@primitivedotdev/sdk 0.18.0 → 0.19.0

package/oclif.manifest.json

@@ -80,7 +80,7 @@
       ],
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -168,6 +168,82 @@
       "summary": "Send an email (simplified, agent-friendly)",
       "enableJsonFlag": false
     },
+    "login": {
+      "aliases": [],
+      "args": {},
+      "description": "Log in by opening Primitive in your browser and saving an org-scoped CLI API key locally.",
+      "examples": [
+        "<%= config.bin %> login",
+        "<%= config.bin %> login --device-name work-laptop",
+        "<%= config.bin %> login --force"
+      ],
+      "flags": {
+        "base-url": {
+          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
+          "env": "PRIMITIVE_API_URL",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "device-name": {
+          "description": "Device name shown in the browser approval screen",
+          "name": "device-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "no-browser": {
+          "description": "Do not attempt to open the browser automatically",
+          "name": "no-browser",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "force": {
+          "char": "f",
+          "description": "Replace saved credentials without first verifying the existing login",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "login",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Log in with browser approval",
+      "enableJsonFlag": false
+    },
+    "logout": {
+      "aliases": [],
+      "args": {},
+      "description": "Log out by revoking the saved Primitive CLI API key and deleting local credentials.",
+      "examples": [
+        "<%= config.bin %> logout"
+      ],
+      "flags": {
+        "base-url": {
+          "description": "Override the API base URL used for key revocation",
+          "env": "PRIMITIVE_API_URL",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "logout",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Log out and revoke the saved CLI key",
+      "enableJsonFlag": false
+    },
     "whoami": {
       "aliases": [],
       "args": {},
@@ -178,7 +254,7 @@
       ],
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -222,7 +298,7 @@
       ],
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -274,7 +350,7 @@
       "description": "GET /account",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -312,7 +388,7 @@
       "description": "GET /account/storage",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -350,7 +426,7 @@
       "description": "Returns the webhook signing secret for your account. If no\nsecret exists yet, one is generated automatically on first\naccess.\n\nSigning is account-scoped, not per-endpoint. Every webhook\ndelivery from any of your registered endpoints is signed\nwith this single secret. Rotate via\n`POST /account/webhook-secret/rotate`.\n\n**Secret format**: the returned string looks base64-shaped\n(e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.\nUse it AS-IS as a UTF-8 string when computing HMAC over a\ndelivery body. Base64-decoding before HMAC will silently\nproduce mismatched signatures.\n\nSee the API-level \"Webhook signing\" section for the full\nwire format (header name, signed string shape, hash algo,\ntolerance) including a language-agnostic verification\nrecipe.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -388,7 +464,7 @@
       "description": "Generates a new webhook signing secret, replacing the current one.\nRate limited to once per 60 minutes.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -426,7 +502,7 @@
       "description": "PATCH /account",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -485,13 +561,190 @@
       "summary": "Update account settings",
       "enableJsonFlag": false
     },
+    "cli:cli-logout": {
+      "aliases": [],
+      "args": {},
+      "description": "Revokes the API key used to authenticate the request. CLI clients use\nthis endpoint during `primitive logout` before removing local credentials.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
+          "env": "PRIMITIVE_API_URL",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "key-id": {
+          "description": "Optional key id guard; when provided it must match the authenticated API key",
+          "name": "key-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cli:cli-logout",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Revoke the current CLI API key",
+      "enableJsonFlag": false
+    },
+    "cli:poll-cli-login": {
+      "aliases": [],
+      "args": {},
+      "description": "Polls a CLI login session until the browser approval either succeeds,\nis denied, expires, or is polled too quickly. The API key is generated\nonly after approval and is returned exactly once.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
+          "env": "PRIMITIVE_API_URL",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "device-code": {
