@primitivedotdev/sdk 0.19.0 → 0.21.0

package/oclif.manifest.json

@@ -87,10 +87,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -178,10 +188,11 @@
         "<%= config.bin %> login --force"
       ],
       "flags": {
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -225,10 +236,11 @@
         "<%= config.bin %> logout"
       ],
       "flags": {
-        "base-url": {
-          "description": "Override the API base URL used for key revocation",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -261,10 +273,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -291,10 +313,10 @@
       "args": {},
       "description": "Print the N most recent inbound emails as a one-line-per-row text table. Designed for quick triage and visual scanning. For programmatic access, use `primitive emails:list-emails` (full JSON envelope, cursor pagination, filters) or pass `--json` here for the same raw shape without pagination/filters.\n\n  ID display is TTY-aware. When STDOUT is a terminal, the table truncates each row's id to the first 8 characters for readability. When STDOUT is piped or redirected (the row stream is being consumed by another command), the full UUID is printed so the id can be fed straight back into `emails:get-email`, `emails:delete-email`, etc. without a separate `--json` round-trip.\n\n  Output streams: the column header line is written to STDERR so the row data on STDOUT stays grep/awk-friendly. `--json` writes everything (including the envelope) to STDOUT and is equivalent to running `emails:list-emails --limit N` for the same N.",
       "examples": [
-        "<%= config.bin %> emails:latest",
-        "<%= config.bin %> emails:latest --limit 25",
-        "<%= config.bin %> emails:latest | head -1 | awk '{print $1}'  # full UUID since piped",
-        "<%= config.bin %> emails:latest --json | jq '.data[0].id'"
+        "<%= config.bin %> emails latest",
+        "<%= config.bin %> emails latest --limit 25",
+        "<%= config.bin %> emails latest | head -1 | awk '{print $1}'  # full UUID since piped",
+        "<%= config.bin %> emails latest --json | jq '.data[0].id'"
       ],
       "flags": {
         "api-key": {
@@ -305,10 +327,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -344,10 +376,15 @@
       "summary": "Show the most recent inbound emails as a compact table",
       "enableJsonFlag": false
     },
-    "account:get-account": {
+    "emails:watch": {
       "aliases": [],
       "args": {},
-      "description": "GET /account",
+      "description": "Poll for new inbound emails and print matching messages as they arrive.",
+      "examples": [
+        "<%= config.bin %> emails watch --to support@example.com",
+        "<%= config.bin %> emails watch --subject verify --seconds 300",
+        "<%= config.bin %> emails watch --number 20 --jsonl"
+      ],
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -357,35 +394,162 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "time": {
-          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
-          "name": "time",
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body": {
+          "description": "Full-text body filter",
+          "name": "body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "domain": {
+          "description": "Filter by inbound email domain",
+          "name": "domain",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "domain-id": {
+          "description": "Filter by domain UUID",
+          "name": "domain-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "from": {
+          "description": "Filter by sender address or domain",
+          "name": "from",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "has-attachment": {
+          "description": "Only show emails with one or more attachments",
+          "name": "has-attachment",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "include-existing": {
+          "description": "Start from existing matching emails instead of only new arrivals",
+          "name": "include-existing",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Seconds to wait between empty polls",
+          "name": "interval",
+          "default": 2,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "jsonl": {
+          "description": "Print each email as one JSON object per line",
+          "name": "jsonl",
           "allowNo": false,
           "type": "boolean"
+        },
+        "number": {
+          "description": "Exit after printing this many matching emails",
+          "name": "number",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "page-size": {
+          "description": "Emails to fetch per poll (1-100)",
+          "name": "page-size",
+          "default": 50,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "q": {
+          "description": "Full-text search DSL query",
+          "name": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "seconds": {
+          "description": "Exit after this many seconds",
+          "name": "seconds",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "since": {
+          "description": "Only show emails received on or after this date/time",
+          "name": "since",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "spam-score-gte": {
+          "description": "Only show emails with spam score greater than or equal to this value",
+          "name": "spam-score-gte",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "spam-score-lt": {
+          "description": "Only show emails with spam score below this value",
+          "name": "spam-score-lt",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "subject": {
+          "description": "Full-text subject filter",
+          "name": "subject",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to": {
+          "description": "Filter by recipient address or domain",
+          "name": "to",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "account:get-account",
+      "id": "emails:watch",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Get account info",
+      "summary": "Watch inbound emails with filters",
       "enableJsonFlag": false
     },
-    "account:get-storage-stats": {
+    "emails:wait": {
       "aliases": [],
       "args": {},
-      "description": "GET /account/storage",
