@primitivedotdev/sdk 0.19.0 → 0.21.0

package/dist/openapi/operations.generated.js

@@ -1459,6 +1459,310 @@ export const operationManifest = [
         "tag": "Emails",
         "tagCommand": "emails"
     },
+    {
+        "binaryResponse": false,
+        "bodyRequired": false,
+        "command": "search-emails",
+        "description": "Searches inbound emails with structured filters and optional\nfull-text matching across parsed email fields. This endpoint is\noptimized for filtered inbox views and CLI polling workflows:\ncallers that only need new accepted mail can pass\n`sort=received_at_asc`, `snippet=false`, `include_facets=false`,\nand a `date_from` timestamp.\n\n`q`, `subject`, and `body` use the same English full-text index\nas the web inbox search. Structured filters such as `from`, `to`,\n`domain_id`, status, attachment presence, and spam score bounds\nare combined with the text query.\n",
+        "hasJsonBody": false,
+        "method": "GET",
+        "operationId": "searchEmails",
+        "path": "/emails/search",
+        "pathParams": [],
+        "queryParams": [
+            {
+                "description": "Full-text search DSL query.",
+                "enum": null,
+                "name": "q",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Filter by sender address or sender domain.",
+                "enum": null,
+                "name": "from",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Filter by recipient address or recipient domain.",
+                "enum": null,
+                "name": "to",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Full-text search restricted to the subject field.",
+                "enum": null,
+                "name": "subject",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Full-text search restricted to the parsed text body.",
+                "enum": null,
+                "name": "body",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Filter by domain ID.",
+                "enum": null,
+                "name": "domain_id",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Filter by inbound email lifecycle status.",
+                "enum": null,
+                "name": "status",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Filter emails received on or after this timestamp.",
+                "enum": null,
+                "name": "date_from",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Filter emails received on or before this timestamp.",
+                "enum": null,
+                "name": "date_to",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Filter by whether the email has one or more attachments.",
+                "enum": [
+                    "true",
+                    "false"
+                ],
+                "name": "has_attachment",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Filter to emails with spam score below this value.",
+                "enum": null,
+                "name": "spam_score_lt",
+                "required": false,
+                "type": "number"
+            },
+            {
+                "description": "Filter to emails with spam score greater than or equal to this value.",
+                "enum": null,
+                "name": "spam_score_gte",
+                "required": false,
+                "type": "number"
+            },
+            {
+                "description": "Sort mode. Defaults to relevance when a text query is present,\notherwise `received_at_desc`.\n",
+                "enum": [
+                    "relevance",
+                    "received_at_desc",
+                    "received_at_asc"
+                ],
+                "name": "sort",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Opaque pagination cursor from a previous search response.",
+                "enum": null,
+                "name": "cursor",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Number of results per page",
+                "enum": null,
+                "name": "limit",
+                "required": false,
+                "type": "integer"
+            },
+            {
+                "description": "Include subject/body highlight snippets when text search is active.",
+                "enum": [
+                    "true",
+                    "false"
+                ],
+                "name": "snippet",
+                "required": false,
+                "type": "string"
+            },
+            {
+                "description": "Include facet counts for sender, domain, status, and attachment presence.",
+                "enum": [
+                    "true",
+                    "false"
+                ],
+                "name": "include_facets",
+                "required": false,
+                "type": "string"
+            }
+        ],
+        "requestSchema": null,
+        "responseSchema": {
+            "type": "array",
+            "items": {
+                "allOf": [
+                    {
+                        "type": "object",
+                        "properties": {
+                            "id": {
+                                "type": "string",
+                                "format": "uuid"
+                            },
+                            "message_id": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ]
+                            },
+                            "domain_id": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ],
+                                "format": "uuid"
+                            },
+                            "org_id": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ],
+                                "format": "uuid"
+                            },
+                            "status": {
+                                "type": "string",
