primcli 1.10.0 → 1.12.0

package/dist/oclif/index.js

@@ -38,6 +38,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	createFunctionSecret: () => createFunctionSecret,
 	createOrgSecret: () => createOrgSecret,
 	createRegistry: () => createRegistry,
+	createRoute: () => createRoute,
 	decideRegistryRequest: () => decideRegistryRequest,
 	defineAgent: () => defineAgent,
 	deleteDomain: () => deleteDomain,
@@ -47,6 +48,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	deleteFunction: () => deleteFunction,
 	deleteFunctionSecret: () => deleteFunctionSecret,
 	deleteOrgSecret: () => deleteOrgSecret,
+	deleteRoute: () => deleteRoute,
 	discardEmailContent: () => discardEmailContent,
 	downloadAttachments: () => downloadAttachments,
 	downloadDomainZoneFile: () => downloadDomainZoneFile,
@@ -82,11 +84,13 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	listRegistries: () => listRegistries,
 	listRegistryAgents: () => listRegistryAgents,
 	listRegistryRequests: () => listRegistryRequests,
+	listRoutes: () => listRoutes,
 	listSentEmails: () => listSentEmails,
 	payChallenge: () => payChallenge,
 	pollCliLogin: () => pollCliLogin,
 	publishAgent: () => publishAgent,
 	registerPayoutAddress: () => registerPayoutAddress,
+	reorderRoutes: () => reorderRoutes,
 	replayDelivery: () => replayDelivery,
 	replayEmailWebhooks: () => replayEmailWebhooks,
 	replyToEmail: () => replyToEmail,
@@ -100,6 +104,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	setFunctionRoute: () => setFunctionRoute,
 	setFunctionSecret: () => setFunctionSecret,
 	setOrgSecret: () => setOrgSecret,
+	simulateRoute: () => simulateRoute,
 	startAgentClaim: () => startAgentClaim,
 	startAgentSignup: () => startAgentSignup,
 	startCliLogin: () => startCliLogin,
@@ -114,6 +119,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	updateFilter: () => updateFilter,
 	updateFunction: () => updateFunction,
 	updateRegistry: () => updateRegistry,
+	updateRoute: () => updateRoute,
 	updateSpendPolicy: () => updateSpendPolicy,
 	verifyAgentClaim: () => verifyAgentClaim,
 	verifyAgentSignup: () => verifyAgentSignup,
@@ -981,6 +987,106 @@ const updateFilter = (options) => (options.client ?? client).patch({
 	}
 });
 /**
+* List recipient routes
+*
+* Returns the org's recipient routing rules in evaluation order. Each rule
+* binds a recipient address pattern to one endpoint; inbound mail resolves
+* to a single destination at delivery time.
+*
+*/
+const listRoutes = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes",
+	...options
+});
+/**
+* Create a recipient route
+*
+* Binds a recipient pattern to a destination. Provide exactly one of
+* `endpoint_id` (an existing endpoint) or `function_id`. With `function_id`,
+* a dedicated route-target endpoint is minted for that function in the same
+* transaction, enabling per-address function routing (e.g.
+* `alice@acme.com -> functionA`).
+*
+*/
+const createRoute = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Reorder recipient routes
+*
+* Update the priority of one or more routes in a single call.
+*/
+const reorderRoutes = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/reorder",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Simulate routing for a recipient
+*
+* Resolves where an inbound email to `recipient` would be delivered, with a
+* trace of every rule evaluated and why. Read-only; creates nothing.
+*
+*/
+const simulateRoute = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/simulate",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a recipient route
+*/
+const deleteRoute = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/{id}",
+	...options
+});
+/**
+* Update a recipient route
+*/
+const updateRoute = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
 * List webhook deliveries
 *
 * Returns a paginated list of webhook delivery attempts. Each delivery
@@ -2043,6 +2149,10 @@ const openapiDocument = {
 			"name": "Filters",
 			"description": "Manage whitelist and blocklist filter rules"
 		},
+		{
+			"name": "Routes",
+			"description": "Recipient routing: route inbound mail to a single destination per recipient\naddress. Rules bind an address pattern (exact or wildcard) to an endpoint;\n`function_id` routes an address to a function, minting its route-target\nendpoint.\n"
+		},
 		{
 			"name": "Payments",
 			"description": "Collect and pay stablecoin (USDC) payments with x402. Settlement is\nnon-custodial: funds move directly from payer to payee on-chain via an\nEIP-3009 authorization the payer signs with their own key, and Primitive\nnever holds funds. The payee registers a payout address and creates a\nchallenge; the payer signs and settles it under a configurable spend\npolicy (kill-switch, per-payment and per-day caps, payee allowlist).\n"
@@ -3457,6 +3567,129 @@ const openapiDocument = {
 				}
 			}
 		},
+		"/routes": {
+			"get": {
+				"operationId": "listRoutes",
+				"summary": "List recipient routes",
+				"description": "Returns the org's recipient routing rules in evaluation order. Each rule\nbinds a recipient address pattern to one endpoint; inbound mail resolves\nto a single destination at delivery time.\n",
+				"tags": ["Routes"],
+				"responses": {
+					"200": {
+						"description": "List of routes",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "array",
+								"items": { "$ref": "#/components/schemas/RecipientRoute" }
+							} }
+						}] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" }
+				}
+			},
+			"post": {
+				"operationId": "createRoute",
+				"summary": "Create a recipient route",
+				"description": "Binds a recipient pattern to a destination. Provide exactly one of\n`endpoint_id` (an existing endpoint) or `function_id`. With `function_id`,\na dedicated route-target endpoint is minted for that function in the same\ntransaction, enabling per-address function routing (e.g.\n`alice@acme.com -> functionA`).\n",
+				"tags": ["Routes"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateRouteInput" } } }