+      "description": "Poll until matching inbound emails arrive, printing each match as it is found.",
+      "examples": [
+        "<%= config.bin %> emails wait --to test@example.com",
+        "<%= config.bin %> emails wait --subject verify --number 5 --timeout 120",
+        "<%= config.bin %> emails wait --q 'domain:example.com' --table"
+      ],
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -395,35 +559,164 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "time": {
-          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
-          "name": "time",
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body": {
+          "description": "Full-text body filter",
+          "name": "body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "domain": {
+          "description": "Filter by inbound email domain",
+          "name": "domain",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "domain-id": {
+          "description": "Filter by domain UUID",
+          "name": "domain-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "from": {
+          "description": "Filter by sender address or domain",
+          "name": "from",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "has-attachment": {
+          "description": "Only match emails with one or more attachments",
+          "name": "has-attachment",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "include-existing": {
+          "description": "Start from existing matching emails instead of only new arrivals",
+          "name": "include-existing",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Seconds to wait between empty polls",
+          "name": "interval",
+          "default": 2,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "number": {
+          "char": "n",
+          "description": "Exit successfully after this many matching emails",
+          "name": "number",
+          "default": 1,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "page-size": {
+          "description": "Emails to fetch per poll (1-100)",
+          "name": "page-size",
+          "default": 50,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "q": {
+          "description": "Full-text search DSL query",
+          "name": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "since": {
+          "description": "Only match emails received on or after this date/time",
+          "name": "since",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "spam-score-gte": {
+          "description": "Only match emails with spam score greater than or equal to this value",
+          "name": "spam-score-gte",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "spam-score-lt": {
+          "description": "Only match emails with spam score below this value",
+          "name": "spam-score-lt",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "subject": {
+          "description": "Full-text subject filter",
+          "name": "subject",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "table": {
+          "description": "Print a human-readable table instead of JSONL",
+          "name": "table",
           "allowNo": false,
           "type": "boolean"
+        },
+        "timeout": {
+          "description": "Seconds to wait before exiting nonzero; 0 waits forever",
+          "name": "timeout",
+          "default": 300,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to": {
+          "description": "Filter by recipient address or domain",
+          "name": "to",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "account:get-storage-stats",
+      "id": "emails:wait",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Get storage usage",
+      "summary": "Wait for matching inbound emails",
       "enableJsonFlag": false
     },
-    "account:get-webhook-secret": {
+    "functions:deploy": {
       "aliases": [],
       "args": {},
-      "description": "Returns the webhook signing secret for your account. If no\nsecret exists yet, one is generated automatically on first\naccess.\n\nSigning is account-scoped, not per-endpoint. Every webhook\ndelivery from any of your registered endpoints is signed\nwith this single secret. Rotate via\n`POST /account/webhook-secret/rotate`.\n\n**Secret format**: the returned string looks base64-shaped\n(e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.\nUse it AS-IS as a UTF-8 string when computing HMAC over a\ndelivery body. Base64-decoding before HMAC will silently\nproduce mismatched signatures.\n\nSee the API-level \"Webhook signing\" section for the full\nwire format (header name, signed string shape, hash algo,\ntolerance) including a language-agnostic verification\nrecipe.\n",
+      "description": "Deploy a new function from a bundled handler file. Agent-grade shortcut for functions:create-function.\n\n  Reads the bundle off disk (--file) instead of forcing the caller to\n  serialize the source into a JSON body. Use the underlying operation\n  `functions:create-function` if you need the full flag surface\n  (raw-body JSON, etc.).",
+      "examples": [
+        "<%= config.bin %> functions:deploy --name forwarder --file ./bundle.js",
+        "<%= config.bin %> functions:deploy --name forwarder --file ./bundle.js --source-map-file ./bundle.js.map"
+      ],
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -433,10 +726,43 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "name": {
+          "description": "Slug-style name. Lowercase letters, digits, hyphens, underscores. 1-64 chars. Must be unique within the org.",
+          "name": "name",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "file": {
+          "description": "Path to the bundled ESM handler file (single self-contained module). Loaded as the `code` body field.",
+          "name": "file",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "source-map-file": {
+          "description": "Optional path to a source map for the bundle. Stored only on the runtime side and used to symbolicate stack traces.",
+          "name": "source-map-file",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -450,18 +776,22 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "account:get-webhook-secret",
+      "id": "functions:deploy",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Get webhook signing secret",
+      "summary": "Deploy a new function from a bundled handler file",
