Every agent
flies a flag.

# 1 · a mailbox that lives as long as the run
curl -X POST https://api.defeatemail.net/v1/mailboxes \
  -H "Authorization: Bearer $DEFEAT_KEY" \
  -d '{"address":"triage@acme.defeatemail.net","flag":"agent_7Kq4x1","expires_in":"24h"}'

# 2 · send it, signed
curl -X POST https://api.defeatemail.net/v1/messages \
  -H "Authorization: Bearer $DEFEAT_KEY" \
  -d '{
       "from": "triage@acme.defeatemail.net",
       "to":   "jordan@acme.co",
       "subject": "Ticket 88213 needs a human",
       "text": "The refund is above my agent limit.",
       "flag": { "task": "run_88213", "model": "claude-opus-5" }
     }'

# 3 · read the thread back
curl https://api.defeatemail.net/v1/messages?thread=thr_4b21 \
  -H "Authorization: Bearer $DEFEAT_KEY"

import { Defeat } from "@defeat/sdk";

const defeat = new Defeat({ apiKey: process.env.DEFEAT_KEY });

// one mailbox per run, gone when the run is
const box = await defeat.mailboxes.create({
  address:   "triage@acme.defeatemail.net",
  flag:      "agent_7Kq4x1",
  expiresIn: "24h",
});

const sent = await defeat.messages.send({
  from:    box.address,
  to:      "jordan@acme.co",
  subject: "Ticket 88213 needs a human",
  text:    "The refund is above my agent limit.",
  flag:    { task: "run_88213", model: "claude-opus-5" },
});

console.log(sent.flag.url);  // defeatemail.net/f/agent_7Kq4x1

// inbound arrives already resolved
defeat.on("message.received", (m) => {
  if (m.verdict !== "verified") return defeat.messages.hold(m.id);
  return handle(m.thread, m.text);
});

import os
from defeat import Defeat

defeat = Defeat(api_key=os.environ["DEFEAT_KEY"])

# one mailbox per run, gone when the run is
box = defeat.mailboxes.create(
    address="triage@acme.defeatemail.net",
    flag="agent_7Kq4x1",
    expires_in="24h",
)

sent = defeat.messages.send(
    from_=box.address,
    to="jordan@acme.co",
    subject="Ticket 88213 needs a human",
    text="The refund is above my agent limit.",
    flag={"task": "run_88213", "model": "claude-opus-5"},
)

print(sent.flag.url)  # defeatemail.net/f/agent_7Kq4x1

for m in defeat.events.stream("message.received"):
    if m.verdict != "verified":
        defeat.messages.hold(m.id)
        continue
    handle(m.thread, m.text)