+				},
+				"responses": {
+					"201": {
+						"description": "Route created",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/RecipientRoute" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"409": { "$ref": "#/components/responses/Conflict" }
+				}
+			}
+		},
+		"/routes/reorder": { "post": {
+			"operationId": "reorderRoutes",
+			"summary": "Reorder recipient routes",
+			"description": "Update the priority of one or more routes in a single call.",
+			"tags": ["Routes"],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReorderRoutesInput" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Updated route list",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": {
+							"type": "array",
+							"items": { "$ref": "#/components/schemas/RecipientRoute" }
+						} }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" }
+			}
+		} },
+		"/routes/simulate": { "post": {
+			"operationId": "simulateRoute",
+			"summary": "Simulate routing for a recipient",
+			"description": "Resolves where an inbound email to `recipient` would be delivered, with a\ntrace of every rule evaluated and why. Read-only; creates nothing.\n",
+			"tags": ["Routes"],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimulateRouteInput" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Routing decision",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/SimulateRouteResult" } }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" }
+			}
+		} },
+		"/routes/{id}": {
+			"parameters": [{ "$ref": "#/components/parameters/ResourceId" }],
+			"patch": {
+				"operationId": "updateRoute",
+				"summary": "Update a recipient route",
+				"tags": ["Routes"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateRouteInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Updated route",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/RecipientRoute" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"404": { "$ref": "#/components/responses/NotFound" },
+					"409": { "$ref": "#/components/responses/Conflict" }
+				}
+			},
+			"delete": {
+				"operationId": "deleteRoute",
+				"summary": "Delete a recipient route",
+				"tags": ["Routes"],
+				"responses": {
+					"200": { "$ref": "#/components/responses/Deleted" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"404": { "$ref": "#/components/responses/NotFound" }
+				}
+			}
+		},
 		"/webhooks/deliveries": { "get": {
 			"operationId": "listDeliveries",
 			"summary": "List webhook deliveries",
@@ -4629,7 +4862,8 @@ const openapiDocument = {
 				"name": "slug",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry slug."
 			}],
 			"get": {
 				"operationId": "listRegistryAgents",
@@ -4644,7 +4878,8 @@ const openapiDocument = {
 						"type": "integer",
 						"minimum": 1,
 						"maximum": 200
-					}
+					},
+					"description": "Maximum number of items to return (1-200)."
 				}, {
 					"name": "cursor",
 					"in": "query",
@@ -4690,12 +4925,14 @@ const openapiDocument = {
 				"name": "slug",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry slug."
 			}, {
 				"name": "handle",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry-scoped handle the agent is published under."
 			}],
 			"get": {
 				"operationId": "resolveRegistryHandle",
@@ -4726,7 +4963,8 @@ const openapiDocument = {
 				"name": "slug",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry slug."
 			}],
 			"get": {
 				"operationId": "listRegistryRequests",
@@ -4740,7 +4978,8 @@ const openapiDocument = {
 						"type": "integer",
 						"minimum": 1,
 						"maximum": 200
-					}
+					},
+					"description": "Maximum number of items to return (1-200)."
 				}],
 				"responses": {
 					"200": {
@@ -4760,7 +4999,8 @@ const openapiDocument = {
 				"name": "slug",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry slug."
 			}, { "$ref": "#/components/parameters/ResourceId" }],
 			"post": {
 				"operationId": "decideRegistryRequest",
@@ -8849,14 +9089,11 @@ const openapiDocument = {
 				"properties": { "enabled": { "type": "boolean" } },
 				"required": ["enabled"]
 			},
-			"DeliverySummary": {
+			"RecipientRoute": {
 				"type": "object",
+				"description": "A recipient routing rule binding an address pattern to one endpoint.",
 				"properties": {
 					"id": {
-						"type": "string",
-						"description": "Delivery ID (numeric string)"
-					},
-					"email_id": {
 						"type": "string",
 						"format": "uuid"
 					},
@@ -8864,72 +9101,334 @@ const openapiDocument = {
 						"type": "string",
 						"format": "uuid"
 					},
-					"endpoint_id": {
-						"type": "string",
-						"format": "uuid"
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Domain the route is scoped to; null = org-wide."
 					},
-					"endpoint_url": { "type": "string" },
-					"status": {
+					"match_type": {
 						"type": "string",
 						"enum": [
-							"pending",
-							"delivered",
-							"header_confirmed",
-							"failed"
+							"exact",
+							"wildcard",
+							"regex"
 						]
 					},
-					"attempt_count": { "type": "integer" },
-					"duration_ms": { "type": ["integer", "null"] },
-					"last_error": { "type": ["string", "null"] },
-					"created_at": {
+					"pattern": {
 						"type": "string",
-						"format": "date-time"
+						"description": "The recipient address pattern (an exact address or a wildcard)."
 					},
-					"updated_at": {
+					"pattern_norm": {
+						"type": ["string", "null"],
+						"description": "Normalized pattern used for matching."
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The endpoint inbound mail matching this rule is delivered to."
+					},
+					"priority": {
+						"type": "integer",
+						"description": "Evaluation order within a scope; lower is checked first."
+					},
+					"enabled": { "type": "boolean" },
+					"match_count": {
 						"type": "string",
+						"description": "How many emails have matched this rule (a bigint, returned as a string)."