       "enableJsonFlag": false
     },
-    "account:rotate-webhook-secret": {
+    "functions:redeploy": {
       "aliases": [],
       "args": {},
-      "description": "Generates a new webhook signing secret, replacing the current one.\nRate limited to once per 60 minutes.\n",
+      "description": "Update or redeploy a function from a bundled handler file. Agent-grade shortcut for functions:update-function.\n\n  Use to push a new bundle OR to refresh secret bindings into the\n  running handler. The same file is fine for both: the deploy reads\n  the bindings table fresh on every call, so passing the existing\n  bundle picks up any secret writes since the last deploy.",
+      "examples": [
+        "<%= config.bin %> functions:redeploy --id <fn-id> --file ./bundle.js",
+        "<%= config.bin %> functions:redeploy --id <fn-id> --file ./bundle.js --source-map-file ./bundle.js.map"
+      ],
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -471,10 +801,43 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "id": {
+          "description": "Function id (UUID). The function must already exist.",
+          "name": "id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "file": {
+          "description": "Path to the bundled ESM handler file. Loaded as the `code` body field.",
+          "name": "file",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "source-map-file": {
+          "description": "Optional path to a source map for the bundle. Used to symbolicate stack traces in the function's logs.",
+          "name": "source-map-file",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -488,18 +851,18 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "account:rotate-webhook-secret",
+      "id": "functions:redeploy",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Rotate webhook signing secret",
+      "summary": "Redeploy a function from a bundled handler file",
       "enableJsonFlag": false
     },
-    "account:update-account": {
+    "account:get-account": {
       "aliases": [],
       "args": {},
-      "description": "PATCH /account",
+      "description": "GET /account",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -509,10 +872,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -522,18 +895,210 @@
           "name": "time",
           "allowNo": false,
           "type": "boolean"
-        },
-        "raw-body": {
-          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
-          "name": "raw-body",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "body-file": {
-          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
-          "name": "body-file",
-          "hasDynamicHelp": false,
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "account:get-account",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Get account info",
+      "enableJsonFlag": false
+    },
+    "account:get-storage-stats": {
+      "aliases": [],
+      "args": {},
+      "description": "GET /account/storage",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "account:get-storage-stats",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Get storage usage",
+      "enableJsonFlag": false
+    },
+    "account:get-webhook-secret": {
+      "aliases": [],
+      "args": {},
+      "description": "Returns the webhook signing secret for your account. If no\nsecret exists yet, one is generated automatically on first\naccess.\n\nSigning is account-scoped, not per-endpoint. Every webhook\ndelivery from any of your registered endpoints is signed\nwith this single secret. Rotate via\n`POST /account/webhook-secret/rotate`.\n\n**Secret format**: the returned string looks base64-shaped\n(e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.\nUse it AS-IS as a UTF-8 string when computing HMAC over a\ndelivery body. Base64-decoding before HMAC will silently\nproduce mismatched signatures.\n\nSee the API-level \"Webhook signing\" section for the full\nwire format (header name, signed string shape, hash algo,\ntolerance) including a language-agnostic verification\nrecipe.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "account:get-webhook-secret",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Get webhook signing secret",
+      "enableJsonFlag": false
+    },
+    "account:rotate-webhook-secret": {
+      "aliases": [],
+      "args": {},
+      "description": "Generates a new webhook signing secret, replacing the current one.\nRate limited to once per 60 minutes.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "account:rotate-webhook-secret",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Rotate webhook signing secret",
+      "enableJsonFlag": false
+    },
+    "account:update-account": {
+      "aliases": [],
+      "args": {},
+      "description": "PATCH /account",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
+          "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
@@ -574,10 +1139,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -633,10 +1208,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -692,10 +1277,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -751,10 +1346,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -810,10 +1415,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -856,10 +1471,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -894,10 +1519,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -967,10 +1602,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1013,10 +1658,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1059,10 +1714,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1105,10 +1770,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1166,10 +1841,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1227,10 +1912,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1273,10 +1968,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1367,24 +2072,917 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "id": {
+          "description": "Resource UUID",
+          "name": "id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "emails:replay-email-webhooks",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Replay email webhooks",
+      "enableJsonFlag": false
+    },
+    "emails:search-emails": {
+      "aliases": [],
+      "args": {},