+                                "description": "Lifecycle status of an INBOUND email (a row in the `emails`\ntable). Distinct from `SentEmailStatus`, which describes\nthe OUTBOUND lifecycle (the `sent_emails` table) and uses\na different vocabulary because the lifecycles differ.\nPossible values:\n\n  - `pending`: the row was inserted at ingestion (mx_main)\n    and has not yet completed the spam / filter / auth\n    pipeline. Body and parsed fields are present; webhook\n    delivery is not yet scheduled. Most rows transition out\n    of `pending` within seconds.\n  - `accepted`: the inbound passed the policy gates and is\n    queued for webhook delivery. The `webhook_status` field\n    tracks the separate webhook-delivery lifecycle from\n    this point.\n  - `completed`: terminal success. Webhook delivery\n    attempted and acknowledged by every active endpoint, OR\n    no endpoints are configured, so the row is durably\n    archived.\n  - `rejected`: terminal failure at ingestion (spam, blocked\n    sender, filter rule, malformed). The body and metadata\n    are stored for auditing but no webhook fires and the\n    row is not repliable.\n\nSee also `webhook_status` (separate enum tracking the\nwebhook-delivery state machine) and `SentEmailStatus` (the\noutbound vocabulary).\n",
+                                "enum": [
+                                    "pending",
+                                    "accepted",
+                                    "completed",
+                                    "rejected"
+                                ]
+                            },
+                            "sender": {
+                                "type": "string",
+                                "description": "SMTP envelope sender (return-path) the inbound mail server\naccepted. For most legitimate mail this equals the bare\naddress in the From header; for mailing lists, bounce\nhandlers, and forwarders it is typically the bounce address\nrather than the human-visible sender.\n\nFor the parsed From-header value (with display name handling\nand a sender-fallback when the header is unparseable), GET\nthe email by id and use `from_email`.\n"
+                            },
+                            "recipient": {
+                                "type": "string"
+                            },
+                            "subject": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ]
+                            },
+                            "domain": {
+                                "type": "string"
+                            },
+                            "spam_score": {
+                                "type": [
+                                    "number",
+                                    "null"
+                                ]
+                            },
+                            "created_at": {
+                                "type": "string",
+                                "format": "date-time"
+                            },
+                            "received_at": {
+                                "type": "string",
+                                "format": "date-time"
+                            },
+                            "raw_size_bytes": {
+                                "type": [
+                                    "integer",
+                                    "null"
+                                ]
+                            },
+                            "webhook_status": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ],
+                                "description": "Webhook-delivery state for an inbound email. Tracks a\nSEPARATE lifecycle from the email's `status` field; the\nsame row carries both. Possible values:\n\n  - `pending`: ingestion is past `pending` (the email itself\n    is `accepted`) but the webhook fan-out has not yet\n    started for this row.\n  - `in_flight`: at least one delivery attempt is in flight.\n  - `fired`: terminal success. Every active endpoint\n    acknowledged the delivery (or accepted it after retries).\n  - `failed`: terminal partial-failure. At least one endpoint\n    exhausted its retry budget; some endpoints may still\n    have succeeded.\n  - `exhausted`: terminal failure. Every endpoint exhausted\n    its retry budget without success.\n  - `null`: no endpoints configured, so no webhook lifecycle\n    applies.\n\nNote that the value `pending` here does NOT mean the email\nis `pending`; it means the email is past ingestion but\nwebhook delivery has not yet begun. Two overlapping uses\nof the word `pending` for distinct lifecycle phases.\n",
+                                "enum": [
+                                    "pending",
+                                    "in_flight",
+                                    "fired",
+                                    "failed",
+                                    "exhausted",
+                                    null
+                                ]
+                            },
+                            "webhook_attempt_count": {
+                                "type": "integer"
+                            }
+                        },
+                        "required": [
+                            "id",
+                            "status",
+                            "sender",
+                            "recipient",
+                            "domain",
+                            "created_at",
+                            "received_at",
+                            "webhook_attempt_count"
+                        ]
+                    },
+                    {
+                        "type": "object",
+                        "properties": {
+                            "attachment_count": {
+                                "type": "integer",
+                                "description": "Number of parsed attachments on the email."
+                            },
+                            "from_known_address": {
+                                "type": "boolean",
+                                "description": "Whether the parsed From address is known to this org from prior authenticated inbound mail."
