primcli 1.13.1 → 1.13.3

package/README.md

@@ -99,17 +99,17 @@ cat challenge.json | primitive payments pay
 primitive payments create-email-challenge --from payee@your-domain.example \
   --to payer@their-domain.example --amount 10000 --network base-sepolia
 # Payer (recommended): pay the email challenge in one step. Signs the challenge
-# locally with your wallet key AND sends the signed interaction.json as an
-# in-thread reply, so you skip the manual sign-then-reply dance. --in-reply-to
-# is the inbound challenge email you received; the reply is threaded to it and
-# addressed to the payee, and From defaults to the payer it was sent to. The
-# reply carries a short default note alongside the attachment; pass --body to
-# customize it.
+# locally with your wallet key AND sends the signed interaction.json, so you
+# skip the manual sign-then-send dance. --in-reply-to is the inbound challenge
+# email you received; it is fetched to address the payment to the payee, with
+# From defaulting to the payer it was sent to. The send is not threaded under
+# the challenge (the payment associates by interaction_id). The message carries
+# a short default note alongside the attachment; pass --body to customize it.
 primitive payments pay-email --challenge-file challenge.json \
   --in-reply-to <inbound-challenge-email-id> --wait
 
 # Advanced: sign only, without sending. Emits the portable interaction.json
-# artifact you can attach to a reply yourself (e.g. with `primitive reply`).
+# artifact you can attach yourself (e.g. with `primitive send --attachment`).
 primitive payments pay-email-step --challenge-file challenge.json > interaction.json
 
 # Inspect a challenge by id, or list your registered payout addresses.
@@ -124,7 +124,7 @@ primitive payments update-spend-policy --max-per-payment 5000000
 
 `charge` is the friendly verb that matches the SDK `charge` and accepts `--amount-usdc`; `create-challenge` is the lower-level command that takes base-unit `--amount`. Either creates a challenge. The signing commands print a human-readable summary by default; pass `--json` for raw JSON suitable for piping.
 
