chore(release): bump ts-sdk 5.9.0, cli 2.5.1, python 5.8.1

cli/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 2.5.1
+
+Bug fix only. No flag, output-field, or exit-code meaning changes from 2.5.0.
+
+**Fixed:** `e2a contacts import` no longer bakes a stray carriage return into
+imported contact metadata. The CSV parser dropped `\r` unconditionally outside
+a quoted field but appended it verbatim inside one, so a CRLF export from
+Excel, Sheets, or a CRM containing a multi-line cell stored the cell's internal
+line breaks as `\r\n`. Quoted fields now normalize the same way the unquoted
+branch already did, matching the parser's documented RFC 4180 conformance.
+
+**Documentation:** corrected the `--send-at` description in the README and in
+this changelog's 2.2.0 entry. Both claimed a review hold *drops* the schedule;
+in fact a scheduled send caught by a hold keeps its `send_at` — approving the
+message submits at that instant if it is still in the future, or immediately if
+it has already passed. No command behavior changed.
+
 ## 2.5.0
 
 Additive only for every input that already succeeded in 2.4.0 — no flag,

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@e2a/cli",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "CLI for e2a — give any AI agent a real, authenticated email inbox",
   "bin": {
     "e2a": "./dist/bin/e2a.js"

sdks/python/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 5.8.1
+
+Documentation only. No public name, signature, type, validation, or runtime
+behavior differs from 5.8.0 — every 5.8.0 call site keeps working identically
+on both ``AsyncE2AClient`` and the synchronous ``E2AClient``.
+
+### Documentation
+- Regenerated the model field descriptions from the current OpenAPI document so
+  the shipped ``pydantic`` ``Field(description=...)`` text matches the server.
+  ``LimitsCapsView.max_messages_month`` and ``LimitsUsageView.messages_month``
+  now state that the monthly allowance counts **outbound recipient-deliveries**
+  — a message to N distinct recipients consumes N units, and received mail is
+  free and never counted. ``LimitExceededDetails.resource`` documents the
+  additional ``messages_day`` stem (a per-UTC-day send cap carried by some
+  accounts; it has no ``AccountView`` field and resets at midnight UTC), so a
+  ``limit_exceeded`` on it clears when the UTC day rolls over rather than on an
+  upgrade. ``ErrorBody.code`` documents ``auth_unavailable`` (503 — an auth
+  backend such as a delegated-token verifier or the identity store could not
+  judge the credential; retry).
+
 ## 5.8.0
 
 ### Changed

sdks/python/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "e2a"
-version = "5.8.0"
+version = "5.8.1"
 description = "Python SDK for e2a — build AI agents with authenticated email"
 readme = "README.md"
 license = "Apache-2.0"

sdks/typescript/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 5.9.0
+
+### Changed
+- **Dot-segment path parameters are now rejected for *every* generated request,
+  not just the ten wrapper methods 5.8.0 covered.** The guard moved down to the
+  generated `RequestContext` chokepoint (both the constructor and `setUrl`), so
+  any `/v1` call whose templated path contains a literal `.` or `..` segment
+  throws `HttpException` ("request path contains an unsafe `..` segment")
+  *before* `new URL()` collapses the segment. Previously that collapse happened
+  before any middleware or retry layer could see it, so a caller-controlled
+  value of exactly `..` silently retargeted the request at a different,
+  larger-scoped resource. 5.8.0 closed this for the ten hand-written wrappers it
+  enumerated; every other path parameter — including any added by future codegen
+  — was still exposed. The guard is injected by a codegen post-processing step
+  rather than hand-edited, so `make generate` cannot drop it again. This is a
+  behavior change for any caller that was, deliberately or not, passing `.` or
+  `..` as a path parameter: it now throws instead of sending the (misdirected)
+  request.
+
+### Documentation
+- Regenerated model and operation docs for the outbound-metering semantics the
+  server now documents. `LimitsCapsView.maxMessagesMonth` and
+  `LimitsUsageView.messagesMonth` are described as **outbound
+  recipient-deliveries** — a message to N distinct recipients consumes N units,
+  and received mail is free and never counted. `LimitExceededDetails.resource`
+  documents the additional `messages_day` stem (a per-UTC-day send cap carried
+  by some accounts; it has no `AccountView` field and resets at midnight UTC),
+  and the `402` throw sites say to retry after the UTC day rolls over.
+  `ErrorBody.code` documents `auth_unavailable` (503 — an auth backend could not
+  judge the credential; retry). Field names, types, and runtime behavior are
+  unchanged from 5.8.0.
+
 ## 5.8.0
 
 ### Added

sdks/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@e2a/sdk",
-  "version": "5.8.0",
+  "version": "5.9.0",
   "description": "TypeScript SDK for e2a — build AI agents with authenticated email",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",