+                            },
+                            "score": {
+                                "type": "number",
+                                "description": "Relevance score. Present only when sorting by relevance."
+                            },
+                            "highlights": {
+                                "type": "object",
+                                "properties": {
+                                    "subject": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        },
+                                        "description": "Subject snippets with matching terms highlighted."
+                                    },
+                                    "body": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "string"
+                                        },
+                                        "description": "Body snippets with matching terms highlighted."
+                                    }
+                                },
+                                "required": [
+                                    "subject",
+                                    "body"
+                                ]
+                            }
+                        },
+                        "required": [
+                            "attachment_count",
+                            "from_known_address"
+                        ]
+                    }
+                ]
+            }
+        },
+        "sdkName": "searchEmails",
+        "summary": "Search inbound emails",
+        "tag": "Emails",
+        "tagCommand": "emails"
+    },
     {
         "binaryResponse": false,
         "bodyRequired": true,
@@ -2211,6 +2515,696 @@ export const operationManifest = [
         "tag": "Filters",
         "tagCommand": "filters"
     },
+    {
+        "binaryResponse": false,
+        "bodyRequired": true,
+        "command": "create-function",
+        "description": "Creates and deploys a new function. The handler must be a single\nESM module that exports a default async function receiving the\n`email.received` event (see the Webhook payload section for the\nfull schema). Code is bundled before being uploaded; ship a\nsingle self-contained file rather than relying on external\nimports.\n\n**Code limits.** `code` is capped at 1 MiB UTF-8. `sourceMap`\n(optional) is capped at 5 MiB UTF-8 and is stored only on the\nedge runtime side; it is not persisted in Primitive's database.\n\n**Auto-wiring.** On successful deploy, Primitive automatically\ncreates a webhook endpoint that delivers inbound mail to the\nfunction. There is nothing to configure on the Endpoints API\nfor this to work; the gateway URL returned here is for\nreference only and is not directly callable from outside.\n\n**Secrets.** New functions ship with the managed secrets\n(`PRIMITIVE_WEBHOOK_SECRET`, `PRIMITIVE_API_KEY`) already\nbound. Add user-set secrets via\n`POST /functions/{id}/secrets`; secret writes only land in the\nrunning handler on the next redeploy.\n",
+        "hasJsonBody": true,
+        "method": "POST",
+        "operationId": "createFunction",
+        "path": "/functions",
+        "pathParams": [],
+        "queryParams": [],
+        "requestSchema": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+                "name": {
+                    "type": "string",
+                    "pattern": "^[a-z0-9_-]{1,64}$",
+                    "description": "Slug-style name. Lowercase letters, digits, hyphens, and\nunderscores. 1 to 64 characters. Must be unique within the\norg; a 409 is returned on collision.\n"
+                },
+                "code": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 1048576,
+                    "description": "Bundled handler as a single ESM module. Up to 1 MiB UTF-8.\nMust export a default `{ async fetch(req, env, ctx) { ... } }`\nobject.\n"
+                },
+                "sourceMap": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 5242880,
+                    "description": "Optional source map for the bundle. Up to 5 MiB UTF-8.\nStored only on the runtime side (not in Primitive's\ndatabase) and used to symbolicate stack traces in the\nfunction's logs.\n"
+                }
+            },
+            "required": [
+                "name",
+                "code"
+            ]
+        },
+        "responseSchema": {
+            "type": "object",
+            "description": "Returned by POST /functions on a successful deploy.",
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "deploy_status": {
+                    "type": "string",
+                    "enum": [
+                        "pending",
+                        "deployed",
+                        "failed"
+                    ],
+                    "description": "Lifecycle state of the latest deploy attempt:\n  * `pending` — deploy in flight; the runtime has not yet\n    confirmed the new bundle is live.\n  * `deployed` — the running edge handler is the latest code.\n  * `failed` — the most recent deploy attempt failed; the\n    previously-live code (if any) is still running. The\n    `deploy_error` field carries the error message.\n"
+                },
+                "gateway_url": {
+                    "type": "string",
+                    "format": "uri"
+                }
+            },
+            "required": [
+                "id",
