primcli 1.14.1 → 1.14.3

package/README.md

@@ -73,6 +73,26 @@ primitive deliveries replay --id <delivery-id>
 
 Generated API commands remain available for compatibility and full schema parity, for example `primitive emails:list-emails` and `primitive sending:reply-to-email`.
 
+## Recipient routing
+
+Bind a recipient address to a destination so inbound mail resolves to a single
+endpoint. Pass `--function` to route an address to a function (its route-target
+endpoint is created in the same call, enabling per-address routing like
+`alice@acme.com -> functionA`), or `--endpoint` for an existing endpoint.
+
+```bash
+primitive routes add alice@acme.com --function <function-id>
+primitive routes add 'support+*@acme.com' --match wildcard --endpoint <endpoint-id>
+primitive routes list
+primitive routes test alice@acme.com          # preview where an address resolves, with the rule trace
+primitive routes update <route-id> --priority 5
+primitive routes reorder --set <route-id>=10 --set <other-id>=20
+primitive routes remove <route-id>
+```
+
+Recipient routing is gated by an organization entitlement; routes are inert
+until it is enabled.
+
 ## x402 payments
 
 The `primitive payments` command group drives non-custodial x402 USDC payments. One agent registers a payout address and requests a payment; the paying agent signs locally with its own wallet key and settles. The key never leaves your machine. Networks are `base` and `base-sepolia`. Amounts take a human USDC value (`--amount-usdc 0.01`) or token base units (`--amount 10000`, since USDC has 6 decimals). Your org is resolved automatically from your API key, so payout registration takes no org flag.

package/dist/{cli-config-B5hrwe8q.js → cli-config-C-7V83Qd.js}

@@ -1124,6 +1124,21 @@ function detectPrimitiveKeyEnvMisname(env = process.env) {
 	if ((primitiveKey?.length ?? 0) > 0 && (primitiveApiKey?.length ?? 0) === 0) return "PRIMITIVE_KEY is set but the CLI reads PRIMITIVE_API_KEY. Rename your env var, or re-run with PRIMITIVE_API_KEY=$PRIMITIVE_KEY.";
 	return null;
 }
+/**
+* True when a usable OAuth login session is saved on disk. Used by `pay-email`
+* to decide whether it can safely ignore an env-only `PRIMITIVE_API_KEY` in
+* favor of the payer's logged-in account (which owns the inbound challenge
+* inbox). Returns false when nothing is stored or the stored credential is
+* unreadable/legacy, so the caller falls back to whatever key did resolve
+* rather than silently dropping the user's only auth.
+*/
+function hasStoredCliLogin(configDir) {
+	try {
+		return loadCliCredentials(configDir) !== null;
+	} catch {
+		return false;
+	}
+}
 function resolveCliAuth(params) {
 	const apiKey = params.apiKey?.trim();
 	const apiBaseUrl = normalizeApiBaseUrl(params.apiBaseUrl);
@@ -1327,4 +1342,4 @@ function redactCliEnvironment(environment) {
 	};
 }
 //#endregion
-export { PrimitiveApiClient as A, saveCliCredentials as C, loadActiveChatState as D, deleteChatState as E, createConfig as M, loadChatConversationByLocalId as O, resolveCliAuth as S, chatStatePath as T, deleteCliCredentials as _, normalizeCliEnvironmentName as a, loadCliCredentials as b, resolveConfigEnvironment as c, validateCliHeaderName as d, validateCliHeaderValue as f, credentialsPath as g, credentialsLockPath as h, loadCliConfig as i, createClient as j, saveActiveChatState as k, saveCliConfig as l, cliAccessTokenExpiresAt as m, deleteCliConfig as n, redactCliEnvironment as o, acquireCliCredentialsLock as p, emptyCliConfig as r, removeCliEnvironment as s, DEFAULT_ENVIRONMENT as t, upsertCliEnvironment as u, deleteCliCredentialsLock as v, saveSignupCredentials as w, normalizeApiBaseUrl as x, detectPrimitiveKeyEnvMisname as y };
+export { saveActiveChatState as A, resolveCliAuth as C, deleteChatState as D, chatStatePath as E, createClient as M, createConfig as N, loadActiveChatState as O, normalizeApiBaseUrl as S, saveSignupCredentials as T, deleteCliCredentials as _, normalizeCliEnvironmentName as a, hasStoredCliLogin as b, resolveConfigEnvironment as c, validateCliHeaderName as d, validateCliHeaderValue as f, credentialsPath as g, credentialsLockPath as h, loadCliConfig as i, PrimitiveApiClient as j, loadChatConversationByLocalId as k, saveCliConfig as l, cliAccessTokenExpiresAt as m, deleteCliConfig as n, redactCliEnvironment as o, acquireCliCredentialsLock as p, emptyCliConfig as r, removeCliEnvironment as s, DEFAULT_ENVIRONMENT as t, upsertCliEnvironment as u, deleteCliCredentialsLock as v, saveCliCredentials as w, loadCliCredentials as x, detectPrimitiveKeyEnvMisname as y };