+      "description": "Searches inbound emails with structured filters and optional\nfull-text matching across parsed email fields. This endpoint is\noptimized for filtered inbox views and CLI polling workflows:\ncallers that only need new accepted mail can pass\n`sort=received_at_asc`, `snippet=false`, `include_facets=false`,\nand a `date_from` timestamp.\n\n`q`, `subject`, and `body` use the same English full-text index\nas the web inbox search. Structured filters such as `from`, `to`,\n`domain_id`, status, attachment presence, and spam score bounds\nare combined with the text query.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "q": {
+          "description": "Full-text search DSL query.",
+          "name": "q",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "from": {
+          "description": "Filter by sender address or sender domain.",
+          "name": "from",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "to": {
+          "description": "Filter by recipient address or recipient domain.",
+          "name": "to",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "subject": {
+          "description": "Full-text search restricted to the subject field.",
+          "name": "subject",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body": {
+          "description": "Full-text search restricted to the parsed text body.",
+          "name": "body",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "domain-id": {
+          "description": "Filter by domain ID.",
+          "name": "domain-id",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "status": {
+          "description": "Filter by inbound email lifecycle status.",
+          "name": "status",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "date-from": {
+          "description": "Filter emails received on or after this timestamp.",
+          "name": "date-from",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "date-to": {
+          "description": "Filter emails received on or before this timestamp.",
+          "name": "date-to",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "has-attachment": {
+          "description": "Filter by whether the email has one or more attachments.",
+          "name": "has-attachment",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "true",
+            "false"
+          ],
+          "type": "option"
+        },
+        "spam-score-lt": {
+          "description": "Filter to emails with spam score below this value.",
+          "name": "spam-score-lt",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "spam-score-gte": {
+          "description": "Filter to emails with spam score greater than or equal to this value.",
+          "name": "spam-score-gte",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sort": {
+          "description": "Sort mode. Defaults to relevance when a text query is present,\notherwise `received_at_desc`.\n",
+          "name": "sort",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "relevance",
+            "received_at_desc",
+            "received_at_asc"
+          ],
+          "type": "option"
+        },
+        "cursor": {
+          "description": "Opaque pagination cursor from a previous search response.",
+          "name": "cursor",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "limit": {
+          "description": "Number of results per page",
+          "name": "limit",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "snippet": {
+          "description": "Include subject/body highlight snippets when text search is active.",
+          "name": "snippet",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "true",
+            "false"
+          ],
+          "type": "option"
+        },
+        "include-facets": {
+          "description": "Include facet counts for sender, domain, status, and attachment presence.",
+          "name": "include-facets",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "true",
+            "false"
+          ],
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "emails:search-emails",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Search inbound emails",
+      "enableJsonFlag": false
+    },
+    "endpoints:create-endpoint": {
+      "aliases": [],
+      "args": {},
+      "description": "Creates a new webhook endpoint. If a deactivated endpoint\nwith the same URL and domain exists, it is reactivated\ninstead. Subject to plan limits on the number of active\nendpoints.\n\n**Signing is account-scoped, not per-endpoint.** This call\ndoes not return any signing material; every endpoint on the\naccount uses the same webhook secret, fetched via\n`GET /account/webhook-secret`. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   rules  object  Endpoint-specific filtering rules\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "url": {
+          "description": "The webhook URL to deliver events to",
+          "name": "url",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "domain-id": {
+          "description": "Restrict to emails from a specific domain",
+          "name": "domain-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "enabled": {
+          "description": "Whether the endpoint is active",
+          "name": "enabled",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "endpoints:create-endpoint",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Create a webhook endpoint",
+      "enableJsonFlag": false
+    },
+    "endpoints:delete-endpoint": {
+      "aliases": [],
+      "args": {},
+      "description": "Soft-deletes a webhook endpoint. The endpoint will no longer\nreceive webhook deliveries.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "id": {
+          "description": "Resource UUID",
+          "name": "id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "endpoints:delete-endpoint",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Delete a webhook endpoint",
+      "enableJsonFlag": false
+    },
+    "endpoints:list-endpoints": {
+      "aliases": [],
+      "args": {},
+      "description": "Returns all active (non-deleted) webhook endpoints.",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "endpoints:list-endpoints",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "List webhook endpoints",
+      "enableJsonFlag": false
+    },
+    "endpoints:test-endpoint": {
