primcli 1.11.0 → 1.13.0

package/dist/oclif/index.js

@@ -38,6 +38,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	createFunctionSecret: () => createFunctionSecret,
 	createOrgSecret: () => createOrgSecret,
 	createRegistry: () => createRegistry,
+	createRoute: () => createRoute,
 	decideRegistryRequest: () => decideRegistryRequest,
 	defineAgent: () => defineAgent,
 	deleteDomain: () => deleteDomain,
@@ -47,6 +48,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	deleteFunction: () => deleteFunction,
 	deleteFunctionSecret: () => deleteFunctionSecret,
 	deleteOrgSecret: () => deleteOrgSecret,
+	deleteRoute: () => deleteRoute,
 	discardEmailContent: () => discardEmailContent,
 	downloadAttachments: () => downloadAttachments,
 	downloadDomainZoneFile: () => downloadDomainZoneFile,
@@ -82,11 +84,13 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	listRegistries: () => listRegistries,
 	listRegistryAgents: () => listRegistryAgents,
 	listRegistryRequests: () => listRegistryRequests,
+	listRoutes: () => listRoutes,
 	listSentEmails: () => listSentEmails,
 	payChallenge: () => payChallenge,
 	pollCliLogin: () => pollCliLogin,
 	publishAgent: () => publishAgent,
 	registerPayoutAddress: () => registerPayoutAddress,
+	reorderRoutes: () => reorderRoutes,
 	replayDelivery: () => replayDelivery,
 	replayEmailWebhooks: () => replayEmailWebhooks,
 	replyToEmail: () => replyToEmail,
@@ -100,6 +104,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	setFunctionRoute: () => setFunctionRoute,
 	setFunctionSecret: () => setFunctionSecret,
 	setOrgSecret: () => setOrgSecret,
+	simulateRoute: () => simulateRoute,
 	startAgentClaim: () => startAgentClaim,
 	startAgentSignup: () => startAgentSignup,
 	startCliLogin: () => startCliLogin,
@@ -114,6 +119,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	updateFilter: () => updateFilter,
 	updateFunction: () => updateFunction,
 	updateRegistry: () => updateRegistry,
+	updateRoute: () => updateRoute,
 	updateSpendPolicy: () => updateSpendPolicy,
 	verifyAgentClaim: () => verifyAgentClaim,
 	verifyAgentSignup: () => verifyAgentSignup,
@@ -981,6 +987,106 @@ const updateFilter = (options) => (options.client ?? client).patch({
 	}
 });
 /**
+* List recipient routes
+*
+* Returns the org's recipient routing rules in evaluation order. Each rule
+* binds a recipient address pattern to one endpoint; inbound mail resolves
+* to a single destination at delivery time.
+*
+*/
+const listRoutes = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes",
+	...options
+});
+/**
+* Create a recipient route
+*
+* Binds a recipient pattern to a destination. Provide exactly one of
+* `endpoint_id` (an existing endpoint) or `function_id`. With `function_id`,
+* a dedicated route-target endpoint is minted for that function in the same
+* transaction, enabling per-address function routing (e.g.
+* `alice@acme.com -> functionA`).
+*
+*/
+const createRoute = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Reorder recipient routes
+*
+* Update the priority of one or more routes in a single call.
+*/
+const reorderRoutes = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/reorder",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Simulate routing for a recipient
+*
+* Resolves where an inbound email to `recipient` would be delivered, with a
+* trace of every rule evaluated and why. Read-only; creates nothing.
+*
+*/
+const simulateRoute = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/simulate",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a recipient route
+*/
+const deleteRoute = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/{id}",
+	...options
+});
+/**
+* Update a recipient route
+*/
+const updateRoute = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
 * List webhook deliveries
 *
 * Returns a paginated list of webhook delivery attempts. Each delivery
@@ -2043,6 +2149,10 @@ const openapiDocument = {
 			"name": "Filters",
 			"description": "Manage whitelist and blocklist filter rules"
 		},
+		{
+			"name": "Routes",
+			"description": "Recipient routing: route inbound mail to a single destination per recipient\naddress. Rules bind an address pattern (exact or wildcard) to an endpoint;\n`function_id` routes an address to a function, minting its route-target\nendpoint.\n"
+		},
 		{
 			"name": "Payments",
 			"description": "Collect and pay stablecoin (USDC) payments with x402. Settlement is\nnon-custodial: funds move directly from payer to payee on-chain via an\nEIP-3009 authorization the payer signs with their own key, and Primitive\nnever holds funds. The payee registers a payout address and creates a\nchallenge; the payer signs and settles it under a configurable spend\npolicy (kill-switch, per-payment and per-day caps, payee allowlist).\n"
@@ -3457,6 +3567,129 @@ const openapiDocument = {
 				}
 			}
 		},
+		"/routes": {
+			"get": {
+				"operationId": "listRoutes",
+				"summary": "List recipient routes",
+				"description": "Returns the org's recipient routing rules in evaluation order. Each rule\nbinds a recipient address pattern to one endpoint; inbound mail resolves\nto a single destination at delivery time.\n",
+				"tags": ["Routes"],
+				"responses": {
+					"200": {
+						"description": "List of routes",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "array",
+								"items": { "$ref": "#/components/schemas/RecipientRoute" }
+							} }
+						}] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" }
+				}
+			},
+			"post": {
+				"operationId": "createRoute",
+				"summary": "Create a recipient route",
+				"description": "Binds a recipient pattern to a destination. Provide exactly one of\n`endpoint_id` (an existing endpoint) or `function_id`. With `function_id`,\na dedicated route-target endpoint is minted for that function in the same\ntransaction, enabling per-address function routing (e.g.\n`alice@acme.com -> functionA`).\n",
+				"tags": ["Routes"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateRouteInput" } } }
+				},
+				"responses": {
+					"201": {
+						"description": "Route created",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/RecipientRoute" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"409": { "$ref": "#/components/responses/Conflict" }
+				}
+			}
+		},
+		"/routes/reorder": { "post": {