+					},
+					"last_matched_at": {
+						"type": ["string", "null"],
 						"format": "date-time"
 					},
-					"email": {
-						"type": ["object", "null"],
-						"properties": {
-							"sender": { "type": "string" },
-							"recipient": { "type": "string" },
-							"subject": { "type": ["string", "null"] }
-						},
-						"required": ["sender", "recipient"]
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
 					}
 				},
-				"required": [
-					"id",
-					"email_id",
-					"org_id",
-					"endpoint_id",
-					"endpoint_url",
-					"status",
-					"attempt_count",
-					"created_at",
-					"updated_at"
-				]
+				"required": ["id"]
 			},
-			"ReplayResult": {
+			"CreateRouteInput": {
 				"type": "object",
+				"additionalProperties": false,
+				"description": "Provide exactly one of `endpoint_id` or `function_id`. With `function_id`,\na route-target endpoint is minted for that function and the route is bound\nto it in one transaction.\n",
 				"properties": {
-					"delivered": {
-						"type": "integer",
-						"description": "Number of successful deliveries"
+					"match_type": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
 					},
-					"failed": {
+					"pattern": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 512
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "An existing endpoint to route to. Mutually exclusive with function_id."
+					},
+					"function_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "Route to this function, minting its route-target endpoint if needed. Mutually exclusive with endpoint_id."
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Scope the route to a domain; defaults to the pattern's domain."
+					},
+					"priority": {
 						"type": "integer",
-						"description": "Number of failed deliveries"
-					}
+						"minimum": 0,
+						"maximum": 1e6
+					},
+					"enabled": { "type": "boolean" }
 				},
-				"required": ["delivered", "failed"]
+				"required": ["match_type", "pattern"]
 			},
-			"DiscardContentResult": {
+			"UpdateRouteInput": {
 				"type": "object",
+				"additionalProperties": false,
 				"properties": {
-					"discarded": {
-						"type": "boolean",
+					"match_type": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
+					},
+					"pattern": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 512
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid"
+					},
+					"priority": {
+						"type": "integer",
+						"minimum": 0,
+						"maximum": 1e6
+					},
+					"enabled": { "type": "boolean" }
+				}
+			},
+			"ReorderRoutesInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": { "updates": {
+					"type": "array",
+					"minItems": 1,
+					"maxItems": 1e3,
+					"items": {
+						"type": "object",
+						"additionalProperties": false,
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"priority": {
+								"type": "integer",
+								"minimum": 0,
+								"maximum": 1e6
+							}
+						},
+						"required": ["id", "priority"]
+					}
+				} },
+				"required": ["updates"]
+			},
+			"SimulateRouteInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"recipient": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 320
+					},
+					"event_type": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 100,
+						"description": "Event type to model; defaults to email.received."
+					}
+				},
+				"required": ["recipient"]
+			},
+			"RouteEvaluatedEntry": {
+				"type": "object",
+				"properties": {
+					"route_id": { "type": "string" },
+					"tier": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
+					},
+					"pattern": { "type": "string" },
+					"result": {
+						"type": "string",
+						"enum": [
+							"hit",
+							"miss",
+							"skipped",
+							"error"
+						]
+					},
+					"reason": { "type": "string" }
+				},
+				"required": [
+					"route_id",
+					"tier",
+					"pattern",
+					"result"
+				]
+			},
+			"SimulateRouteResult": {
+				"type": "object",
+				"description": "Where an inbound email to the recipient would be delivered, and why.",
+				"properties": {
+					"outcome": {
+						"type": "string",
+						"enum": [
+							"matched",
+							"defaulted",
+							"none"
+						]
+					},
+					"recipient": { "type": "string" },
+					"endpoint_id": { "type": ["string", "null"] },
+					"matched_route_id": { "type": ["string", "null"] },
+					"matched_tier": {
+						"type": ["string", "null"],
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex",
+							null
+						]
+					},
+					"matched_pattern": { "type": ["string", "null"] },
+					"default_scope": {
+						"type": ["string", "null"],
+						"enum": [
+							"domain",
+							"org",
+							null
+						]
+					},
+					"evaluated": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/RouteEvaluatedEntry" }
+					},
+					"truncated": { "type": "boolean" }
+				},
+				"required": [
+					"outcome",
+					"recipient",
+					"endpoint_id",
+					"matched_route_id",
+					"matched_tier",
+					"matched_pattern",
+					"default_scope",
+					"evaluated",
+					"truncated"
+				]
+			},
+			"DeliverySummary": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"description": "Delivery ID (numeric string)"
+					},
+					"email_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"org_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"endpoint_url": { "type": "string" },
+					"status": {
+						"type": "string",
+						"enum": [
+							"pending",
+							"delivered",
+							"header_confirmed",
+							"failed"
+						]
+					},
+					"attempt_count": { "type": "integer" },
+					"duration_ms": { "type": ["integer", "null"] },
+					"last_error": { "type": ["string", "null"] },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"email": {
+						"type": ["object", "null"],
+						"properties": {
+							"sender": { "type": "string" },
+							"recipient": { "type": "string" },
+							"subject": { "type": ["string", "null"] }
+						},
+						"required": ["sender", "recipient"]
+					}
+				},
+				"required": [
+					"id",
+					"email_id",
+					"org_id",
+					"endpoint_id",
+					"endpoint_url",
+					"status",
+					"attempt_count",
+					"created_at",
+					"updated_at"
+				]
+			},
+			"ReplayResult": {
+				"type": "object",
+				"properties": {
+					"delivered": {
+						"type": "integer",
+						"description": "Number of successful deliveries"
+					},
+					"failed": {
+						"type": "integer",
+						"description": "Number of failed deliveries"
+					}
+				},
+				"required": ["delivered", "failed"]
+			},
+			"DiscardContentResult": {
+				"type": "object",
+				"properties": {
+					"discarded": {
+						"type": "boolean",
 						"description": "Always `true` on a 2xx response. The content is either now\ndiscarded as a result of this call, or was already discarded\nbefore this call ran.\n"
 					},
 					"already_discarded": {
@@ -16292,7 +16791,7 @@ const operationManifest = [
 		"operationId": "decideRegistryRequest",
 		"path": "/registries/{slug}/requests/{id}",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
@@ -16554,14 +17053,14 @@ const operationManifest = [
 		"operationId": "listRegistryAgents",
 		"path": "/registries/{slug}/agents",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
 			"type": "string"
 		}],
 		"queryParams": [{
-			"description": null,
+			"description": "Maximum number of items to return (1-200).",
 			"enum": null,
 			"maximum": 200,
 			"minimum": 1,
@@ -16620,14 +17119,14 @@ const operationManifest = [
 		"operationId": "listRegistryRequests",
 		"path": "/registries/{slug}/requests",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
 			"type": "string"
 		}],
 		"queryParams": [{
-			"description": null,
+			"description": "Maximum number of items to return (1-200).",
 			"enum": null,
 			"maximum": 200,
 			"minimum": 1,
@@ -16678,7 +17177,7 @@ const operationManifest = [
 		"operationId": "publishAgent",
 		"path": "/registries/{slug}/agents",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
@@ -16731,13 +17230,13 @@ const operationManifest = [
 		"operationId": "resolveRegistryHandle",
 		"path": "/registries/{slug}/agents/{handle}",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
 			"type": "string"
 		}, {
-			"description": null,
+			"description": "The registry-scoped handle the agent is published under.",
 			"enum": null,
 			"name": "handle",
 			"required": true,
@@ -16757,109 +17256,658 @@ const operationManifest = [
 					"type": "array",
 					"items": { "type": "string" }
 				},
-				"handle": {
+				"handle": {
+					"type": ["string", "null"],
+					"description": "The registry-scoped name. Null on the global by-address read."