+                "name",
+                "deploy_status",
+                "gateway_url"
+            ]
+        },
+        "sdkName": "createFunction",
+        "summary": "Deploy a function",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
+    {
+        "binaryResponse": false,
+        "bodyRequired": true,
+        "command": "create-function-secret",
+        "description": "Idempotent insert-or-update keyed on `(function_id, key)`.\nReturns 201 the first time the key is set, 200 on subsequent\nupdates. Values are encrypted at rest and only become visible\nto the running handler on the next deploy (`PUT /functions/{id}`\nwith the existing code is sufficient to refresh bindings).\n\nKeys must match `^[A-Z_][A-Z0-9_]*$` (uppercase letters,\ndigits, underscores; first character is a letter or\nunderscore). Values are at most 4096 UTF-8 bytes. System-\nmanaged keys are reserved and rejected.\n",
+        "hasJsonBody": true,
+        "method": "POST",
+        "operationId": "createFunctionSecret",
+        "path": "/functions/{id}/secrets",
+        "pathParams": [
+            {
+                "description": "Resource UUID",
+                "enum": null,
+                "name": "id",
+                "required": true,
+                "type": "string"
+            }
+        ],
+        "queryParams": [],
+        "requestSchema": {
+            "type": "object",
+            "additionalProperties": false,
+            "description": "Body for POST /functions/{id}/secrets.",
+            "properties": {
+                "key": {
+                    "type": "string",
+                    "pattern": "^[A-Z_][A-Z0-9_]*$",
+                    "description": "Uppercase letters, digits, and underscores. Must start with\na letter or underscore. System-managed keys (e.g.\nPRIMITIVE_WEBHOOK_SECRET) are reserved.\n"
+                },
+                "value": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 4096,
+                    "description": "Secret value, up to 4096 UTF-8 bytes. Encrypted at rest.\nNever returned by any read endpoint.\n"
+                }
+            },
+            "required": [
+                "key",
+                "value"
+            ]
+        },
+        "responseSchema": {
+            "type": "object",
+            "description": "Returned by POST and PUT secret routes.",
+            "properties": {
+                "key": {
+                    "type": "string"
+                },
+                "created_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "updated_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "created": {
+                    "type": "boolean",
+                    "description": "True if this call inserted a new row, false if it updated an existing one."
+                }
+            },
+            "required": [
+                "key",
+                "created_at",
+                "updated_at",
+                "created"
+            ]
+        },
+        "sdkName": "createFunctionSecret",
+        "summary": "Create or update a secret",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
+    {
+        "binaryResponse": false,
+        "bodyRequired": false,
+        "command": "delete-function",
+        "description": "Soft-deletes the function row, removes the script from the edge\nruntime, and deactivates the auto-wired webhook endpoint so no\nfurther inbound mail is delivered. Past deploy history,\ninvocations, and logs are retained.\n\nReturns 502 if the runtime delete fails partway; the function\nrow stays in place and the call is safe to retry until it\nsucceeds.\n",
+        "hasJsonBody": false,
+        "method": "DELETE",
+        "operationId": "deleteFunction",
+        "path": "/functions/{id}",
+        "pathParams": [
+            {
+                "description": "Resource UUID",
+                "enum": null,
+                "name": "id",
+                "required": true,
+                "type": "string"
+            }
+        ],
+        "queryParams": [],
+        "requestSchema": null,
+        "responseSchema": null,
+        "sdkName": "deleteFunction",
+        "summary": "Delete a function",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
+    {
+        "binaryResponse": false,
+        "bodyRequired": false,
+        "command": "delete-function-secret",
+        "description": "Removes the secret. The binding stays live in the running\nhandler until the next deploy refreshes the binding set\n(`PUT /functions/{id}` with the existing code is sufficient).\nReturns 404 if the key did not exist. Managed system keys\ncannot be deleted.\n",
+        "hasJsonBody": false,
+        "method": "DELETE",
+        "operationId": "deleteFunctionSecret",
+        "path": "/functions/{id}/secrets/{key}",
+        "pathParams": [
+            {
+                "description": "Resource UUID",
+                "enum": null,
+                "name": "id",
+                "required": true,
+                "type": "string"
+            },
+            {
+                "description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+                "enum": null,
+                "name": "key",
+                "required": true,
+                "type": "string"
+            }
+        ],
+        "queryParams": [],
+        "requestSchema": null,
+        "responseSchema": null,