+          "description": "device_code",
+          "name": "device-code",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cli:poll-cli-login",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Poll CLI browser login",
+      "enableJsonFlag": false
+    },
+    "cli:start-cli-login": {
+      "aliases": [],
+      "args": {},
+      "description": "Starts a browser-assisted CLI login session. The response includes a\ndevice code for polling and a user code that the user approves in the\nbrowser. This endpoint does not require an API key.\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   metadata  object  Optional client metadata stored with the login session; serialized JSON mus...\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "base-url": {
+          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
+          "env": "PRIMITIVE_API_URL",
+          "name": "base-url",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "device-name": {
+          "description": "Human-readable device name shown during browser approval",
+          "name": "device-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cli:start-cli-login",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Start CLI browser login",
+      "enableJsonFlag": false
+    },
     "domains:add-domain": {
       "aliases": [],
       "args": {},
       "description": "Creates an unverified domain claim. You will receive a\n`verification_token` to add as a DNS TXT record before\ncalling the verify endpoint.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -550,7 +803,7 @@
       "description": "Deletes a verified or unverified domain claim.",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -596,7 +849,7 @@
       "description": "Returns all verified and unverified domains for your organization,\nsorted by creation date (newest first). Each domain includes a\n`verified` boolean to distinguish between the two states.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -634,7 +887,7 @@
       "description": "Update a verified domain's settings. Only verified domains can be\nupdated. Per-domain spam thresholds require a Pro plan.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -707,7 +960,7 @@
       "description": "Checks DNS records (MX and TXT) to verify domain ownership.\nOn success, the domain is promoted from unverified to verified.\nOn failure, returns which checks passed and which failed.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -753,7 +1006,7 @@
       "description": "DELETE /emails/{id}",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -796,10 +1049,10 @@
     "emails:discard-email-content": {
       "aliases": [],
       "args": {},
-      "description": "Permanently deletes the email's raw bytes, parsed body (text + HTML),\nand attachments while preserving metadata (sender, recipient,\nsubject, timestamps, hashes, attachment manifest) for audit logs.\nIdempotent: a second call returns success with\n`already_discarded: true` and does no work.\n\n**Gated** on the customer's discard-content opt-in (managed in the\ndashboard at Settings > Webhooks). When the toggle is off, this\nendpoint returns `403` with code `discard_not_enabled` and a\nmessage pointing the human at the dashboard. There is intentionally\nno API to flip this toggle — opting in to a destructive,\nnon-reversible operation must be a deliberate human click in the\nUI.\n",
+      "description": "Permanently deletes the email's raw bytes, parsed body (text + HTML),\nand attachments while preserving metadata (sender, recipient,\nsubject, timestamps, hashes, attachment manifest) for audit logs.\nIdempotent: a second call returns success with\n`already_discarded: true` and does no work.\n\n**Gated** on the customer's discard-content opt-in (managed in the\ndashboard at Settings > Webhooks). When the toggle is off, this\nendpoint returns `403` with code `discard_not_enabled` and a\nmessage pointing the human at the dashboard. There is intentionally\nno API to flip this toggle. Opting in to a destructive,\nnon-reversible operation must be a deliberate human click in the\nUI.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -845,7 +1098,7 @@
       "description": "Downloads all attachments as a gzip-compressed tar archive.\nAuthenticates via a signed download token (provided in webhook\npayloads) or a valid session.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -906,7 +1159,7 @@
       "description": "Downloads the raw RFC 822 email file (.eml). Authenticates via\na signed download token (provided in webhook payloads) or a\nvalid session.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -967,7 +1220,7 @@