+				}
+			},
+			"required": [
+				"address",
+				"display_name",
+				"title",
+				"description",
+				"tags",
+				"handle"
+			]
+		},
+		"sdkName": "resolveRegistryHandle",
+		"summary": "Resolve a registry handle to its agent",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "unpublish-agent",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "DELETE",
+		"operationId": "unpublishAgent",
+		"path": "/registries/{slug}/agents/{handle}",
+		"pathParams": [{
+			"description": "The registry slug.",
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}, {
+			"description": "The registry-scoped handle the agent is published under.",
+			"enum": null,
+			"name": "handle",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": null,
+		"sdkName": "unpublishAgent",
+		"summary": "Unpublish an agent from a registry",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-registry",
+		"description": null,
+		"hasJsonBody": true,
+		"method": "PATCH",
+		"operationId": "updateRegistry",
+		"path": "/registries/{slug}",
+		"pathParams": [{
+			"description": "The registry slug",
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"minProperties": 1,
+			"properties": {
+				"name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 120
+				},
+				"description": {
+					"type": ["string", "null"],
+					"maxLength": 2e3
+				},
+				"is_public": { "type": "boolean" },
+				"publish_policy": {
+					"type": "string",
+					"enum": [
+						"owner_only",
+						"request",
+						"open"
+					],
+					"description": "Who may publish into a registry. owner_only: only the registry owner.\nrequest: anyone may request and the owner approves. open: anyone may\npublish and it lists immediately (no approval step).\n"
+				}
+			}
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": { "id": {
+				"type": "string",
+				"format": "uuid"
+			} },
+			"required": ["id"]
+		},
+		"sdkName": "updateRegistry",
+		"summary": "Update a registry you own",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "create-route",
+		"description": "Binds a recipient pattern to a destination. Provide exactly one of\n`endpoint_id` (an existing endpoint) or `function_id`. With `function_id`,\na dedicated route-target endpoint is minted for that function in the same\ntransaction, enabling per-address function routing (e.g.\n`alice@acme.com -> functionA`).\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createRoute",
+		"path": "/routes",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Provide exactly one of `endpoint_id` or `function_id`. With `function_id`,\na route-target endpoint is minted for that function and the route is bound\nto it in one transaction.\n",
+			"properties": {
+				"match_type": {
+					"type": "string",
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex"
+					]
+				},
+				"pattern": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 512
+				},
+				"endpoint_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "An existing endpoint to route to. Mutually exclusive with function_id."
+				},
+				"function_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "Route to this function, minting its route-target endpoint if needed. Mutually exclusive with endpoint_id."
+				},
+				"domain_id": {
+					"type": ["string", "null"],
+					"format": "uuid",
+					"description": "Scope the route to a domain; defaults to the pattern's domain."
+				},
+				"priority": {
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 1e6
+				},
+				"enabled": { "type": "boolean" }
+			},
+			"required": ["match_type", "pattern"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "A recipient routing rule binding an address pattern to one endpoint.",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"org_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"domain_id": {
+					"type": ["string", "null"],
+					"format": "uuid",
+					"description": "Domain the route is scoped to; null = org-wide."
+				},
+				"match_type": {
+					"type": "string",
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex"
+					]
+				},
+				"pattern": {
+					"type": "string",
+					"description": "The recipient address pattern (an exact address or a wildcard)."
+				},
+				"pattern_norm": {
+					"type": ["string", "null"],
+					"description": "Normalized pattern used for matching."
+				},
+				"endpoint_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "The endpoint inbound mail matching this rule is delivered to."
+				},
+				"priority": {
+					"type": "integer",
+					"description": "Evaluation order within a scope; lower is checked first."
+				},
+				"enabled": { "type": "boolean" },
+				"match_count": {
+					"type": "string",
+					"description": "How many emails have matched this rule (a bigint, returned as a string)."