+        "sdkName": "deleteFunctionSecret",
+        "summary": "Delete a secret",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
+    {
+        "binaryResponse": false,
+        "bodyRequired": false,
+        "command": "get-function",
+        "description": "Returns the full record for a function, including its current\nsource code and the deploy status / error from the most recent\ndeploy attempt.\n",
+        "hasJsonBody": false,
+        "method": "GET",
+        "operationId": "getFunction",
+        "path": "/functions/{id}",
+        "pathParams": [
+            {
+                "description": "Resource UUID",
+                "enum": null,
+                "name": "id",
+                "required": true,
+                "type": "string"
+            }
+        ],
+        "queryParams": [],
+        "requestSchema": null,
+        "responseSchema": {
+            "type": "object",
+            "description": "Full function record returned by GET / PUT.",
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "code": {
+                    "type": "string",
+                    "description": "The bundled handler source. UTF-8 string up to 1 MiB. The\nsame value most recently passed as `code` to POST or PUT.\n"
+                },
+                "deploy_status": {
+                    "type": "string",
+                    "enum": [
+                        "pending",
+                        "deployed",
+                        "failed"
+                    ],
+                    "description": "Lifecycle state of the latest deploy attempt:\n  * `pending` — deploy in flight; the runtime has not yet\n    confirmed the new bundle is live.\n  * `deployed` — the running edge handler is the latest code.\n  * `failed` — the most recent deploy attempt failed; the\n    previously-live code (if any) is still running. The\n    `deploy_error` field carries the error message.\n"
+                },
+                "deploy_error": {
+                    "type": [
+                        "string",
+                        "null"
+                    ],
+                    "description": "Error message from the most recent failed deploy, or null\nafter a successful deploy. Surface this to users to explain\na `failed` status without polling.\n"
+                },
+                "deployed_at": {
+                    "type": [
+                        "string",
+                        "null"
+                    ],
+                    "format": "date-time"
+                },
+                "gateway_url": {
+                    "type": "string",
+                    "format": "uri"
+                },
+                "created_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "updated_at": {
+                    "type": "string",
+                    "format": "date-time"
+                }
+            },
+            "required": [
+                "id",
+                "name",
+                "code",
+                "deploy_status",
+                "gateway_url",
+                "created_at",
+                "updated_at"
+            ]
+        },
+        "sdkName": "getFunction",
+        "summary": "Get a function",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
+    {
+        "binaryResponse": false,
+        "bodyRequired": false,
+        "command": "list-function-secrets",
+        "description": "Returns metadata for every secret bound to the function, with\nmanaged entries (provisioned by Primitive) listed first and\nuser-set entries listed alphabetically after. **Values are\nnever returned.** Secret writes are write-only.\n\nManaged entries (e.g. `PRIMITIVE_WEBHOOK_SECRET`,\n`PRIMITIVE_API_KEY`) carry a `description` instead of\n`created_at` / `updated_at`. They cannot be created, updated,\nor deleted via this API.\n",
+        "hasJsonBody": false,
+        "method": "GET",
+        "operationId": "listFunctionSecrets",
+        "path": "/functions/{id}/secrets",
+        "pathParams": [
+            {
+                "description": "Resource UUID",
+                "enum": null,
+                "name": "id",
+                "required": true,
+                "type": "string"
+            }
+        ],
+        "queryParams": [],
+        "requestSchema": null,
+        "responseSchema": {
+            "type": "object",
+            "properties": {
+                "items": {
+                    "type": "array",
+                    "items": {
+                        "type": "object",
+                        "description": "One row from GET /functions/{id}/secrets. Discriminate on the\n`managed` field:\n  * `managed = true`  — system secret provisioned by Primitive.\n    `description` is set; `created_at` / `updated_at` are\n    null because the row is virtual (resolved at deploy time\n    from the managed registry, not stored in the secrets\n    table).\n  * `managed = false` — secret the user set via the API.\n    `created_at` / `updated_at` are set; `description` is\n    null.\n",
+                        "properties": {
+                            "key": {
+                                "type": "string"
+                            },
+                            "managed": {
+                                "type": "boolean",
+                                "description": "True for managed system secrets, false for user-set entries."