+			"operationId": "reorderRoutes",
+			"summary": "Reorder recipient routes",
+			"description": "Update the priority of one or more routes in a single call.",
+			"tags": ["Routes"],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReorderRoutesInput" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Updated route list",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": {
+							"type": "array",
+							"items": { "$ref": "#/components/schemas/RecipientRoute" }
+						} }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" }
+			}
+		} },
+		"/routes/simulate": { "post": {
+			"operationId": "simulateRoute",
+			"summary": "Simulate routing for a recipient",
+			"description": "Resolves where an inbound email to `recipient` would be delivered, with a\ntrace of every rule evaluated and why. Read-only; creates nothing.\n",
+			"tags": ["Routes"],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/SimulateRouteInput" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Routing decision",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/SimulateRouteResult" } }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" }
+			}
+		} },
+		"/routes/{id}": {
+			"parameters": [{ "$ref": "#/components/parameters/ResourceId" }],
+			"patch": {
+				"operationId": "updateRoute",
+				"summary": "Update a recipient route",
+				"tags": ["Routes"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateRouteInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Updated route",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/RecipientRoute" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"404": { "$ref": "#/components/responses/NotFound" },
+					"409": { "$ref": "#/components/responses/Conflict" }
+				}
+			},
+			"delete": {
+				"operationId": "deleteRoute",
+				"summary": "Delete a recipient route",
+				"tags": ["Routes"],
+				"responses": {
+					"200": { "$ref": "#/components/responses/Deleted" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"404": { "$ref": "#/components/responses/NotFound" }
+				}
+			}
+		},
 		"/webhooks/deliveries": { "get": {
 			"operationId": "listDeliveries",
 			"summary": "List webhook deliveries",
@@ -8712,6 +8945,20 @@ const openapiDocument = {
 					"deactivated_at": {
 						"type": ["string", "null"],
 						"format": "date-time"
+					},
+					"kind": {
+						"type": "string",
+						"enum": ["http", "function"],
+						"description": "http: deliver to the webhook URL. function: invoke a Primitive Function."
+					},
+					"function_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The Function this endpoint invokes, when kind is function."
+					},
+					"is_route_target": {
+						"type": "boolean",
+						"description": "When true, this endpoint is reachable only via an explicit recipient\nroute, never as a domain's default destination, and is exempt from\nthe one-endpoint-per-domain rule (so many can share a domain).\n"
 					}
 				},
 				"required": [
@@ -8727,14 +8974,20 @@ const openapiDocument = {
 					"consecutive_fails"
 				]
 			},
-			"CreateEndpointInput": {
+			"CreateHttpEndpointInput": {
 				"type": "object",
 				"additionalProperties": false,
 				"properties": {
+					"kind": {
+						"type": "string",
+						"enum": ["http"],
+						"default": "http",
+						"description": "Deliver to a webhook URL."
+					},
 					"url": {
 						"type": "string",
 						"minLength": 1,
-						"description": "The webhook URL to deliver events to"
+						"description": "The webhook URL to deliver events to."
 					},
 					"enabled": {
 						"type": "boolean",
@@ -8749,10 +9002,61 @@ const openapiDocument = {
 					"rules": {
 						"type": "object",
 						"description": "Endpoint-specific filtering rules"
+					},
+					"is_route_target": {
+						"type": "boolean",
+						"default": false,
+						"description": "Create this endpoint as a route-target: reachable only via an\nexplicit recipient route, never a domain's default destination, and\nexempt from the one-endpoint-per-domain rule.\n"
 					}
 				},
 				"required": ["url"]
 			},
+			"CreateFunctionEndpointInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"kind": {
+						"type": "string",
+						"enum": ["function"],
+						"description": "Invoke a Primitive Function."
+					},
+					"function_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The Function to invoke."
+					},
+					"enabled": {
+						"type": "boolean",
+						"default": true,
+						"description": "Whether the endpoint is active"
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Restrict to emails from a specific domain"
+					},
+					"rules": {
+						"type": "object",
+						"description": "Endpoint-specific filtering rules"
+					},
+					"is_route_target": {
+						"type": "boolean",
+						"default": false,
+						"description": "Create this endpoint as a route-target: reachable only via an\nexplicit recipient route, never a domain's default destination, and\nexempt from the one-endpoint-per-domain rule.\n"
+					}
+				},
+				"required": ["kind", "function_id"]
+			},
+			"CreateEndpointInput": {
+				"oneOf": [{ "$ref": "#/components/schemas/CreateHttpEndpointInput" }, { "$ref": "#/components/schemas/CreateFunctionEndpointInput" }],
+				"discriminator": {
+					"propertyName": "kind",
+					"mapping": {
+						"http": "#/components/schemas/CreateHttpEndpointInput",
+						"function": "#/components/schemas/CreateFunctionEndpointInput"
+					}
+				}
+			},
 			"UpdateEndpointInput": {
 				"type": "object",
 				"additionalProperties": false,
@@ -8856,14 +9160,11 @@ const openapiDocument = {
 				"properties": { "enabled": { "type": "boolean" } },
 				"required": ["enabled"]
 			},
-			"DeliverySummary": {
+			"RecipientRoute": {
 				"type": "object",
+				"description": "A recipient routing rule binding an address pattern to one endpoint.",
 				"properties": {
 					"id": {
-						"type": "string",
-						"description": "Delivery ID (numeric string)"
-					},
-					"email_id": {
 						"type": "string",
 						"format": "uuid"
 					},
@@ -8871,47 +9172,309 @@ const openapiDocument = {
 						"type": "string",
 						"format": "uuid"
 					},
-					"endpoint_id": {
-						"type": "string",
-						"format": "uuid"
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Domain the route is scoped to; null = org-wide."