+				},
+				"last_matched_at": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
+			"required": ["id"]
+		},
+		"sdkName": "createRoute",
+		"summary": "Create a recipient route",
+		"tag": "Routes",
+		"tagCommand": "routes"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "delete-route",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "DELETE",
+		"operationId": "deleteRoute",
+		"path": "/routes/{id}",
+		"pathParams": [{
+			"description": "Resource UUID",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": null,
+		"sdkName": "deleteRoute",
+		"summary": "Delete a recipient route",
+		"tag": "Routes",
+		"tagCommand": "routes"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-routes",
+		"description": "Returns the org's recipient routing rules in evaluation order. Each rule\nbinds a recipient address pattern to one endpoint; inbound mail resolves\nto a single destination at delivery time.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listRoutes",
+		"path": "/routes",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"description": "A recipient routing rule binding an address pattern to one endpoint.",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"org_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Domain the route is scoped to; null = org-wide."
+					},
+					"match_type": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
+					},
+					"pattern": {
+						"type": "string",
+						"description": "The recipient address pattern (an exact address or a wildcard)."
+					},
+					"pattern_norm": {
+						"type": ["string", "null"],
+						"description": "Normalized pattern used for matching."
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The endpoint inbound mail matching this rule is delivered to."
+					},
+					"priority": {
+						"type": "integer",
+						"description": "Evaluation order within a scope; lower is checked first."
+					},
+					"enabled": { "type": "boolean" },
+					"match_count": {
+						"type": "string",
+						"description": "How many emails have matched this rule (a bigint, returned as a string)."
+					},
+					"last_matched_at": {
+						"type": ["string", "null"],
+						"format": "date-time"
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": ["id"]
+			}
+		},
+		"sdkName": "listRoutes",
+		"summary": "List recipient routes",
+		"tag": "Routes",
+		"tagCommand": "routes"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "reorder-routes",
+		"description": "Update the priority of one or more routes in a single call.",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "reorderRoutes",
+		"path": "/routes/reorder",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": { "updates": {
+				"type": "array",
+				"minItems": 1,
+				"maxItems": 1e3,
+				"items": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": {
+						"id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"priority": {
+							"type": "integer",
+							"minimum": 0,
+							"maximum": 1e6
+						}
+					},
+					"required": ["id", "priority"]
+				}
+			} },
+			"required": ["updates"]
+		},
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"description": "A recipient routing rule binding an address pattern to one endpoint.",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"org_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Domain the route is scoped to; null = org-wide."
+					},
+					"match_type": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
+					},
+					"pattern": {
+						"type": "string",
+						"description": "The recipient address pattern (an exact address or a wildcard)."
+					},
+					"pattern_norm": {
+						"type": ["string", "null"],
+						"description": "Normalized pattern used for matching."
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The endpoint inbound mail matching this rule is delivered to."
+					},
+					"priority": {
+						"type": "integer",
+						"description": "Evaluation order within a scope; lower is checked first."
+					},
+					"enabled": { "type": "boolean" },
+					"match_count": {
+						"type": "string",
+						"description": "How many emails have matched this rule (a bigint, returned as a string)."
+					},
+					"last_matched_at": {
+						"type": ["string", "null"],
+						"format": "date-time"
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": ["id"]
+			}
+		},
+		"sdkName": "reorderRoutes",
+		"summary": "Reorder recipient routes",
+		"tag": "Routes",
+		"tagCommand": "routes"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "simulate-route",
+		"description": "Resolves where an inbound email to `recipient` would be delivered, with a\ntrace of every rule evaluated and why. Read-only; creates nothing.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "simulateRoute",
+		"path": "/routes/simulate",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"recipient": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 320
+				},
+				"event_type": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 100,
+					"description": "Event type to model; defaults to email.received."
+				}
+			},
+			"required": ["recipient"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "Where an inbound email to the recipient would be delivered, and why.",
+			"properties": {
+				"outcome": {
+					"type": "string",
+					"enum": [
+						"matched",
+						"defaulted",
+						"none"
+					]
+				},
+				"recipient": { "type": "string" },
+				"endpoint_id": { "type": ["string", "null"] },
+				"matched_route_id": { "type": ["string", "null"] },
+				"matched_tier": {
 					"type": ["string", "null"],
-					"description": "The registry-scoped name. Null on the global by-address read."
-				}
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex",
+						null
+					]
+				},
+				"matched_pattern": { "type": ["string", "null"] },
+				"default_scope": {
+					"type": ["string", "null"],
+					"enum": [
+						"domain",
+						"org",
+						null
+					]
+				},
+				"evaluated": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"route_id": { "type": "string" },
+							"tier": {
+								"type": "string",
+								"enum": [
+									"exact",
+									"wildcard",
+									"regex"
+								]
+							},
+							"pattern": { "type": "string" },
+							"result": {
+								"type": "string",
+								"enum": [
+									"hit",
+									"miss",
+									"skipped",
+									"error"
+								]
+							},
+							"reason": { "type": "string" }
+						},
+						"required": [
+							"route_id",
+							"tier",
+							"pattern",
+							"result"