+                            },
+                            "description": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ],
+                                "description": "Set on managed entries only; null on user-set entries."
+                            },
+                            "created_at": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ],
+                                "format": "date-time",
+                                "description": "Set on user-set entries only; null on managed entries."
+                            },
+                            "updated_at": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ],
+                                "format": "date-time",
+                                "description": "Set on user-set entries only; null on managed entries."
+                            }
+                        },
+                        "required": [
+                            "key",
+                            "managed"
+                        ]
+                    }
+                }
+            },
+            "required": [
+                "items"
+            ]
+        },
+        "sdkName": "listFunctionSecrets",
+        "summary": "List a function's secrets",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
+    {
+        "binaryResponse": false,
+        "bodyRequired": false,
+        "command": "list-functions",
+        "description": "Returns every active (non-deleted) function in the org, newest\nfirst. Each entry carries the deploy status and the gateway URL\nthat the platform's webhook delivery loop posts to. To inspect\nthe source code or deploy errors, use `GET /functions/{id}`.\n",
+        "hasJsonBody": false,
+        "method": "GET",
+        "operationId": "listFunctions",
+        "path": "/functions",
+        "pathParams": [],
+        "queryParams": [],
+        "requestSchema": null,
+        "responseSchema": {
+            "type": "array",
+            "items": {
+                "type": "object",
+                "description": "One row from the function listing.",
+                "properties": {
+                    "id": {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Function id, also the script name in the edge runtime."
+                    },
+                    "name": {
+                        "type": "string",
+                        "description": "Slug-style name set on creation. Stable; cannot be changed."
+                    },
+                    "deploy_status": {
+                        "type": "string",
+                        "enum": [
+                            "pending",
+                            "deployed",
+                            "failed"
+                        ],
+                        "description": "Lifecycle state of the latest deploy attempt:\n  * `pending` — deploy in flight; the runtime has not yet\n    confirmed the new bundle is live.\n  * `deployed` — the running edge handler is the latest code.\n  * `failed` — the most recent deploy attempt failed; the\n    previously-live code (if any) is still running. The\n    `deploy_error` field carries the error message.\n"
+                    },
+                    "deployed_at": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "format": "date-time",
+                        "description": "Timestamp of the most recent successful deploy. Null until the first deploy succeeds."
+                    },
+                    "gateway_url": {
+                        "type": "string",
+                        "format": "uri",
+                        "description": "URL the platform's webhook delivery loop posts to in order\nto invoke the function. Reference only; not directly\ncallable from outside.\n"
+                    },
+                    "created_at": {
+                        "type": "string",
+                        "format": "date-time"
+                    },
+                    "updated_at": {
+                        "type": "string",
+                        "format": "date-time"
+                    }
+                },
+                "required": [
+                    "id",
+                    "name",
+                    "deploy_status",
+                    "gateway_url",
+                    "created_at",
+                    "updated_at"
+                ]
+            }
+        },
+        "sdkName": "listFunctions",
+        "summary": "List functions",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
+    {
+        "binaryResponse": false,
+        "bodyRequired": true,
+        "command": "set-function-secret",
+        "description": "Path-keyed companion to `POST /functions/{id}/secrets`.\nIdempotent: returns 201 the first time the key is set, 200 on\nsubsequent updates. Same validation rules and same write-only\nguarantees as the POST verb; the new value lands in the running\nhandler on the next deploy.\n",
+        "hasJsonBody": true,
+        "method": "PUT",
+        "operationId": "setFunctionSecret",
+        "path": "/functions/{id}/secrets/{key}",
+        "pathParams": [
+            {
+                "description": "Resource UUID",
+                "enum": null,
+                "name": "id",
+                "required": true,
+                "type": "string"
+            },
+            {
+                "description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+                "enum": null,
+                "name": "key",
+                "required": true,
+                "type": "string"
+            }
+        ],
+        "queryParams": [],
+        "requestSchema": {
+            "type": "object",
+            "additionalProperties": false,
+            "description": "Body for PUT /functions/{id}/secrets/{key}. Key comes from the path.",
+            "properties": {
+                "value": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 4096
+                }
+            },
+            "required": [
+                "value"
+            ]
+        },
+        "responseSchema": {
+            "type": "object",
+            "description": "Returned by POST and PUT secret routes.",
+            "properties": {
+                "key": {
+                    "type": "string"
+                },
+                "created_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "updated_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "created": {
+                    "type": "boolean",
+                    "description": "True if this call inserted a new row, false if it updated an existing one."