 					},
-					"endpoint_url": { "type": "string" },
-					"status": {
+					"match_type": {
 						"type": "string",
 						"enum": [
-							"pending",
-							"delivered",
-							"header_confirmed",
-							"failed"
+							"exact",
+							"wildcard",
+							"regex"
 						]
 					},
-					"attempt_count": { "type": "integer" },
-					"duration_ms": { "type": ["integer", "null"] },
-					"last_error": { "type": ["string", "null"] },
-					"created_at": {
+					"pattern": {
 						"type": "string",
-						"format": "date-time"
+						"description": "The recipient address pattern (an exact address or a wildcard)."
 					},
-					"updated_at": {
+					"pattern_norm": {
+						"type": ["string", "null"],
+						"description": "Normalized pattern used for matching."
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The endpoint inbound mail matching this rule is delivered to."
+					},
+					"priority": {
+						"type": "integer",
+						"description": "Evaluation order within a scope; lower is checked first."
+					},
+					"enabled": { "type": "boolean" },
+					"match_count": {
 						"type": "string",
+						"description": "How many emails have matched this rule (a bigint, returned as a string)."
+					},
+					"last_matched_at": {
+						"type": ["string", "null"],
 						"format": "date-time"
 					},
-					"email": {
-						"type": ["object", "null"],
-						"properties": {
-							"sender": { "type": "string" },
-							"recipient": { "type": "string" },
-							"subject": { "type": ["string", "null"] }
-						},
-						"required": ["sender", "recipient"]
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
 					}
 				},
-				"required": [
-					"id",
-					"email_id",
-					"org_id",
-					"endpoint_id",
-					"endpoint_url",
+				"required": ["id"]
+			},
+			"CreateRouteInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "Provide exactly one of `endpoint_id` or `function_id`. With `function_id`,\na route-target endpoint is minted for that function and the route is bound\nto it in one transaction.\n",
+				"properties": {
+					"match_type": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
+					},
+					"pattern": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 512
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "An existing endpoint to route to. Mutually exclusive with function_id."
+					},
+					"function_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "Route to this function, minting its route-target endpoint if needed. Mutually exclusive with endpoint_id."
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Scope the route to a domain; defaults to the pattern's domain."
+					},
+					"priority": {
+						"type": "integer",
+						"minimum": 0,
+						"maximum": 1e6
+					},
+					"enabled": { "type": "boolean" }
+				},
+				"required": ["match_type", "pattern"]
+			},
+			"UpdateRouteInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"match_type": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
+					},
+					"pattern": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 512
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid"
+					},
+					"priority": {
+						"type": "integer",
+						"minimum": 0,
+						"maximum": 1e6
+					},
+					"enabled": { "type": "boolean" }
+				}
+			},
+			"ReorderRoutesInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": { "updates": {
+					"type": "array",
+					"minItems": 1,
+					"maxItems": 1e3,
+					"items": {
+						"type": "object",
+						"additionalProperties": false,
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"priority": {
+								"type": "integer",
+								"minimum": 0,
+								"maximum": 1e6
+							}
+						},
+						"required": ["id", "priority"]
+					}
+				} },
+				"required": ["updates"]
+			},
+			"SimulateRouteInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"recipient": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 320
+					},
+					"event_type": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 100,
+						"description": "Event type to model; defaults to email.received."
+					}
+				},
+				"required": ["recipient"]
+			},
+			"RouteEvaluatedEntry": {
+				"type": "object",
+				"properties": {
+					"route_id": { "type": "string" },
+					"tier": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
+					},
+					"pattern": { "type": "string" },
+					"result": {
+						"type": "string",
+						"enum": [
+							"hit",
+							"miss",
+							"skipped",
+							"error"
+						]
+					},
+					"reason": { "type": "string" }
+				},
+				"required": [
+					"route_id",
+					"tier",
+					"pattern",
+					"result"
+				]
+			},
+			"SimulateRouteResult": {
+				"type": "object",
+				"description": "Where an inbound email to the recipient would be delivered, and why.",
+				"properties": {
+					"outcome": {
+						"type": "string",
+						"enum": [
+							"matched",
+							"defaulted",
+							"none"
+						]
+					},
+					"recipient": { "type": "string" },
+					"endpoint_id": { "type": ["string", "null"] },
+					"matched_route_id": { "type": ["string", "null"] },
+					"matched_tier": {
+						"type": ["string", "null"],
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex",
+							null
+						]
+					},
+					"matched_pattern": { "type": ["string", "null"] },
+					"default_scope": {
+						"type": ["string", "null"],
+						"enum": [
+							"domain",
+							"org",
+							null
+						]
+					},
+					"evaluated": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/RouteEvaluatedEntry" }
+					},
+					"truncated": { "type": "boolean" }
+				},
+				"required": [
+					"outcome",
+					"recipient",
+					"endpoint_id",
+					"matched_route_id",
+					"matched_tier",
+					"matched_pattern",
+					"default_scope",
+					"evaluated",
+					"truncated"
+				]
+			},
+			"DeliverySummary": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"description": "Delivery ID (numeric string)"
+					},
+					"email_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"org_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"endpoint_url": { "type": "string" },
+					"status": {
+						"type": "string",
+						"enum": [
+							"pending",
+							"delivered",
+							"header_confirmed",
+							"failed"
+						]
+					},
+					"attempt_count": { "type": "integer" },
+					"duration_ms": { "type": ["integer", "null"] },
+					"last_error": { "type": ["string", "null"] },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"email": {
+						"type": ["object", "null"],
+						"properties": {
+							"sender": { "type": "string" },
+							"recipient": { "type": "string" },
+							"subject": { "type": ["string", "null"] }
+						},
+						"required": ["sender", "recipient"]
+					}
+				},
+				"required": [
+					"id",
+					"email_id",
+					"org_id",
+					"endpoint_id",
+					"endpoint_url",
 					"status",
 					"attempt_count",
 					"created_at",
@@ -12806,30 +13369,85 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
-			"type": "object",
-			"additionalProperties": false,
-			"properties": {
-				"url": {
-					"type": "string",
-					"minLength": 1,
-					"description": "The webhook URL to deliver events to"
-				},
-				"enabled": {
-					"type": "boolean",
-					"default": true,
-					"description": "Whether the endpoint is active"
+			"oneOf": [{
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"kind": {
+						"type": "string",
+						"enum": ["http"],
+						"default": "http",
+						"description": "Deliver to a webhook URL."