+						]
+					}
+				},
+				"truncated": { "type": "boolean" }
 			},
 			"required": [
-				"address",
-				"display_name",
-				"title",
-				"description",
-				"tags",
-				"handle"
+				"outcome",
+				"recipient",
+				"endpoint_id",
+				"matched_route_id",
+				"matched_tier",
+				"matched_pattern",
+				"default_scope",
+				"evaluated",
+				"truncated"
 			]
 		},
-		"sdkName": "resolveRegistryHandle",
-		"summary": "Resolve a registry handle to its agent",
-		"tag": "Registries",
-		"tagCommand": "registries"
-	},
-	{
-		"binaryResponse": false,
-		"bodyRequired": false,
-		"command": "unpublish-agent",
-		"description": null,
-		"hasJsonBody": false,
-		"method": "DELETE",
-		"operationId": "unpublishAgent",
-		"path": "/registries/{slug}/agents/{handle}",
-		"pathParams": [{
-			"description": null,
-			"enum": null,
-			"name": "slug",
-			"required": true,
-			"type": "string"
-		}, {
-			"description": null,
-			"enum": null,
-			"name": "handle",
-			"required": true,
-			"type": "string"
-		}],
-		"queryParams": [],
-		"requestSchema": null,
-		"responseSchema": null,
-		"sdkName": "unpublishAgent",
-		"summary": "Unpublish an agent from a registry",
-		"tag": "Registries",
-		"tagCommand": "registries"
+		"sdkName": "simulateRoute",
+		"summary": "Simulate routing for a recipient",
+		"tag": "Routes",
+		"tagCommand": "routes"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "update-registry",
+		"command": "update-route",
 		"description": null,
 		"hasJsonBody": true,
 		"method": "PATCH",
-		"operationId": "updateRegistry",
-		"path": "/registries/{slug}",
+		"operationId": "updateRoute",
+		"path": "/routes/{id}",
 		"pathParams": [{
-			"description": "The registry slug",
+			"description": "Resource UUID",
 			"enum": null,
-			"name": "slug",
+			"name": "id",
 			"required": true,
 			"type": "string"
 		}],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
-			"minProperties": 1,
+			"additionalProperties": false,
 			"properties": {
-				"name": {
+				"match_type": {
+					"type": "string",
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex"
+					]
+				},
+				"pattern": {
 					"type": "string",
 					"minLength": 1,
-					"maxLength": 120
+					"maxLength": 512
 				},
-				"description": {
+				"endpoint_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"domain_id": {
 					"type": ["string", "null"],
-					"maxLength": 2e3
+					"format": "uuid"
 				},
-				"is_public": { "type": "boolean" },
-				"publish_policy": {
-					"type": "string",
-					"enum": [
-						"owner_only",
-						"request",
-						"open"
-					],
-					"description": "Who may publish into a registry. owner_only: only the registry owner.\nrequest: anyone may request and the owner approves. open: anyone may\npublish and it lists immediately (no approval step).\n"
-				}
+				"priority": {
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 1e6
+				},
+				"enabled": { "type": "boolean" }
 			}
 		},
 		"responseSchema": {
 			"type": "object",
-			"properties": { "id": {
-				"type": "string",
-				"format": "uuid"
-			} },
+			"description": "A recipient routing rule binding an address pattern to one endpoint.",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"org_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"domain_id": {
+					"type": ["string", "null"],
+					"format": "uuid",
+					"description": "Domain the route is scoped to; null = org-wide."
+				},
+				"match_type": {
+					"type": "string",
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex"
+					]
+				},
+				"pattern": {
+					"type": "string",
+					"description": "The recipient address pattern (an exact address or a wildcard)."
+				},
+				"pattern_norm": {
+					"type": ["string", "null"],
+					"description": "Normalized pattern used for matching."
+				},
+				"endpoint_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "The endpoint inbound mail matching this rule is delivered to."
+				},
+				"priority": {
+					"type": "integer",
+					"description": "Evaluation order within a scope; lower is checked first."
+				},
+				"enabled": { "type": "boolean" },
+				"match_count": {
+					"type": "string",
+					"description": "How many emails have matched this rule (a bigint, returned as a string)."
+				},
+				"last_matched_at": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
 			"required": ["id"]
 		},
-		"sdkName": "updateRegistry",
-		"summary": "Update a registry you own",
-		"tag": "Registries",
-		"tagCommand": "registries"
+		"sdkName": "updateRoute",
+		"summary": "Update a recipient route",
+		"tag": "Routes",
+		"tagCommand": "routes"
 	},
 	{
 		"binaryResponse": false,
@@ -22648,8 +23696,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.10.0";
-const CLI_VERSION_RANGE = "^1.10.0";
+const SDK_VERSION_RANGE = "^1.12.0";
+const CLI_VERSION_RANGE = "^1.12.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -26194,24 +27242,47 @@ function toPaymentPayload(network, auth, signature) {
 	};
 }
 /**
-* Compute the EIP-3009 validity window for a payment. `validBefore` is the
-* value that governs on-chain validity, so it MUST cover the challenge's
-* `expires_at` plus a settlement margin; `validAfter` is set generously in the
-* past for clock skew. The total window is hard-capped at `maxWindowSec` so
-* neither a far-future `challengeExpiresAtSec` nor a widened margin can produce
-* a window the platform verifier would later reject.
+* Compute the EIP-3009 validity window for a payment, landing inside the band
+* the platform accepts. `validBefore` governs on-chain validity, so it MUST
+* stay far enough in the future to settle (>= `minHeadroomSec`) yet not so far
+* that the total window exceeds the `maxWindowSec` cap; `validAfter` is set
+* generously in the past for clock skew.
+*
+* Both ends of that band are payer landmines: a too-tight `validBefore` (low
+* headroom, e.g. a near-expired challenge) is rejected for being about to
+* expire, and a too-wide window (far-future expiry) is rejected as
+* "authorization window too wide". By default this clamps the computed window
+* into the band so a caller who does not override always gets a signable
+* window.
+*
+* If the caller passes an explicit `validBeforeSec` or `validAfterSec`, that is
+* an intent to pin the bound: when it falls outside the band this throws a
+* specific error naming which bound was violated (rather than silently signing
+* a doomed authorization), unless `clamp` is left enabled, in which case the
+* pinned value is clamped into the band like the computed one.