-The signing commands (`register-payout-address`, `pay`, `pay-email`, and `pay-email-step`) need your wallet key. `pay-email` is the recommended payer path for the email-native flow: it signs and replies in one step. `pay-email-step` signs only and emits the `interaction.json` artifact for advanced use where you want to deliver it yourself. Set the key in `PRIMITIVE_X402_PRIVATE_KEY` (a `0x`-prefixed hex private key) so it never lands in shell history or the process list:
+The signing commands (`register-payout-address`, `pay`, `pay-email`, and `pay-email-step`) need your wallet key. `pay-email` is the recommended payer path for the email-native flow: it signs and sends in one step. `pay-email-step` signs only and emits the `interaction.json` artifact for advanced use where you want to deliver it yourself. Set the key in `PRIMITIVE_X402_PRIVATE_KEY` (a `0x`-prefixed hex private key) so it never lands in shell history or the process list:
 
 ```bash
 export PRIMITIVE_X402_PRIVATE_KEY=0x...

package/dist/oclif/index.js

@@ -20955,7 +20955,7 @@ function assertParentMatchesRecipient(parent, recipient) {
 	if (normalizeEmailAddress(parent.from_email) === normalizeEmailAddress(recipient)) return;
 	throw cliError$6(`Inbound email ${parent.id} is from ${parent.from_email}, not ${recipient}. Use \`primitive chat ${parent.from_email} --reply <message> --reply-to-email-id ${parent.id}\` or omit --reply-to-email-id to continue the latest inbound from ${recipient}.`);
 }
-function emailDetailFromEnvelope(envelope) {
+function emailDetailFromEnvelope$1(envelope) {
 	return envelope?.data ?? envelope ?? null;
 }
 function buildCommand(kind, description, argv, options = {}) {
@@ -21205,7 +21205,7 @@ async function loadInboundEmailDetail(params) {
 		});
 		throw new Errors.CLIError(`Could not load inbound email ${params.id}.`, { exit: 1 });
 	}
-	const detail = emailDetailFromEnvelope(result.data);
+	const detail = emailDetailFromEnvelope$1(result.data);
 	if (!detail) throw new Errors.CLIError(`Could not load inbound email ${params.id}: the API returned no email body.`, { exit: 1 });
 	return detail;
 }
@@ -23864,8 +23864,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.13.1";
-const CLI_VERSION_RANGE = "^1.13.1";
+const SDK_VERSION_RANGE = "^1.13.3";
+const CLI_VERSION_RANGE = "^1.13.3";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -28293,7 +28293,8 @@ var PaymentsPayEmailStepCommand = class PaymentsPayEmailStepCommand extends Comm
 /** The exact part name + content type the inbound matcher requires. */
 const INTERACTION_PART_FILENAME = "interaction.json";
 const INTERACTION_PART_CONTENT_TYPE = "application/json";
-const DEFAULT_REPLY_BODY_TEXT = "x402 payment authorization attached (interaction.json).";
+const DEFAULT_SUBJECT = "x402 payment authorization";
+const DEFAULT_BODY_TEXT = "x402 payment authorization attached (interaction.json).";
 /** Build the `interaction.json` attachment from a signed payment step. */
 function interactionAttachment(built) {
 	return {
@@ -28302,29 +28303,39 @@ function interactionAttachment(built) {
 		content_base64: Buffer.from(built.json, "utf8").toString("base64")
 	};
 }
+/**
+* Pull the `EmailDetail` out of the get-email envelope. The fields wrapper
+* returns `{ data: { data: EmailDetail } }`; normalize to the inner detail or
+* null when the API returned no body.
+*/
+function emailDetailFromEnvelope(data) {
+	return data?.data ?? null;
+}
 var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
-	static description = `Pay an email-native x402 challenge in one step: sign it and send the signed interaction.json as an in-thread reply.
+	static description = `Pay an email-native x402 challenge in one step: sign it and send the signed interaction.json in-thread.
 
   Reads the email challenge the payee issued (the JSON from
   \`payments create-email-challenge\`), derives and signs the interaction-bound
   EIP-3009 authorization locally with your wallet key (read from
-  ${PRIVATE_KEY_ENV} by default), and replies in-thread to the challenge email
-  with the signed \`interaction.json\` attached as an \`application/json\` part.
-  The key never leaves your machine.
+  ${PRIVATE_KEY_ENV} by default), and sends the signed \`interaction.json\`
+  attached as an \`application/json\` part. The key never leaves your machine.
 
   This is the recommended payer path. It replaces the two-step
-  \`pay-email-step\` + \`reply --attachment interaction.json\` dance: no manual
+  \`pay-email-step\` + \`send --attachment interaction.json\` dance: no manual
   address or threading wrangling. Use \`pay-email-step\` only when you need the
   signed bytes as a portable artifact without sending.
 
-  --in-reply-to is the id of the inbound challenge email you received; the reply
-  endpoint derives the recipient (the payee) and threading headers from it, and
-  defaults the From to the inbound's recipient (you, the payer). Pass --from
-  only to override that default.
+  --in-reply-to is the id of the inbound challenge email you received. It is
+  fetched to derive the recipient (the payee, from the inbound's sender) and the
+  From (you, the payer, from the inbound's recipient). The outgoing send does