+					},
+					"url": {
+						"type": "string",
+						"minLength": 1,
+						"description": "The webhook URL to deliver events to."
+					},
+					"enabled": {
+						"type": "boolean",
+						"default": true,
+						"description": "Whether the endpoint is active"
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Restrict to emails from a specific domain"
+					},
+					"rules": {
+						"type": "object",
+						"description": "Endpoint-specific filtering rules"
+					},
+					"is_route_target": {
+						"type": "boolean",
+						"default": false,
+						"description": "Create this endpoint as a route-target: reachable only via an\nexplicit recipient route, never a domain's default destination, and\nexempt from the one-endpoint-per-domain rule.\n"
+					}
 				},
-				"domain_id": {
-					"type": ["string", "null"],
-					"format": "uuid",
-					"description": "Restrict to emails from a specific domain"
+				"required": ["url"]
+			}, {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"kind": {
+						"type": "string",
+						"enum": ["function"],
+						"description": "Invoke a Primitive Function."
+					},
+					"function_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The Function to invoke."
+					},
+					"enabled": {
+						"type": "boolean",
+						"default": true,
+						"description": "Whether the endpoint is active"
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Restrict to emails from a specific domain"
+					},
+					"rules": {
+						"type": "object",
+						"description": "Endpoint-specific filtering rules"
+					},
+					"is_route_target": {
+						"type": "boolean",
+						"default": false,
+						"description": "Create this endpoint as a route-target: reachable only via an\nexplicit recipient route, never a domain's default destination, and\nexempt from the one-endpoint-per-domain rule.\n"
+					}
 				},
-				"rules": {
-					"type": "object",
-					"description": "Endpoint-specific filtering rules"
+				"required": ["kind", "function_id"]
+			}],
+			"discriminator": {
+				"propertyName": "kind",
+				"mapping": {
+					"http": "#/components/schemas/CreateHttpEndpointInput",
+					"function": "#/components/schemas/CreateFunctionEndpointInput"
 				}
-			},
-			"required": ["url"]
+			}
 		},
 		"responseSchema": {
 			"type": "object",
@@ -12892,6 +13510,20 @@ const operationManifest = [
 				"deactivated_at": {
 					"type": ["string", "null"],
 					"format": "date-time"
+				},
+				"kind": {
+					"type": "string",
+					"enum": ["http", "function"],
+					"description": "http: deliver to the webhook URL. function: invoke a Primitive Function."
+				},
+				"function_id": {
+					"type": ["string", "null"],
+					"format": "uuid",
+					"description": "The Function this endpoint invokes, when kind is function."
+				},
+				"is_route_target": {
+					"type": "boolean",
+					"description": "When true, this endpoint is reachable only via an explicit recipient\nroute, never as a domain's default destination, and is exempt from\nthe one-endpoint-per-domain rule (so many can share a domain).\n"
 				}
 			},
 			"required": [
@@ -13011,6 +13643,20 @@ const operationManifest = [
 					"deactivated_at": {
 						"type": ["string", "null"],
 						"format": "date-time"
+					},
+					"kind": {
+						"type": "string",
+						"enum": ["http", "function"],
+						"description": "http: deliver to the webhook URL. function: invoke a Primitive Function."
+					},
+					"function_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The Function this endpoint invokes, when kind is function."
+					},
+					"is_route_target": {
+						"type": "boolean",
+						"description": "When true, this endpoint is reachable only via an explicit recipient\nroute, never as a domain's default destination, and is exempt from\nthe one-endpoint-per-domain rule (so many can share a domain).\n"
 					}
 				},
 				"required": [
@@ -13169,6 +13815,20 @@ const operationManifest = [
 				"deactivated_at": {
 					"type": ["string", "null"],
 					"format": "date-time"
+				},
+				"kind": {
+					"type": "string",
+					"enum": ["http", "function"],
+					"description": "http: deliver to the webhook URL. function: invoke a Primitive Function."
+				},
+				"function_id": {
+					"type": ["string", "null"],
+					"format": "uuid",
+					"description": "The Function this endpoint invokes, when kind is function."