+      "aliases": [],
+      "args": {},
+      "description": "Sends a sample `email.received` event to the endpoint. The request\nincludes SSRF protection (private IP rejection and DNS pinning).\nRate limited to 4 per minute and 30 per hour (non-exempt).\nSuccessful deliveries and verified-domain endpoints are exempt\nfrom the rate limit.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "id": {
+          "description": "Resource UUID",
+          "name": "id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "endpoints:test-endpoint",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Send a test webhook",
+      "enableJsonFlag": false
+    },
+    "endpoints:update-endpoint": {
+      "aliases": [],
+      "args": {},
+      "description": "Updates an active webhook endpoint. If the URL is changed, the old\nendpoint is deactivated and a new one is created (or an existing\ndeactivated endpoint with the new URL is reactivated).\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   rules  object\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "id": {
+          "description": "Resource UUID",
+          "name": "id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "domain-id": {
+          "description": "domain_id",
+          "name": "domain-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "enabled": {
+          "description": "enabled",
+          "name": "enabled",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "url": {
+          "description": "New webhook URL (triggers endpoint rotation)",
+          "name": "url",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "endpoints:update-endpoint",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Update a webhook endpoint",
+      "enableJsonFlag": false
+    },
+    "filters:create-filter": {
+      "aliases": [],
+      "args": {},
+      "description": "Creates a new whitelist or blocklist filter. Per-domain filters\nrequire a Pro plan. Patterns are stored as lowercase.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "pattern": {
+          "description": "Email address or pattern to filter",
+          "name": "pattern",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "type": {
+          "description": "type",
+          "name": "type",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "whitelist",
+            "blocklist"
+          ],
+          "type": "option"
+        },
+        "domain-id": {
+          "description": "Restrict filter to a specific domain (Pro plan required)",
+          "name": "domain-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "filters:create-filter",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Create a filter rule",
+      "enableJsonFlag": false
+    },
+    "filters:delete-filter": {
+      "aliases": [],
+      "args": {},
+      "description": "DELETE /filters/{id}",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "id": {
+          "description": "Resource UUID",
+          "name": "id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "filters:delete-filter",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Delete a filter rule",
+      "enableJsonFlag": false
+    },
+    "filters:list-filters": {
+      "aliases": [],
+      "args": {},
+      "description": "Returns all whitelist and blocklist filter rules.",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "filters:list-filters",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "List filter rules",
+      "enableJsonFlag": false
+    },
+    "filters:update-filter": {
+      "aliases": [],
+      "args": {},
+      "description": "Toggle a filter's enabled state.",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "id": {
+          "description": "Resource UUID",
+          "name": "id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "enabled": {
+          "description": "enabled",
+          "name": "enabled",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "filters:update-filter",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Update a filter rule",
+      "enableJsonFlag": false
+    },
+    "functions:create-function": {
+      "aliases": [],
+      "args": {},
+      "description": "Creates and deploys a new function. The handler must be a single\nESM module that exports a default async function receiving the\n`email.received` event (see the Webhook payload section for the\nfull schema). Code is bundled before being uploaded; ship a\nsingle self-contained file rather than relying on external\nimports.\n\n**Code limits.** `code` is capped at 1 MiB UTF-8. `sourceMap`\n(optional) is capped at 5 MiB UTF-8 and is stored only on the\nedge runtime side; it is not persisted in Primitive's database.\n\n**Auto-wiring.** On successful deploy, Primitive automatically\ncreates a webhook endpoint that delivers inbound mail to the\nfunction. There is nothing to configure on the Endpoints API\nfor this to work; the gateway URL returned here is for\nreference only and is not directly callable from outside.\n\n**Secrets.** New functions ship with the managed secrets\n(`PRIMITIVE_WEBHOOK_SECRET`, `PRIMITIVE_API_KEY`) already\nbound. Add user-set secrets via\n`POST /functions/{id}/secrets`; secret writes only land in the\nrunning handler on the next redeploy.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "time": {
-          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
-          "name": "time",
-          "allowNo": false,
-          "type": "boolean"
+        "code": {
+          "description": "Bundled handler as a single ESM module. Up to 1 MiB UTF-8. Must export a default `{ async fetch(req, env, ctx) { ... } }` object.",
+          "name": "code",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
-        "id": {
-          "description": "Resource UUID",
-          "name": "id",
-          "required": true,
+        "name": {
+          "description": "Slug-style name. Lowercase letters, digits, hyphens, and underscores. 1 to 64 characters. Must be unique within the org; a 409 is returned on collision.",
+          "name": "name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sourceMap": {
+          "description": "Optional source map for the bundle. Up to 5 MiB UTF-8. Stored only on the runtime side (not in Primitive's database) and used to symbolicate stack traces in the function's logs.",