 */
 function computePaymentValidityWindow(params) {
 	const margin = params.settlementMarginSec ?? 300;
 	const skew = params.clockSkewSec ?? 300;
-	const validBefore = BigInt(params.challengeExpiresAtSec + margin);
-	const validAfter = BigInt(params.nowSec - skew);
-	if (validBefore <= validAfter) throw new Error("invalid validity window: validBefore must be after validAfter (challenge already expired?)");
-	const maxWindow = BigInt(params.maxWindowSec ?? 86400);
-	if (validBefore - validAfter > maxWindow) throw new Error(`invalid validity window: total window exceeds the ${maxWindow}s cap (challenge expiry too far out?)`);
+	const maxWindow = params.maxWindowSec ?? 86400;
+	const minHeadroom = params.minHeadroomSec ?? 60;
+	const clamp = params.clamp ?? true;
+	if (maxWindow < minHeadroom) throw new Error(`invalid validity window config: maxWindowSec (${maxWindow}) is smaller than minHeadroomSec (${minHeadroom})`);
+	const validAfter = params.validAfterSec !== void 0 ? params.validAfterSec : params.nowSec - skew;
+	const rawValidBefore = params.validBeforeSec !== void 0 ? params.validBeforeSec : params.challengeExpiresAtSec + margin;
+	const floor = params.nowSec + minHeadroom;
+	const ceiling = validAfter + maxWindow;
+	const tooTight = rawValidBefore < floor;
+	const tooWide = rawValidBefore > ceiling;
+	if (!clamp && params.validBeforeSec !== void 0) {
+		if (tooTight) throw new Error(`invalid validity window: validBefore (${rawValidBefore}) is below the minimum settlement headroom (must be >= now + ${minHeadroom}s = ${floor}); the authorization would be rejected as about to expire`);
+		if (tooWide) throw new Error(`invalid validity window: validBefore (${rawValidBefore}) exceeds the ${maxWindow}s window cap (must be <= validAfter + ${maxWindow}s = ${ceiling}); the authorization window is too wide`);
+	}
+	const bandedValidBefore = tooTight ? floor : tooWide ? ceiling : rawValidBefore;
+	if (bandedValidBefore <= validAfter) throw new Error("invalid validity window: validBefore must be after validAfter (challenge already expired or validAfter pinned too late?)");
 	return {
-		validAfter,
-		validBefore
+		validAfter: BigInt(validAfter),
+		validBefore: BigInt(bandedValidBefore)
 	};
 }
 /**
@@ -26308,6 +27379,7 @@ var X402Error = class extends Error {
 		this.retryAfter = options?.retryAfter ?? null;
 	}
 };
+new RegExp(`^${/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.source.slice(1, -1)}@[^\\s@]+$`, "i");
 /**
 * Assert a challenge is fully hydrated before signing, so a missing field fails
 * with a named X402Error instead of an opaque viem/BigInt error mid-sign.
@@ -26689,6 +27761,22 @@ const X402_ERROR_HINTS = {
 	payment_verification_failed: "The signed payment did not match the challenge. Make sure you are paying with the wallet and network the challenge was issued for.",
 	ownership_proof_failed: "The signature did not prove control of the address. Make sure the wallet key matches the address you are registering."
 };
+/**
+* Sign an email-native x402 challenge into a payment-step `interaction.json`
+* envelope, locally and with no network call. This is the exact signing path
+* shared by `payments pay-email-step` (sign only) and `payments pay-email`
+* (sign and send), so both produce byte-identical `interaction.json` bytes for
+* the same challenge + key. The EIP-3009 / nonce derivation lives in the SDK's
+* `payEmailChallenge`; this helper just wires the CLI's key handling to it.
+*/
+async function signEmailChallenge(params) {
+	const client = createX402Client({
+		apiKey: params.apiKey || void 0,
+		baseUrl: x402BaseUrl(params.resolvedApiBaseUrl)
+	});
+	const signer = signerFromPrivateKey(params.privateKey);
+	return client.payEmailChallenge(params.challenge, { signer });
+}
 /** Turn a hex private key into a viem account (a valid X402Signer). */
 function signerFromPrivateKey(rawKey) {
 	const trimmed = rawKey.trim();
@@ -27009,17 +28097,16 @@ var PaymentsPayEmailStepCommand = class PaymentsPayEmailStepCommand extends Comm
 			credentials: null
 		};
 		await runWithTiming(flags.time, async () => {
-			const client = createX402Client({
-				apiKey: flags["api-key"] || void 0,
-				baseUrl: x402BaseUrl(requestConfig.resolvedApiBaseUrl)
-			});
 			try {
-				const challenge = readEmailChallenge({
-					inline: flags.challenge,
-					file: flags["challenge-file"]
+				const built = await signEmailChallenge({
+					challenge: readEmailChallenge({
+						inline: flags.challenge,
+						file: flags["challenge-file"]
+					}),
+					privateKey: flags["private-key"] ?? "",
+					resolvedApiBaseUrl: requestConfig.resolvedApiBaseUrl,
+					apiKey: flags["api-key"]
 				});
-				const signer = signerFromPrivateKey(flags["private-key"] ?? "");
-				const built = await client.payEmailChallenge(challenge, { signer });
 				if (flags.json) this.log(JSON.stringify(built.envelope, null, 2));
 				else this.log(built.json);
 			} catch (error) {
@@ -27034,6 +28121,136 @@ var PaymentsPayEmailStepCommand = class PaymentsPayEmailStepCommand extends Comm
 	}
 };
 //#endregion
+//#region src/oclif/commands/payments-pay-email.ts
+/** The exact part name + content type the inbound matcher requires. */
+const INTERACTION_PART_FILENAME = "interaction.json";
+const INTERACTION_PART_CONTENT_TYPE = "application/json";
+/** Build the `interaction.json` attachment from a signed payment step. */
+function interactionAttachment(built) {
+	return {
+		filename: INTERACTION_PART_FILENAME,
+		content_type: INTERACTION_PART_CONTENT_TYPE,
+		content_base64: Buffer.from(built.json, "utf8").toString("base64")
+	};
+}
+var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
+	static description = `Pay an email-native x402 challenge in one step: sign it and send the signed interaction.json as an in-thread reply.