       "description": "Returns the full record for an inbound email received at one\nof your verified domains, including the parsed text and HTML\nbodies, threading metadata, SMTP envelope detail, webhook\ndelivery state, and a `replies` array for any outbound sends\nrecorded as replies to this inbound.\n\nFor listing inbound emails (with cursor pagination, status\nand date filters, and free-text search), use\n`/emails`. Outbound (sent) email records are NOT returned\nhere; use `/sent-emails/{id}` for those.\n\nThe response carries four sender-shaped fields whose\nmeanings overlap. `from_email` is the canonical \"who sent\nthis\" field for most use cases (parsed bare address from\nthe `From:` header, with a `sender` fallback). `from_header`\nis the raw header including any display name. `sender` and\n`smtp_mail_from` both carry the SMTP envelope MAIL FROM\n(return-path) and are equal by construction; `sender` is\nthe older field name retained for compatibility. See\n`primitive describe emails:get-email | jq '.responseSchema.properties'`\nfor per-field detail.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1013,7 +1266,7 @@
       "description": "Returns a paginated list of INBOUND emails received at your\nverified domains. Outbound messages sent via /send-mail are\nnot included; this endpoint is the inbox view, not a\nunified send/receive history.\n\nSupports filtering by domain, status, date range, and\nfree-text search across subject, sender, and recipient\nfields.\n\nFor a compact text-table summary of the most recent N\ninbounds (no filters, no cursor pagination), the CLI ships\n`primitive emails:latest` as a one-line-per-email shortcut.\nIt's TTY-aware so id columns are full UUIDs when piped, and\na `--json` flag returns the same envelope this endpoint\ndoes. Use whichever fits the call site.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1107,7 +1360,7 @@
       "description": "Re-delivers the webhook payload for this email to all active\nendpoints matching the email's domain. Rate limited per-email\n(short cooldown between successive replays of the same email)\nand per-org (burst + sustained windows), sharing an org-wide\nbudget with delivery replays.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1153,7 +1406,7 @@
       "description": "Creates a new webhook endpoint. If a deactivated endpoint\nwith the same URL and domain exists, it is reactivated\ninstead. Subject to plan limits on the number of active\nendpoints.\n\n**Signing is account-scoped, not per-endpoint.** This call\ndoes not return any signing material; every endpoint on the\naccount uses the same webhook secret, fetched via\n`GET /account/webhook-secret`. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   rules  object  Endpoint-specific filtering rules\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1225,7 +1478,7 @@
       "description": "Soft-deletes a webhook endpoint. The endpoint will no longer\nreceive webhook deliveries.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1271,7 +1524,7 @@
       "description": "Returns all active (non-deleted) webhook endpoints.",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1309,7 +1562,7 @@
       "description": "Sends a sample `email.received` event to the endpoint. The request\nincludes SSRF protection (private IP rejection and DNS pinning).\nRate limited to 4 per minute and 30 per hour (non-exempt).\nSuccessful deliveries and verified-domain endpoints are exempt\nfrom the rate limit.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1355,7 +1608,7 @@
       "description": "Updates an active webhook endpoint. If the URL is changed, the old\nendpoint is deactivated and a new one is created (or an existing\ndeactivated endpoint with the new URL is reactivated).\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   rules  object\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1435,7 +1688,7 @@
       "description": "Creates a new whitelist or blocklist filter. Per-domain filters\nrequire a Pro plan. Patterns are stored as lowercase.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1512,7 +1765,7 @@
       "description": "DELETE /filters/{id}",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1558,7 +1811,7 @@
       "description": "Returns all whitelist and blocklist filter rules.",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1596,7 +1849,7 @@
       "description": "Toggle a filter's enabled state.",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1662,7 +1915,7 @@