+				},
+				"is_route_target": {
+					"type": "boolean",
+					"description": "When true, this endpoint is reachable only via an explicit recipient\nroute, never as a domain's default destination, and is exempt from\nthe one-endpoint-per-domain rule (so many can share a domain).\n"
 				}
 			},
 			"required": [
@@ -16764,109 +17424,658 @@ const operationManifest = [
 					"type": "array",
 					"items": { "type": "string" }
 				},
-				"handle": {
+				"handle": {
+					"type": ["string", "null"],
+					"description": "The registry-scoped name. Null on the global by-address read."
+				}
+			},
+			"required": [
+				"address",
+				"display_name",
+				"title",
+				"description",
+				"tags",
+				"handle"
+			]
+		},
+		"sdkName": "resolveRegistryHandle",
+		"summary": "Resolve a registry handle to its agent",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "unpublish-agent",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "DELETE",
+		"operationId": "unpublishAgent",
+		"path": "/registries/{slug}/agents/{handle}",
+		"pathParams": [{
+			"description": "The registry slug.",
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}, {
+			"description": "The registry-scoped handle the agent is published under.",
+			"enum": null,
+			"name": "handle",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": null,
+		"sdkName": "unpublishAgent",
+		"summary": "Unpublish an agent from a registry",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-registry",
+		"description": null,
+		"hasJsonBody": true,
+		"method": "PATCH",
+		"operationId": "updateRegistry",
+		"path": "/registries/{slug}",
+		"pathParams": [{
+			"description": "The registry slug",
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"minProperties": 1,
+			"properties": {
+				"name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 120
+				},
+				"description": {
+					"type": ["string", "null"],
+					"maxLength": 2e3
+				},
+				"is_public": { "type": "boolean" },
+				"publish_policy": {
+					"type": "string",
+					"enum": [
+						"owner_only",
+						"request",
+						"open"
+					],
+					"description": "Who may publish into a registry. owner_only: only the registry owner.\nrequest: anyone may request and the owner approves. open: anyone may\npublish and it lists immediately (no approval step).\n"
+				}
+			}
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": { "id": {
+				"type": "string",
+				"format": "uuid"
+			} },
+			"required": ["id"]
+		},
+		"sdkName": "updateRegistry",
+		"summary": "Update a registry you own",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "create-route",
+		"description": "Binds a recipient pattern to a destination. Provide exactly one of\n`endpoint_id` (an existing endpoint) or `function_id`. With `function_id`,\na dedicated route-target endpoint is minted for that function in the same\ntransaction, enabling per-address function routing (e.g.\n`alice@acme.com -> functionA`).\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createRoute",
+		"path": "/routes",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Provide exactly one of `endpoint_id` or `function_id`. With `function_id`,\na route-target endpoint is minted for that function and the route is bound\nto it in one transaction.\n",
+			"properties": {
+				"match_type": {
+					"type": "string",
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex"
+					]
+				},
+				"pattern": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 512
+				},
+				"endpoint_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "An existing endpoint to route to. Mutually exclusive with function_id."
+				},
+				"function_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "Route to this function, minting its route-target endpoint if needed. Mutually exclusive with endpoint_id."
+				},
+				"domain_id": {
+					"type": ["string", "null"],
+					"format": "uuid",
+					"description": "Scope the route to a domain; defaults to the pattern's domain."
+				},
+				"priority": {
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 1e6
+				},
+				"enabled": { "type": "boolean" }
+			},
+			"required": ["match_type", "pattern"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "A recipient routing rule binding an address pattern to one endpoint.",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"org_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"domain_id": {
+					"type": ["string", "null"],
+					"format": "uuid",
+					"description": "Domain the route is scoped to; null = org-wide."
+				},
+				"match_type": {
+					"type": "string",
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex"
+					]
+				},
+				"pattern": {
+					"type": "string",
+					"description": "The recipient address pattern (an exact address or a wildcard)."
+				},
+				"pattern_norm": {
+					"type": ["string", "null"],
+					"description": "Normalized pattern used for matching."
+				},
+				"endpoint_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "The endpoint inbound mail matching this rule is delivered to."
+				},
+				"priority": {
+					"type": "integer",
+					"description": "Evaluation order within a scope; lower is checked first."
+				},
+				"enabled": { "type": "boolean" },
+				"match_count": {
+					"type": "string",
+					"description": "How many emails have matched this rule (a bigint, returned as a string)."
+				},
+				"last_matched_at": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
+			"required": ["id"]
+		},
+		"sdkName": "createRoute",
+		"summary": "Create a recipient route",
+		"tag": "Routes",
+		"tagCommand": "routes"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "delete-route",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "DELETE",
+		"operationId": "deleteRoute",
+		"path": "/routes/{id}",
+		"pathParams": [{
+			"description": "Resource UUID",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": null,
+		"sdkName": "deleteRoute",
+		"summary": "Delete a recipient route",
+		"tag": "Routes",
+		"tagCommand": "routes"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-routes",
+		"description": "Returns the org's recipient routing rules in evaluation order. Each rule\nbinds a recipient address pattern to one endpoint; inbound mail resolves\nto a single destination at delivery time.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listRoutes",
+		"path": "/routes",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"description": "A recipient routing rule binding an address pattern to one endpoint.",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"org_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Domain the route is scoped to; null = org-wide."
+					},
+					"match_type": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
+					},
+					"pattern": {
+						"type": "string",
+						"description": "The recipient address pattern (an exact address or a wildcard)."
+					},
+					"pattern_norm": {
+						"type": ["string", "null"],
+						"description": "Normalized pattern used for matching."
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The endpoint inbound mail matching this rule is delivered to."
+					},
+					"priority": {
+						"type": "integer",
+						"description": "Evaluation order within a scope; lower is checked first."