+          "name": "sourceMap",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1392,18 +2990,18 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "emails:replay-email-webhooks",
+      "id": "functions:create-function",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Replay email webhooks",
+      "summary": "Deploy a function",
       "enableJsonFlag": false
     },
-    "endpoints:create-endpoint": {
+    "functions:create-function-secret": {
       "aliases": [],
       "args": {},
-      "description": "Creates a new webhook endpoint. If a deactivated endpoint\nwith the same URL and domain exists, it is reactivated\ninstead. Subject to plan limits on the number of active\nendpoints.\n\n**Signing is account-scoped, not per-endpoint.** This call\ndoes not return any signing material; every endpoint on the\naccount uses the same webhook secret, fetched via\n`GET /account/webhook-secret`. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   rules  object  Endpoint-specific filtering rules\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
+      "description": "Idempotent insert-or-update keyed on `(function_id, key)`.\nReturns 201 the first time the key is set, 200 on subsequent\nupdates. Values are encrypted at rest and only become visible\nto the running handler on the next deploy (`PUT /functions/{id}`\nwith the existing code is sufficient to refresh bindings).\n\nKeys must match `^[A-Z_][A-Z0-9_]*$` (uppercase letters,\ndigits, underscores; first character is a letter or\nunderscore). Values are at most 4096 UTF-8 bytes. System-\nmanaged keys are reserved and rejected.\n",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -1413,10 +3011,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1427,6 +3035,14 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "id": {
+          "description": "Resource UUID",
+          "name": "id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "raw-body": {
           "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
           "name": "raw-body",
@@ -1441,41 +3057,35 @@
           "multiple": false,
           "type": "option"
         },
-        "url": {
-          "description": "The webhook URL to deliver events to",
-          "name": "url",
+        "key": {
+          "description": "Uppercase letters, digits, and underscores. Must start with a letter or underscore. System-managed keys (e.g. PRIMITIVE_WEBHOOK_SECRET) are reserved.",
+          "name": "key",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "domain-id": {
-          "description": "Restrict to emails from a specific domain",
-          "name": "domain-id",
+        "value": {
+          "description": "Secret value, up to 4096 UTF-8 bytes. Encrypted at rest. Never returned by any read endpoint.",
+          "name": "value",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "enabled": {
-          "description": "Whether the endpoint is active",
-          "name": "enabled",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "endpoints:create-endpoint",
+      "id": "functions:create-function-secret",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Create a webhook endpoint",
+      "summary": "Create or update a secret",
       "enableJsonFlag": false
     },
-    "endpoints:delete-endpoint": {
+    "functions:delete-function": {
       "aliases": [],
       "args": {},
-      "description": "Soft-deletes a webhook endpoint. The endpoint will no longer\nreceive webhook deliveries.\n",
+      "description": "Soft-deletes the function row, removes the script from the edge\nruntime, and deactivates the auto-wired webhook endpoint so no\nfurther inbound mail is delivered. Past deploy history,\ninvocations, and logs are retained.\n\nReturns 502 if the runtime delete fails partway; the function\nrow stays in place and the call is safe to retry until it\nsucceeds.\n",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -1485,10 +3095,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1510,18 +3130,18 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "endpoints:delete-endpoint",
+      "id": "functions:delete-function",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Delete a webhook endpoint",
+      "summary": "Delete a function",
       "enableJsonFlag": false
     },
-    "endpoints:list-endpoints": {
+    "functions:delete-function-secret": {
       "aliases": [],
       "args": {},
-      "description": "Returns all active (non-deleted) webhook endpoints.",
+      "description": "Removes the secret. The binding stays live in the running\nhandler until the next deploy refreshes the binding set\n(`PUT /functions/{id}` with the existing code is sufficient).\nReturns 404 if the key did not exist. Managed system keys\ncannot be deleted.\n",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -1531,10 +3151,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1544,22 +3174,38 @@
           "name": "time",
           "allowNo": false,
           "type": "boolean"
+        },
+        "id": {
+          "description": "Resource UUID",
+          "name": "id",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "key": {
+          "description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+          "name": "key",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "endpoints:list-endpoints",
+      "id": "functions:delete-function-secret",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "List webhook endpoints",
+      "summary": "Delete a secret",
       "enableJsonFlag": false
     },
-    "endpoints:test-endpoint": {
+    "functions:get-function": {
       "aliases": [],
       "args": {},
-      "description": "Sends a sample `email.received` event to the endpoint. The request\nincludes SSRF protection (private IP rejection and DNS pinning).\nRate limited to 4 per minute and 30 per hour (non-exempt).\nSuccessful deliveries and verified-domain endpoints are exempt\nfrom the rate limit.\n",
+      "description": "Returns the full record for a function, including its current\nsource code and the deploy status / error from the most recent\ndeploy attempt.\n",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -1569,10 +3215,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1594,18 +3250,18 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "endpoints:test-endpoint",