+                }
+            },
+            "required": [
+                "key",
+                "created_at",
+                "updated_at",
+                "created"
+            ]
+        },
+        "sdkName": "setFunctionSecret",
+        "summary": "Set a secret by key",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
+    {
+        "binaryResponse": false,
+        "bodyRequired": false,
+        "command": "test-function",
+        "description": "Sends a real test email from a Primitive-controlled sender to a\nsynthetic local-part on one of the org's verified inbound\ndomains. The function fires through the normal MX delivery\npath, so reply / send-mail calls from inside the handler\nagainst the inbound's `email.id` work the same as in\nproduction. Returns immediately after the send is queued; the\ninvocation appears on the function's invocations list within a\nfew seconds.\n\nRequires that the function is currently `deployed`. Returns 422\nif the function is in `pending` or `failed` state, or if the\norg has no verified inbound domain to receive the test mail.\n",
+        "hasJsonBody": false,
+        "method": "POST",
+        "operationId": "testFunction",
+        "path": "/functions/{id}/test",
+        "pathParams": [
+            {
+                "description": "Resource UUID",
+                "enum": null,
+                "name": "id",
+                "required": true,
+                "type": "string"
+            }
+        ],
+        "queryParams": [],
+        "requestSchema": null,
+        "responseSchema": {
+            "type": "object",
+            "description": "Metadata returned by POST /functions/{id}/test. The send is\nqueued; the actual invocation lands on the function's\ninvocations list a few seconds later as the inbound mail\ntraverses the MX path.\n",
+            "properties": {
+                "inbound_domain": {
+                    "type": "string",
+                    "description": "Verified inbound domain the test email was sent to."
+                },
+                "to": {
+                    "type": "string",
+                    "description": "Synthetic local-part plus inbound_domain. Visible in the org's inbox."
+                },
+                "from": {
+                    "type": "string",
+                    "description": "Primitive-controlled outbound sender used for the test."
+                },
+                "send_id": {
+                    "type": "string",
+                    "description": "Outbound message id from the underlying send. NOT the\ninbound email's id; the inbound id is created when the\nemail arrives via MX and lands on the function's\ninvocations list.\n"
+                },
+                "subject": {
+                    "type": "string",
+                    "description": "Subject placed on the test email so it can be located in the inbox."
+                },
+                "poll_since": {
+                    "type": "string",
+                    "format": "date-time",
+                    "description": "ISO timestamp suitable as a `since` lower bound when\npolling /emails for the inbound's arrival. Captured\nslightly before the send to absorb light clock skew.\n"
+                },
+                "watch_url": {
+                    "type": "string",
+                    "format": "uri",
+                    "description": "Function detail page where invocations show up live."