+					},
+					"enabled": { "type": "boolean" },
+					"match_count": {
+						"type": "string",
+						"description": "How many emails have matched this rule (a bigint, returned as a string)."
+					},
+					"last_matched_at": {
+						"type": ["string", "null"],
+						"format": "date-time"
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": ["id"]
+			}
+		},
+		"sdkName": "listRoutes",
+		"summary": "List recipient routes",
+		"tag": "Routes",
+		"tagCommand": "routes"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "reorder-routes",
+		"description": "Update the priority of one or more routes in a single call.",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "reorderRoutes",
+		"path": "/routes/reorder",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": { "updates": {
+				"type": "array",
+				"minItems": 1,
+				"maxItems": 1e3,
+				"items": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": {
+						"id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"priority": {
+							"type": "integer",
+							"minimum": 0,
+							"maximum": 1e6
+						}
+					},
+					"required": ["id", "priority"]
+				}
+			} },
+			"required": ["updates"]
+		},
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"description": "A recipient routing rule binding an address pattern to one endpoint.",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"org_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"domain_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "Domain the route is scoped to; null = org-wide."
+					},
+					"match_type": {
+						"type": "string",
+						"enum": [
+							"exact",
+							"wildcard",
+							"regex"
+						]
+					},
+					"pattern": {
+						"type": "string",
+						"description": "The recipient address pattern (an exact address or a wildcard)."
+					},
+					"pattern_norm": {
+						"type": ["string", "null"],
+						"description": "Normalized pattern used for matching."
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The endpoint inbound mail matching this rule is delivered to."
+					},
+					"priority": {
+						"type": "integer",
+						"description": "Evaluation order within a scope; lower is checked first."
+					},
+					"enabled": { "type": "boolean" },
+					"match_count": {
+						"type": "string",
+						"description": "How many emails have matched this rule (a bigint, returned as a string)."
+					},
+					"last_matched_at": {
+						"type": ["string", "null"],
+						"format": "date-time"
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": ["id"]
+			}
+		},
+		"sdkName": "reorderRoutes",
+		"summary": "Reorder recipient routes",
+		"tag": "Routes",
+		"tagCommand": "routes"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "simulate-route",
+		"description": "Resolves where an inbound email to `recipient` would be delivered, with a\ntrace of every rule evaluated and why. Read-only; creates nothing.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "simulateRoute",
+		"path": "/routes/simulate",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"recipient": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 320
+				},
+				"event_type": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 100,
+					"description": "Event type to model; defaults to email.received."
+				}
+			},
+			"required": ["recipient"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "Where an inbound email to the recipient would be delivered, and why.",
+			"properties": {
+				"outcome": {
+					"type": "string",
+					"enum": [
+						"matched",
+						"defaulted",
+						"none"
+					]
+				},
+				"recipient": { "type": "string" },
+				"endpoint_id": { "type": ["string", "null"] },
+				"matched_route_id": { "type": ["string", "null"] },
+				"matched_tier": {
 					"type": ["string", "null"],
-					"description": "The registry-scoped name. Null on the global by-address read."
-				}
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex",
+						null
+					]
+				},
+				"matched_pattern": { "type": ["string", "null"] },
+				"default_scope": {
+					"type": ["string", "null"],
+					"enum": [
+						"domain",
+						"org",
+						null
+					]
+				},
+				"evaluated": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"route_id": { "type": "string" },
+							"tier": {
+								"type": "string",
+								"enum": [
+									"exact",
+									"wildcard",
+									"regex"
+								]
+							},
+							"pattern": { "type": "string" },
+							"result": {
+								"type": "string",
+								"enum": [
+									"hit",
+									"miss",
+									"skipped",
+									"error"
+								]
+							},
+							"reason": { "type": "string" }
+						},
+						"required": [
+							"route_id",
+							"tier",
+							"pattern",
+							"result"
+						]
+					}
+				},
+				"truncated": { "type": "boolean" }
 			},
 			"required": [
-				"address",
-				"display_name",
-				"title",
-				"description",
-				"tags",
-				"handle"
+				"outcome",
+				"recipient",
+				"endpoint_id",
+				"matched_route_id",
+				"matched_tier",
+				"matched_pattern",
+				"default_scope",
+				"evaluated",
+				"truncated"
 			]
 		},
-		"sdkName": "resolveRegistryHandle",
-		"summary": "Resolve a registry handle to its agent",
-		"tag": "Registries",
-		"tagCommand": "registries"
-	},
-	{
-		"binaryResponse": false,
-		"bodyRequired": false,
-		"command": "unpublish-agent",
-		"description": null,
-		"hasJsonBody": false,
-		"method": "DELETE",
-		"operationId": "unpublishAgent",
-		"path": "/registries/{slug}/agents/{handle}",
-		"pathParams": [{
-			"description": "The registry slug.",
-			"enum": null,
-			"name": "slug",
-			"required": true,
-			"type": "string"
-		}, {
-			"description": "The registry-scoped handle the agent is published under.",
-			"enum": null,
-			"name": "handle",
-			"required": true,
-			"type": "string"
-		}],
-		"queryParams": [],
-		"requestSchema": null,
-		"responseSchema": null,
-		"sdkName": "unpublishAgent",
-		"summary": "Unpublish an agent from a registry",
-		"tag": "Registries",
-		"tagCommand": "registries"
+		"sdkName": "simulateRoute",
+		"summary": "Simulate routing for a recipient",
+		"tag": "Routes",
+		"tagCommand": "routes"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "update-registry",
+		"command": "update-route",
 		"description": null,
 		"hasJsonBody": true,
 		"method": "PATCH",
-		"operationId": "updateRegistry",
-		"path": "/registries/{slug}",
+		"operationId": "updateRoute",