+      "id": "functions:get-function",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Send a test webhook",
+      "summary": "Get a function",
       "enableJsonFlag": false
     },
-    "endpoints:update-endpoint": {
+    "functions:list-function-secrets": {
       "aliases": [],
       "args": {},
-      "description": "Updates an active webhook endpoint. If the URL is changed, the old\nendpoint is deactivated and a new one is created (or an existing\ndeactivated endpoint with the new URL is reactivated).\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   rules  object\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
+      "description": "Returns metadata for every secret bound to the function, with\nmanaged entries (provisioned by Primitive) listed first and\nuser-set entries listed alphabetically after. **Values are\nnever returned.** Secret writes are write-only.\n\nManaged entries (e.g. `PRIMITIVE_WEBHOOK_SECRET`,\n`PRIMITIVE_API_KEY`) carry a `description` instead of\n`created_at` / `updated_at`. They cannot be created, updated,\nor deleted via this API.\n",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -1615,10 +3271,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1636,56 +3302,70 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "raw-body": {
-          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
-          "name": "raw-body",
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "functions:list-function-secrets",
+      "pluginAlias": "@primitivedotdev/sdk",
+      "pluginName": "@primitivedotdev/sdk",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "List a function's secrets",
+      "enableJsonFlag": false
+    },
+    "functions:list-functions": {
+      "aliases": [],
+      "args": {},
+      "description": "Returns every active (non-deleted) function in the org, newest\nfirst. Each entry carries the deploy status and the gateway URL\nthat the platform's webhook delivery loop posts to. To inspect\nthe source code or deploy errors, use `GET /functions/{id}`.\n",
+      "flags": {
+        "api-key": {
+          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
+          "env": "PRIMITIVE_API_KEY",
+          "name": "api-key",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "body-file": {
-          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
-          "name": "body-file",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "domain-id": {
-          "description": "domain_id",
-          "name": "domain-id",
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "enabled": {
-          "description": "enabled",
-          "name": "enabled",
+        "time": {
+          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
+          "name": "time",
           "allowNo": false,
           "type": "boolean"
-        },
-        "url": {
-          "description": "New webhook URL (triggers endpoint rotation)",
-          "name": "url",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "endpoints:update-endpoint",
+      "id": "functions:list-functions",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Update a webhook endpoint",
+      "summary": "List functions",
       "enableJsonFlag": false
     },
-    "filters:create-filter": {
+    "functions:set-function-secret": {
       "aliases": [],
       "args": {},
-      "description": "Creates a new whitelist or blocklist filter. Per-domain filters\nrequire a Pro plan. Patterns are stored as lowercase.\n",
+      "description": "Path-keyed companion to `POST /functions/{id}/secrets`.\nIdempotent: returns 201 the first time the key is set, 200 on\nsubsequent updates. Same validation rules and same write-only\nguarantees as the POST verb; the new value lands in the running\nhandler on the next deploy.\n",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -1695,10 +3375,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1709,41 +3399,39 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "raw-body": {
-          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
-          "name": "raw-body",
+        "id": {
+          "description": "Resource UUID",
+          "name": "id",
+          "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "body-file": {
-          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
-          "name": "body-file",
+        "key": {
+          "description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+          "name": "key",
+          "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "pattern": {
-          "description": "Email address or pattern to filter",
-          "name": "pattern",
+        "raw-body": {
+          "description": "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available.",
+          "name": "raw-body",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "type": {
-          "description": "type",
-          "name": "type",
+        "body-file": {
+          "description": "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload.",
+          "name": "body-file",
           "hasDynamicHelp": false,
           "multiple": false,
-          "options": [
-            "whitelist",
-            "blocklist"
-          ],
           "type": "option"
         },
-        "domain-id": {
-          "description": "Restrict filter to a specific domain (Pro plan required)",
-          "name": "domain-id",
+        "value": {
+          "description": "value",
+          "name": "value",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1751,18 +3439,18 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "filters:create-filter",
+      "id": "functions:set-function-secret",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Create a filter rule",
+      "summary": "Set a secret by key",
       "enableJsonFlag": false
     },
-    "filters:delete-filter": {
+    "functions:test-function": {
       "aliases": [],
       "args": {},
-      "description": "DELETE /filters/{id}",