       "description": "Returns a flat list of rules describing every recipient the\ncaller may send to. Each rule has a `type`, a kind-specific\npayload, and a human-readable `description`. If any rule\nmatches the recipient, /send-mail will accept the send under\nthe recipient-scope check.\n\nThe endpoint is the answer to \"where can I send\" without\nexposing internal entitlement names. Agents that don't\nrecognize a `type` can still read the `description` prose\nand act on it.\n\nRule kinds, ordered broadest-first so an agent can stop\nscanning at the first match:\n\n  1. `any_recipient` (one entry, only when the org can send\n     anywhere): every other rule below it is redundant.\n  2. `managed_zone` (always emitted, one per Primitive-managed\n     zone): sends to any address at *.primitive.email or\n     *.email.works always succeed; no entitlement required.\n  3. `your_domain` (one per active verified outbound domain\n     owned by the org): sends to that domain are approved.\n  4. `address` (one per address that has authenticated\n     inbound mail to the org, capped at `meta.address_cap`):\n     sends to that exact address are approved.\n\nThe list is informational, not an authorization check.\n/send-mail remains the source of truth on whether an\nindividual send will succeed (it also enforces the\nfrom-address and the `send_mail` entitlement, which are\nnot recipient-scope concerns and are not represented here).\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1700,7 +1953,7 @@
       "description": "Returns the full sent-email record by id, including\n`body_text` and `body_html` (omitted from the listing\nendpoint to keep paginated responses small). Use this when\ndiagnosing a specific send, e.g. inspecting the receiver's\nSMTP response on a `bounced` row or pulling the gate\ndenial detail on a `gate_denied` row.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1746,7 +1999,7 @@
       "description": "Returns a paginated list of OUTBOUND emails the caller's\norg has sent via /send-mail (and /emails/{id}/reply, which\nforwards through /send-mail). Includes every recorded\nattempt, including gate-denied attempts that the agent\nnever called and rows still in `queued` state.\n\nFor inbound mail received at your verified domains, see\n/emails. There is no unified send/receive history endpoint;\nthe two surfaces are intentionally separate because the\nunderlying tables, statuses, and lifecycle differ.\n\nEmail bodies (`body_text`, `body_html`) are NOT included on\nlist rows so a 50-row page can't balloon into a multi-MB\nresponse when sends are near the 5MB body cap. Use\n/sent-emails/{id} to fetch a single row with bodies, or\ncross-reference by `client_idempotency_key` if the caller\nalready has the body locally.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1840,7 +2093,7 @@
       "description": "Sends an outbound reply to the inbound email identified by `id`.\nThreading headers (`In-Reply-To`, `References`), recipient\nderivation (Reply-To, then From, then bare sender), and the\n`Re:` subject prefix are all derived server-side from the\nstored inbound row. The request body carries only the message\nbody and optional `wait` flag; passing any header or recipient\noverride is rejected by the schema (`additionalProperties:\nfalse`).\n\nForwards through the same gates as `/send-mail`: the response\nstatus, error envelope, and `idempotent_replay` flag mirror\nthe send-mail contract verbatim.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -1927,7 +2180,7 @@
       "description": "Sends an outbound email through Primitive's outbound relay. By default\nthe request returns once the relay accepts the message for delivery.\nSet `wait: true` to wait for the first downstream SMTP delivery outcome.\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   references  array<string>  Full ordered message-id chain for the thread.\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -2034,7 +2287,7 @@
       "description": "Returns a paginated list of webhook delivery attempts. Each delivery\nincludes a nested `email` object with sender, recipient, and subject.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -2126,7 +2379,7 @@
       "description": "Re-sends the stored webhook payload from a previous delivery attempt.\nIf the original endpoint is still active, it is targeted. If the\noriginal endpoint was deleted, the oldest active endpoint is used.\nDeactivated endpoints cannot be replayed to. Rate limited per-org,\nsharing an org-wide budget with email replays.\n",
       "flags": {
         "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY)",
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
           "env": "PRIMITIVE_API_KEY",
           "name": "api-key",
           "hasDynamicHelp": false,
@@ -2167,5 +2420,5 @@
       "enableJsonFlag": false
     }
   },
-  "version": "0.18.0"
+  "version": "0.19.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@primitivedotdev/sdk",
-  "version": "0.18.0",
-  "description": "Official Primitive Node.js SDK — webhook, api, openapi, contract, and parser modules",
+  "version": "0.19.0",
+  "description": "Official Primitive Node.js SDK: webhook, api, openapi, contract, and parser modules",
   "type": "module",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -59,6 +59,9 @@
       "@oclif/plugin-autocomplete"
     ],
     "topics": {
+      "cli": {
+        "description": "Browser-assisted CLI authentication"
+      },
       "account": {
         "description": "Manage your account settings, storage, and webhook secret"
       },