+  NOT thread under the challenge: threading would trigger the send endpoint's
+  parent-thread dedup and the payment would never settle. The interaction
+  associates by interaction_id instead. Pass --from only to override the derived
+  payer From.
 
   Provide the challenge inline with --challenge, from a file with
   --challenge-file, or piped on stdin.`;
-	static summary = "Sign an email x402 challenge and send it as an in-thread reply (one step)";
+	static summary = "Sign an email x402 challenge and send the signed interaction.json in-thread (one step)";
 	static examples = [
 		"<%= config.bin %> payments pay-email --challenge-file challenge.json --in-reply-to <inbound-email-id>",
 		"cat challenge.json | <%= config.bin %> payments pay-email --in-reply-to <inbound-email-id> --wait",
@@ -28353,12 +28364,12 @@ var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
 			exclusive: ["challenge"]
 		}),
 		"in-reply-to": Flags.string({
-			description: "Id of the inbound challenge email you received. The reply is threaded to it and addressed to the payee derived from it.",
+			description: "Id of the inbound challenge email you received. It is fetched to derive the payee recipient and the payer From. The outgoing send is not threaded under the challenge; the payment associates by interaction_id.",
 			required: true
 		}),
 		from: Flags.string({ description: "Optional From header override. Defaults to the inbound's recipient (the payer the challenge was addressed to)." }),
-		body: Flags.string({ description: `Plain-text reply body. The signed authorization travels in the interaction.json attachment; this is the human-readable accompanying note. Defaults to "${DEFAULT_REPLY_BODY_TEXT}".` }),
-		wait: Flags.boolean({ description: "Block until the receiving MTA returns an outcome. Without --wait, the call returns once Primitive has accepted the reply for delivery." }),
+		body: Flags.string({ description: `Plain-text body. The signed authorization travels in the interaction.json attachment; this is the human-readable accompanying note. Defaults to "${DEFAULT_BODY_TEXT}".` }),
+		wait: Flags.boolean({ description: "Block until the receiving MTA returns an outcome. Without --wait, the call returns once Primitive has accepted the message for delivery." }),
 		json: Flags.boolean({ description: "Print a JSON object with the signed interaction step and the send result." }),
 		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
 	};
@@ -28391,15 +28402,50 @@ var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
 				process.exitCode = 1;
 				return;
 			}
-			const result = await replyToEmail({
+			const inboundResult = await getEmail({
+				client: apiClient.client,
+				path: { id: flags["in-reply-to"] },
+				responseStyle: "fields"
+			});
+			if (inboundResult.error) {
+				const errorPayload = extractErrorPayload(inboundResult.error);
+				writeErrorWithHints(errorPayload);
+				surfaceUnauthorizedHint({
+					...authFailureContext,
+					payload: errorPayload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			const inbound = emailDetailFromEnvelope(inboundResult.data);
+			if (!inbound) {
+				process.stderr.write(`Could not load inbound challenge email ${flags["in-reply-to"]}: the API returned no email.\n`);
+				process.exitCode = 1;
+				return;
+			}
+			const payeeTo = inbound.from_email;
+			const derivedPayerFrom = inbound.to_email || inbound.recipient;
+			const from = flags.from ?? derivedPayerFrom;
+			if (!payeeTo) {
+				process.stderr.write(`Inbound challenge email ${flags["in-reply-to"]} has no resolvable sender to address the payment to.\n`);
+				process.exitCode = 1;
+				return;
+			}
+			if (!from) {
+				process.stderr.write(`Could not derive the payer From from inbound challenge email ${flags["in-reply-to"]}; pass --from explicitly.\n`);
+				process.exitCode = 1;
+				return;
+			}
+			const result = await sendEmail({
 				body: {
-					body_text: flags.body?.trim() ? flags.body : DEFAULT_REPLY_BODY_TEXT,
+					from,
+					to: payeeTo,
+					subject: DEFAULT_SUBJECT,
+					body_text: flags.body?.trim() ? flags.body : DEFAULT_BODY_TEXT,
 					attachments: [interactionAttachment(built)],
-					...flags.from !== void 0 ? { from: flags.from } : {},
 					...flags.wait !== void 0 ? { wait: flags.wait } : {}
 				},
 				client: apiClient.client,
-				path: { id: flags["in-reply-to"] },
 				responseStyle: "fields"
 			});
 			if (result.error) {
@@ -28413,11 +28459,17 @@ var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
 				return;
 			}
 			const sent = result.data?.data ?? null;
+			const replayed = sent?.idempotent_replay === true;
+			if (replayed) writeIdempotentReplayBannerIfReplay(sent, { write: (chunk) => {
+				process.stderr.write(chunk);
+			} });
 			if (flags.json) this.log(JSON.stringify({
 				interaction: built.envelope,
-				sent
+				sent,
+				idempotent_replay: replayed
 			}, null, 2));
 			else this.log(JSON.stringify(sent, null, 2));
+			if (replayed) process.exitCode = 1;
 		});
 	}
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.13.1",
+  "version": "1.13.3",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,