+                }
+            },
+            "required": [
+                "inbound_domain",
+                "to",
+                "from",
+                "send_id",
+                "subject",
+                "poll_since",
+                "watch_url"
+            ]
+        },
+        "sdkName": "testFunction",
+        "summary": "Send a test invocation",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
+    {
+        "binaryResponse": false,
+        "bodyRequired": true,
+        "command": "update-function",
+        "description": "Replaces the function's source code with the body's `code` and\ntriggers a redeploy. Same size limits as `POST /functions`.\nUse this verb to push secret writes into the running handler:\npassing the same `code` re-runs the deploy and refreshes the\nbinding set with the latest values from the secrets table.\n\nOn a 502 deploy failure, the previously-deployed code stays\nlive; the runtime never serves a half-built bundle. The\n`deploy_error` field on the returned record carries the error\nthat came back from the runtime so you can surface it to users\nwithout polling.\n",
+        "hasJsonBody": true,
+        "method": "PUT",
+        "operationId": "updateFunction",
+        "path": "/functions/{id}",
+        "pathParams": [
+            {
+                "description": "Resource UUID",
+                "enum": null,
+                "name": "id",
+                "required": true,
+                "type": "string"
+            }
+        ],
+        "queryParams": [],
+        "requestSchema": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+                "code": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 1048576,
+                    "description": "New bundled handler. Same rules as CreateFunctionInput.code."
+                },
+                "sourceMap": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 5242880
+                }
+            },
+            "required": [
+                "code"
+            ]
+        },
+        "responseSchema": {
+            "type": "object",
+            "description": "Full function record returned by GET / PUT.",
+            "properties": {
+                "id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "code": {
+                    "type": "string",
+                    "description": "The bundled handler source. UTF-8 string up to 1 MiB. The\nsame value most recently passed as `code` to POST or PUT.\n"
+                },
+                "deploy_status": {
+                    "type": "string",
+                    "enum": [
+                        "pending",
+                        "deployed",
+                        "failed"
+                    ],
+                    "description": "Lifecycle state of the latest deploy attempt:\n  * `pending` — deploy in flight; the runtime has not yet\n    confirmed the new bundle is live.\n  * `deployed` — the running edge handler is the latest code.\n  * `failed` — the most recent deploy attempt failed; the\n    previously-live code (if any) is still running. The\n    `deploy_error` field carries the error message.\n"
+                },
+                "deploy_error": {
+                    "type": [
+                        "string",
+                        "null"
+                    ],
+                    "description": "Error message from the most recent failed deploy, or null\nafter a successful deploy. Surface this to users to explain\na `failed` status without polling.\n"
+                },
+                "deployed_at": {
+                    "type": [
+                        "string",
+                        "null"
+                    ],
+                    "format": "date-time"
+                },
+                "gateway_url": {
+                    "type": "string",
+                    "format": "uri"
+                },
+                "created_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "updated_at": {
+                    "type": "string",
+                    "format": "date-time"
+                }
+            },
+            "required": [
+                "id",
+                "name",
+                "code",
+                "deploy_status",
+                "gateway_url",
+                "created_at",
+                "updated_at"
+            ]
+        },
+        "sdkName": "updateFunction",
+        "summary": "Update and redeploy a function",
+        "tag": "Functions",
+        "tagCommand": "functions"
+    },
     {
         "binaryResponse": false,
         "bodyRequired": false,
@@ -3131,7 +4125,7 @@ export const operationManifest = [
         "binaryResponse": false,
         "bodyRequired": true,
         "command": "send-email",
-        "description": "Sends an outbound email through Primitive's outbound relay. By default\nthe request returns once the relay accepts the message for delivery.\nSet `wait: true` to wait for the first downstream SMTP delivery outcome.\n",
+        "description": "Sends an outbound email through Primitive's outbound relay. By default\nthe request returns once the relay accepts the message for delivery.\nSet `wait: true` to wait for the first downstream SMTP delivery outcome.\n\n**Host routing.** /send-mail is served by the attachments-\nsupporting host (`https://api.primitive.dev/v1`) so the\nrequest body can carry inline attachments up to ~30 MiB raw.\nThe primary host (`https://www.primitive.dev/api/v1`) also\naccepts /send-mail for attachment-free sends; sends WITH\nattachments to the primary host return 413\n`attachments_unsupported_on_this_endpoint`. The typed SDKs\nroute /send-mail to the attachments host automatically.\n",
         "hasJsonBody": true,
         "method": "POST",
         "operationId": "sendEmail",