later version will cover received mail for full inbox + folder structure + flags. The endpoint contract stays unchanged.  **Scope changed:** this used to accept `mailboxes:read`. It takes any mailbox in the tenant and returns that mailbox's mail, so it now requires `tenant:admin`, matching `POST /v1/ediscovery/export`. A key scoped `mailboxes:read` gets 403 and has to be reissued; admin console sessions are unaffected. 
 
         :param email: (required)
         :type email: str
@@ -1624,7 +1624,7 @@ class MailboxesApi:
     ) -> RESTResponseType:
         """Request a mailbox export
 
-        Issues a one-shot \"presigned\" download URL for the mailbox's content in mbox format. The URL works without an Authorization header — the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (from `lockally.messages`). v2 swaps in Stalwart's export primitive for full inbox + folder structure + flags. The endpoint contract stays unchanged.  **Scope changed:** this used to accept `mailboxes:read`. It takes any mailbox in the tenant and returns that mailbox's mail, so it now requires `tenant:admin`, matching `POST /v1/ediscovery/export`. A key scoped `mailboxes:read` gets 403 and has to be reissued; admin console sessions are unaffected. 
+        Issues a one-shot \"presigned\" download URL for the mailbox's content in mbox format. The URL works without an Authorization header, the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (sent mail only). A later version will cover received mail for full inbox + folder structure + flags. The endpoint contract stays unchanged.  **Scope changed:** this used to accept `mailboxes:read`. It takes any mailbox in the tenant and returns that mailbox's mail, so it now requires `tenant:admin`, matching `POST /v1/ediscovery/export`. A key scoped `mailboxes:read` gets 403 and has to be reissued; admin console sessions are unaffected. 
 
         :param email: (required)
         :type email: str
@@ -2294,7 +2294,7 @@ class MailboxesApi:
     ) -> ListMailboxes200Response:
         """List mailboxes
 
-        Returns mailboxes under the calling tenant — active and soft-deleted. `?limit=N` between 1 and 200 (default 50). 
+        Returns mailboxes under the calling tenant, active and soft-deleted. `?limit=N` between 1 and 200 (default 50). 
 
         :param limit:
         :type limit: int
@@ -2363,7 +2363,7 @@ class MailboxesApi:
     ) -> ApiResponse[ListMailboxes200Response]:
         """List mailboxes
 
-        Returns mailboxes under the calling tenant — active and soft-deleted. `?limit=N` between 1 and 200 (default 50). 
+        Returns mailboxes under the calling tenant, active and soft-deleted. `?limit=N` between 1 and 200 (default 50). 
 
         :param limit:
         :type limit: int
@@ -2432,7 +2432,7 @@ class MailboxesApi:
     ) -> RESTResponseType:
         """List mailboxes
 
-        Returns mailboxes under the calling tenant — active and soft-deleted. `?limit=N` between 1 and 200 (default 50). 
+        Returns mailboxes under the calling tenant, active and soft-deleted. `?limit=N` between 1 and 200 (default 50). 
 
         :param limit:
         :type limit: int
@@ -3368,7 +3368,7 @@ class MailboxesApi:
     ) -> VacationResponder:
         """Set the vacation responder
 
-        Upsert — same endpoint creates or replaces the rule. Clears `synced_at`; the rule is staged on lockally until a sync worker pushes it to the mail server. 
+        Upsert, same endpoint creates or replaces the rule. Clears `synced_at`; the rule is staged until a later sync pushes it to the mail server. 
 
         :param email: (required)
         :type email: str
@@ -3443,7 +3443,7 @@ class MailboxesApi:
     ) -> ApiResponse[VacationResponder]:
         """Set the vacation responder
 
-        Upsert — same endpoint creates or replaces the rule. Clears `synced_at`; the rule is staged on lockally until a sync worker pushes it to the mail server. 
+        Upsert, same endpoint creates or replaces the rule. Clears `synced_at`; the rule is staged until a later sync pushes it to the mail server. 
 
         :param email: (required)
         :type email: str
@@ -3518,7 +3518,7 @@ class MailboxesApi:
     ) -> RESTResponseType:
         """Set the vacation responder
 
-        Upsert — same endpoint creates or replaces the rule. Clears `synced_at`; the rule is staged on lockally until a sync worker pushes it to the mail server. 
+        Upsert, same endpoint creates or replaces the rule. Clears `synced_at`; the rule is staged until a later sync pushes it to the mail server. 
 
         :param email: (required)
         :type email: str