+
+  Reads the email challenge the payee issued (the JSON from
+  \`payments create-email-challenge\`), derives and signs the interaction-bound
+  EIP-3009 authorization locally with your wallet key (read from
+  ${PRIVATE_KEY_ENV} by default), and replies in-thread to the challenge email
+  with the signed \`interaction.json\` attached as an \`application/json\` part.
+  The key never leaves your machine.
+
+  This is the recommended payer path. It replaces the two-step
+  \`pay-email-step\` + \`reply --attachment interaction.json\` dance: no manual
+  address or threading wrangling. Use \`pay-email-step\` only when you need the
+  signed bytes as a portable artifact without sending.
+
+  --in-reply-to is the id of the inbound challenge email you received; the reply
+  endpoint derives the recipient (the payee) and threading headers from it, and
+  defaults the From to the inbound's recipient (you, the payer). Pass --from
+  only to override that default.
+
+  Provide the challenge inline with --challenge, from a file with
+  --challenge-file, or piped on stdin.`;
+	static summary = "Sign an email x402 challenge and send it as an in-thread reply (one step)";
+	static examples = [
+		"<%= config.bin %> payments pay-email --challenge-file challenge.json --in-reply-to <inbound-email-id>",
+		"cat challenge.json | <%= config.bin %> payments pay-email --in-reply-to <inbound-email-id> --wait",
+		"<%= config.bin %> payments pay-email --challenge-file challenge.json --in-reply-to <inbound-email-id> --from 'Payer <payer@your-domain.example>'"
+	];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		"private-key": Flags.string({
+			description: PRIVATE_KEY_FLAG_DESCRIPTION,
+			env: PRIVATE_KEY_ENV
+		}),
+		challenge: Flags.string({
+			description: "The email challenge object as a JSON string.",
+			exclusive: ["challenge-file"]
+		}),
+		"challenge-file": Flags.string({
+			description: "Path to a file containing the email challenge JSON.",
+			exclusive: ["challenge"]
+		}),
+		"in-reply-to": Flags.string({
+			description: "Id of the inbound challenge email you received. The reply is threaded to it and addressed to the payee derived from it.",
+			required: true
+		}),
+		from: Flags.string({ description: "Optional From header override. Defaults to the inbound's recipient (the payer the challenge was addressed to)." }),
+		wait: Flags.boolean({ description: "Block until the receiving MTA returns an outcome. Without --wait, the call returns once Primitive has accepted the reply for delivery." }),
+		json: Flags.boolean({ description: "Print a JSON object with the signed interaction step and the send result." }),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(PaymentsPayEmailCommand);
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		const authFailureContext = {
+			auth,
+			baseUrlOverridden,
+			configDir: this.config.configDir
+		};
+		await runWithTiming(flags.time, async () => {
+			let built;
+			try {
+				built = await signEmailChallenge({
+					challenge: readEmailChallenge({
+						inline: flags.challenge,
+						file: flags["challenge-file"]
+					}),
+					privateKey: flags["private-key"] ?? "",
+					resolvedApiBaseUrl: auth.apiBaseUrl,
+					apiKey: flags["api-key"]
+				});
+			} catch (error) {
+				reportX402Error(error, authFailureContext);
+				process.exitCode = 1;
+				return;
+			}
+			const result = await replyToEmail({
+				body: {
+					attachments: [interactionAttachment(built)],
+					...flags.from !== void 0 ? { from: flags.from } : {},
+					...flags.wait !== void 0 ? { wait: flags.wait } : {}
+				},
+				client: apiClient.client,
+				path: { id: flags["in-reply-to"] },
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const errorPayload = extractErrorPayload(result.error);
+				writeErrorWithHints(errorPayload);
+				surfaceUnauthorizedHint({
+					...authFailureContext,
+					payload: errorPayload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			const sent = result.data?.data ?? null;
+			if (flags.json) this.log(JSON.stringify({
+				interaction: built.envelope,
+				sent
+			}, null, 2));
+			else this.log(JSON.stringify(sent, null, 2));
+		});
+	}
+};
+//#endregion
 //#region src/oclif/commands/payments-register-payout-address.ts
 var PaymentsRegisterPayoutAddressCommand = class PaymentsRegisterPayoutAddressCommand extends Command {
 	static description = `Register the default payout address your org receives x402 payments at.
@@ -28529,6 +29746,18 @@ const CANONICAL_OPERATION_ALIASES = {
 	"functions:get": "functions:get-function",
 	"functions:list": "functions:list-functions",
 	"functions:list-secrets": "functions:list-function-secrets",
+	"registries:agent": "registries:get-agent",
+	"registries:agents": "registries:list-registry-agents",
+	"registries:create": "registries:create-registry",
+	"registries:decide": "registries:decide-registry-request",
+	"registries:define": "registries:define-agent",
+	"registries:get": "registries:get-registry",
+	"registries:list": "registries:list-registries",
+	"registries:publish": "registries:publish-agent",
+	"registries:requests": "registries:list-registry-requests",
+	"registries:resolve": "registries:resolve-registry-handle",
+	"registries:unpublish": "registries:unpublish-agent",
+	"registries:update": "registries:update-registry",
 	"sending:get": "sending:get-sent-email",
 	"sending:list": "sending:list-sent-emails",
 	"sending:permissions": "sending:get-send-permissions",
@@ -28634,6 +29863,7 @@ const COMMANDS = {
 	"payments:charge": PaymentsChargeCommand,
 	"payments:pay-challenge": PaymentsPayCommand,
 	"payments:pay": PaymentsPayCommand,
+	"payments:pay-email": PaymentsPayEmailCommand,
 	"payments:pay-email-step": PaymentsPayEmailStepCommand
 };
 //#endregion