+		"path": "/routes/{id}",
 		"pathParams": [{
-			"description": "The registry slug",
+			"description": "Resource UUID",
 			"enum": null,
-			"name": "slug",
+			"name": "id",
 			"required": true,
 			"type": "string"
 		}],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
-			"minProperties": 1,
+			"additionalProperties": false,
 			"properties": {
-				"name": {
+				"match_type": {
+					"type": "string",
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex"
+					]
+				},
+				"pattern": {
 					"type": "string",
 					"minLength": 1,
-					"maxLength": 120
+					"maxLength": 512
 				},
-				"description": {
+				"endpoint_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"domain_id": {
 					"type": ["string", "null"],
-					"maxLength": 2e3
+					"format": "uuid"
 				},
-				"is_public": { "type": "boolean" },
-				"publish_policy": {
-					"type": "string",
-					"enum": [
-						"owner_only",
-						"request",
-						"open"
-					],
-					"description": "Who may publish into a registry. owner_only: only the registry owner.\nrequest: anyone may request and the owner approves. open: anyone may\npublish and it lists immediately (no approval step).\n"
-				}
+				"priority": {
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 1e6
+				},
+				"enabled": { "type": "boolean" }
 			}
 		},
 		"responseSchema": {
 			"type": "object",
-			"properties": { "id": {
-				"type": "string",
-				"format": "uuid"
-			} },
+			"description": "A recipient routing rule binding an address pattern to one endpoint.",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"org_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"domain_id": {
+					"type": ["string", "null"],
+					"format": "uuid",
+					"description": "Domain the route is scoped to; null = org-wide."
+				},
+				"match_type": {
+					"type": "string",
+					"enum": [
+						"exact",
+						"wildcard",
+						"regex"
+					]
+				},
+				"pattern": {
+					"type": "string",
+					"description": "The recipient address pattern (an exact address or a wildcard)."
+				},
+				"pattern_norm": {
+					"type": ["string", "null"],
+					"description": "Normalized pattern used for matching."
+				},
+				"endpoint_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "The endpoint inbound mail matching this rule is delivered to."
+				},
+				"priority": {
+					"type": "integer",
+					"description": "Evaluation order within a scope; lower is checked first."
+				},
+				"enabled": { "type": "boolean" },
+				"match_count": {
+					"type": "string",
+					"description": "How many emails have matched this rule (a bigint, returned as a string)."
+				},
+				"last_matched_at": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
 			"required": ["id"]
 		},
-		"sdkName": "updateRegistry",
-		"summary": "Update a registry you own",
-		"tag": "Registries",
-		"tagCommand": "registries"
+		"sdkName": "updateRoute",
+		"summary": "Update a recipient route",
+		"tag": "Routes",
+		"tagCommand": "routes"
 	},
 	{
 		"binaryResponse": false,
@@ -22655,8 +23864,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.11.0";
-const CLI_VERSION_RANGE = "^1.11.0";
+const SDK_VERSION_RANGE = "^1.13.0";
+const CLI_VERSION_RANGE = "^1.13.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -26720,6 +27929,22 @@ const X402_ERROR_HINTS = {
 	payment_verification_failed: "The signed payment did not match the challenge. Make sure you are paying with the wallet and network the challenge was issued for.",
 	ownership_proof_failed: "The signature did not prove control of the address. Make sure the wallet key matches the address you are registering."
 };
+/**
+* Sign an email-native x402 challenge into a payment-step `interaction.json`
+* envelope, locally and with no network call. This is the exact signing path
+* shared by `payments pay-email-step` (sign only) and `payments pay-email`
+* (sign and send), so both produce byte-identical `interaction.json` bytes for
+* the same challenge + key. The EIP-3009 / nonce derivation lives in the SDK's
+* `payEmailChallenge`; this helper just wires the CLI's key handling to it.
+*/
+async function signEmailChallenge(params) {
+	const client = createX402Client({
+		apiKey: params.apiKey || void 0,
+		baseUrl: x402BaseUrl(params.resolvedApiBaseUrl)
+	});
+	const signer = signerFromPrivateKey(params.privateKey);
+	return client.payEmailChallenge(params.challenge, { signer });
+}
 /** Turn a hex private key into a viem account (a valid X402Signer). */
 function signerFromPrivateKey(rawKey) {
 	const trimmed = rawKey.trim();
@@ -27040,17 +28265,16 @@ var PaymentsPayEmailStepCommand = class PaymentsPayEmailStepCommand extends Comm
 			credentials: null
 		};
 		await runWithTiming(flags.time, async () => {
-			const client = createX402Client({
-				apiKey: flags["api-key"] || void 0,
-				baseUrl: x402BaseUrl(requestConfig.resolvedApiBaseUrl)
-			});
 			try {
-				const challenge = readEmailChallenge({
-					inline: flags.challenge,
-					file: flags["challenge-file"]
+				const built = await signEmailChallenge({
+					challenge: readEmailChallenge({
+						inline: flags.challenge,
+						file: flags["challenge-file"]
+					}),
+					privateKey: flags["private-key"] ?? "",
+					resolvedApiBaseUrl: requestConfig.resolvedApiBaseUrl,
+					apiKey: flags["api-key"]
 				});
-				const signer = signerFromPrivateKey(flags["private-key"] ?? "");
-				const built = await client.payEmailChallenge(challenge, { signer });
 				if (flags.json) this.log(JSON.stringify(built.envelope, null, 2));
 				else this.log(built.json);
 			} catch (error) {
@@ -27065,6 +28289,136 @@ var PaymentsPayEmailStepCommand = class PaymentsPayEmailStepCommand extends Comm
 	}
 };
 //#endregion
+//#region src/oclif/commands/payments-pay-email.ts
+/** The exact part name + content type the inbound matcher requires. */
+const INTERACTION_PART_FILENAME = "interaction.json";
+const INTERACTION_PART_CONTENT_TYPE = "application/json";
+/** Build the `interaction.json` attachment from a signed payment step. */
+function interactionAttachment(built) {
+	return {
+		filename: INTERACTION_PART_FILENAME,
+		content_type: INTERACTION_PART_CONTENT_TYPE,
+		content_base64: Buffer.from(built.json, "utf8").toString("base64")
+	};
+}
+var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
+	static description = `Pay an email-native x402 challenge in one step: sign it and send the signed interaction.json as an in-thread reply.