+      "description": "Sends a real test email from a Primitive-controlled sender to a\nsynthetic local-part on one of the org's verified inbound\ndomains. The function fires through the normal MX delivery\npath, so reply / send-mail calls from inside the handler\nagainst the inbound's `email.id` work the same as in\nproduction. Returns immediately after the send is queued; the\ninvocation appears on the function's invocations list within a\nfew seconds.\n\nRequires that the function is currently `deployed`. Returns 422\nif the function is in `pending` or `failed` state, or if the\norg has no verified inbound domain to receive the test mail.\n",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -1772,10 +3460,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1797,18 +3495,18 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "filters:delete-filter",
+      "id": "functions:test-function",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Delete a filter rule",
+      "summary": "Send a test invocation",
       "enableJsonFlag": false
     },
-    "filters:list-filters": {
+    "functions:update-function": {
       "aliases": [],
       "args": {},
-      "description": "Returns all whitelist and blocklist filter rules.",
+      "description": "Replaces the function's source code with the body's `code` and\ntriggers a redeploy. Same size limits as `POST /functions`.\nUse this verb to push secret writes into the running handler:\npassing the same `code` re-runs the deploy and refreshes the\nbinding set with the latest values from the secrets table.\n\nOn a 502 deploy failure, the previously-deployed code stays\nlive; the runtime never serves a half-built bundle. The\n`deploy_error` field on the returned record carries the error\nthat came back from the runtime so you can surface it to users\nwithout polling.\n",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -1818,48 +3516,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "time": {
-          "description": "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.",
-          "name": "time",
-          "allowNo": false,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "filters:list-filters",
-      "pluginAlias": "@primitivedotdev/sdk",
-      "pluginName": "@primitivedotdev/sdk",
-      "pluginType": "core",
-      "strict": true,
-      "summary": "List filter rules",
-      "enableJsonFlag": false
-    },
-    "filters:update-filter": {
-      "aliases": [],
-      "args": {},
-      "description": "Toggle a filter's enabled state.",
-      "flags": {
-        "api-key": {
-          "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
-          "env": "PRIMITIVE_API_KEY",
-          "name": "api-key",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1892,21 +3562,29 @@
           "multiple": false,
           "type": "option"
         },
-        "enabled": {
-          "description": "enabled",
-          "name": "enabled",
-          "allowNo": false,
-          "type": "boolean"
+        "code": {
+          "description": "New bundled handler. Same rules as CreateFunctionInput.code.",
+          "name": "code",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sourceMap": {
+          "description": "sourceMap",
+          "name": "sourceMap",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "filters:update-filter",
+      "id": "functions:update-function",
       "pluginAlias": "@primitivedotdev/sdk",
       "pluginName": "@primitivedotdev/sdk",
       "pluginType": "core",
       "strict": true,
-      "summary": "Update a filter rule",
+      "summary": "Update and redeploy a function",
       "enableJsonFlag": false
     },
     "sending:get-send-permissions": {
@@ -1922,10 +3600,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1960,10 +3648,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -2006,10 +3704,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -2100,10 +3808,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -2177,7 +3895,7 @@
     "sending:send-email": {
       "aliases": [],
       "args": {},
-      "description": "Sends an outbound email through Primitive's outbound relay. By default\nthe request returns once the relay accepts the message for delivery.\nSet `wait: true` to wait for the first downstream SMTP delivery outcome.\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   references  array<string>  Full ordered message-id chain for the thread.\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
+      "description": "Sends an outbound email through Primitive's outbound relay. By default\nthe request returns once the relay accepts the message for delivery.\nSet `wait: true` to wait for the first downstream SMTP delivery outcome.\n\n**Host routing.** /send-mail is served by the attachments-\nsupporting host (`https://api.primitive.dev/v1`) so the\nrequest body can carry inline attachments up to ~30 MiB raw.\nThe primary host (`https://www.primitive.dev/api/v1`) also\naccepts /send-mail for attachment-free sends; sends WITH\nattachments to the primary host return 413\n`attachments_unsupported_on_this_endpoint`. The typed SDKs\nroute /send-mail to the attachments host automatically.\n\n\nBody fields requiring --raw-body JSON (these are not exposed as flags):\n   references  array<string>  Full ordered message-id chain for the thread.\n(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)",
       "flags": {
         "api-key": {
           "description": "Primitive API key (defaults to PRIMITIVE_API_KEY or saved `primitive login` credentials)",
@@ -2187,10 +3905,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -2294,10 +4022,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -2386,10 +4124,20 @@
           "multiple": false,
           "type": "option"
         },
-        "base-url": {
-          "description": "API base URL (defaults to PRIMITIVE_API_URL or production)",
-          "env": "PRIMITIVE_API_URL",
-          "name": "base-url",
+        "api-base-url-1": {
+          "description": "Override the primary API base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_1",
+          "hidden": true,
+          "name": "api-base-url-1",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-base-url-2": {
+          "description": "Override the attachments-supporting send host base URL. Internal testing only; not documented to customers.",
+          "env": "PRIMITIVE_API_BASE_URL_2",
+          "hidden": true,
+          "name": "api-base-url-2",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -2420,5 +4168,5 @@
       "enableJsonFlag": false
     }
   },
-  "version": "0.19.0"
+  "version": "0.21.0"
 }