# description
Every field is optional — send only what changes. The domain is deliberately absent: a password is bound to its domain for life, because repointing a live credential would hand its holder mail they were never granted. Create a new password for another domain.

# properties.address.description
New local-part pattern — `*` (every address), `hello`, `support-*`, `*-agent`. No `@`: the domain can't change.

# properties.protocols.description
Replaces the existing set. Must be a non-empty subset of `["imap","api"]`.