+
+  Reads the email challenge the payee issued (the JSON from
+  \`payments create-email-challenge\`), derives and signs the interaction-bound
+  EIP-3009 authorization locally with your wallet key (read from
+  ${PRIVATE_KEY_ENV} by default), and replies in-thread to the challenge email
+  with the signed \`interaction.json\` attached as an \`application/json\` part.
+  The key never leaves your machine.
+
+  This is the recommended payer path. It replaces the two-step
+  \`pay-email-step\` + \`reply --attachment interaction.json\` dance: no manual
+  address or threading wrangling. Use \`pay-email-step\` only when you need the
+  signed bytes as a portable artifact without sending.
+
+  --in-reply-to is the id of the inbound challenge email you received; the reply
+  endpoint derives the recipient (the payee) and threading headers from it, and
+  defaults the From to the inbound's recipient (you, the payer). Pass --from
+  only to override that default.
+
+  Provide the challenge inline with --challenge, from a file with
+  --challenge-file, or piped on stdin.`;
+	static summary = "Sign an email x402 challenge and send it as an in-thread reply (one step)";
+	static examples = [
+		"<%= config.bin %> payments pay-email --challenge-file challenge.json --in-reply-to <inbound-email-id>",
+		"cat challenge.json | <%= config.bin %> payments pay-email --in-reply-to <inbound-email-id> --wait",
+		"<%= config.bin %> payments pay-email --challenge-file challenge.json --in-reply-to <inbound-email-id> --from 'Payer <payer@your-domain.example>'"
+	];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		"private-key": Flags.string({
+			description: PRIVATE_KEY_FLAG_DESCRIPTION,
+			env: PRIVATE_KEY_ENV
+		}),
+		challenge: Flags.string({
+			description: "The email challenge object as a JSON string.",
+			exclusive: ["challenge-file"]
+		}),
+		"challenge-file": Flags.string({
+			description: "Path to a file containing the email challenge JSON.",
+			exclusive: ["challenge"]
+		}),
+		"in-reply-to": Flags.string({
+			description: "Id of the inbound challenge email you received. The reply is threaded to it and addressed to the payee derived from it.",
+			required: true
+		}),
+		from: Flags.string({ description: "Optional From header override. Defaults to the inbound's recipient (the payer the challenge was addressed to)." }),
+		wait: Flags.boolean({ description: "Block until the receiving MTA returns an outcome. Without --wait, the call returns once Primitive has accepted the reply for delivery." }),
+		json: Flags.boolean({ description: "Print a JSON object with the signed interaction step and the send result." }),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(PaymentsPayEmailCommand);
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		const authFailureContext = {
+			auth,
+			baseUrlOverridden,
+			configDir: this.config.configDir
+		};
+		await runWithTiming(flags.time, async () => {
+			let built;
+			try {
+				built = await signEmailChallenge({
+					challenge: readEmailChallenge({
+						inline: flags.challenge,
+						file: flags["challenge-file"]
+					}),
+					privateKey: flags["private-key"] ?? "",
+					resolvedApiBaseUrl: auth.apiBaseUrl,
+					apiKey: flags["api-key"]
+				});
+			} catch (error) {
+				reportX402Error(error, authFailureContext);
+				process.exitCode = 1;
+				return;
+			}
+			const result = await replyToEmail({
+				body: {
+					attachments: [interactionAttachment(built)],
+					...flags.from !== void 0 ? { from: flags.from } : {},
+					...flags.wait !== void 0 ? { wait: flags.wait } : {}
+				},
+				client: apiClient.client,
+				path: { id: flags["in-reply-to"] },
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const errorPayload = extractErrorPayload(result.error);
+				writeErrorWithHints(errorPayload);
+				surfaceUnauthorizedHint({
+					...authFailureContext,
+					payload: errorPayload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			const sent = result.data?.data ?? null;
+			if (flags.json) this.log(JSON.stringify({
+				interaction: built.envelope,
+				sent
+			}, null, 2));
+			else this.log(JSON.stringify(sent, null, 2));
+		});
+	}
+};
+//#endregion
 //#region src/oclif/commands/payments-register-payout-address.ts
 var PaymentsRegisterPayoutAddressCommand = class PaymentsRegisterPayoutAddressCommand extends Command {
 	static description = `Register the default payout address your org receives x402 payments at.
@@ -28677,6 +30031,7 @@ const COMMANDS = {
 	"payments:charge": PaymentsChargeCommand,
 	"payments:pay-challenge": PaymentsPayCommand,
 	"payments:pay": PaymentsPayCommand,
+	"payments:pay-email": PaymentsPayEmailCommand,
 	"payments:pay-email-step": PaymentsPayEmailStepCommand
 };
 //#endregion