package/dist/oclif/index.js

@@ -1,4 +1,4 @@
-import { A as PrimitiveApiClient, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, M as createConfig, O as loadChatConversationByLocalId, S as resolveCliAuth, T as chatStatePath, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as createClient, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "../cli-config-B5hrwe8q.js";
+import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient, N as createConfig, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-C-7V83Qd.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
 import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { randomUUID } from "node:crypto";
@@ -3607,6 +3607,7 @@ const openapiDocument = {
 					},
 					"400": { "$ref": "#/components/responses/ValidationError" },
 					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
 					"409": { "$ref": "#/components/responses/Conflict" }
 				}
 			}
@@ -3676,6 +3677,7 @@ const openapiDocument = {
 					},
 					"400": { "$ref": "#/components/responses/ValidationError" },
 					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
 					"404": { "$ref": "#/components/responses/NotFound" },
 					"409": { "$ref": "#/components/responses/Conflict" }
 				}
@@ -28619,6 +28621,23 @@ async function pollForSettlementInteraction(params) {
 function shouldDeriveChallenge(flags) {
 	return flags.challenge === void 0 && flags["challenge-file"] === void 0;
 }
+/**
+* Decide the api-key `pay-email` should authenticate its inbox reads with, given
+* the parsed flag value, whether `--api-key` was passed explicitly on the
+* command line (vs sourced from `PRIMITIVE_API_KEY`), and whether a logged-in
+* session exists. Returns the key to use, or `undefined` to fall through to the
+* stored login. See the block comment above for the precedence rationale.
+*/
+function resolvePayerInboxApiKey(params) {
+	if (params.apiKeyFlag !== void 0 && params.apiKeyFromEnvOnly && params.hasStoredLogin) return {
+		apiKey: void 0,
+		usedStoredLoginOverEnvKey: true
+	};
+	return {
+		apiKey: params.apiKeyFlag,
+		usedStoredLoginOverEnvKey: false
+	};
+}
 /** The exact part name + content type the inbound matcher requires. */
 const INTERACTION_PART_FILENAME = "interaction.json";
 const INTERACTION_PART_CONTENT_TYPE = "application/json";
@@ -28744,9 +28763,17 @@ var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
 		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
 	};
 	async run() {
-		const { flags } = await this.parse(PaymentsPayEmailCommand);
+		const { flags, raw } = await this.parse(PaymentsPayEmailCommand);
+		const apiKeyFlagExplicit = raw.some((token) => token.type === "flag" && token.flag === "api-key");
+		const apiKeyFromEnvOnly = flags["api-key"] !== void 0 && !apiKeyFlagExplicit;
+		const { apiKey: effectiveApiKey, usedStoredLoginOverEnvKey } = resolvePayerInboxApiKey({
+			apiKeyFlag: flags["api-key"],
+			apiKeyFromEnvOnly,
+			hasStoredLogin: hasStoredCliLogin(this.config.configDir)
+		});
+		if (usedStoredLoginOverEnvKey) process.stderr.write("PRIMITIVE_API_KEY is set, but pay-email reads the inbound challenge from your logged-in account's inbox, so it is using your saved login for this command. Pass --api-key explicitly to override.\n");
 		const { apiClient, auth, baseUrlOverridden, requestConfig } = await createAuthenticatedCliApiClient({
-			apiKey: flags["api-key"],
+			apiKey: effectiveApiKey,
 			apiBaseUrl: flags["api-base-url"],
 			configDir: this.config.configDir
 		});
@@ -28768,6 +28795,7 @@ var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
 					...authFailureContext,
 					payload: errorPayload
 				});
+				if (extractErrorCode(errorPayload) === API_ERROR_CODES.notFound && auth.source === "flag-or-env") process.stderr.write("The inbound challenge email was not found for the org this API key belongs to. pay-email reads the challenge from the PAYER account's inbox: unset PRIMITIVE_API_KEY (or pass --api-key for the payer's org, or run `primitive signin` as the payer) and retry.\n");
 				process.exitCode = 1;
 				return;
 			}
@@ -28795,7 +28823,7 @@ var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
 					challenge,
 					privateKey: flags["private-key"] ?? "",
 					resolvedApiBaseUrl: auth.apiBaseUrl,
-					apiKey: flags["api-key"]
+					apiKey: effectiveApiKey
 				});
 			} catch (error) {
 				reportX402Error(error, authFailureContext);
@@ -29163,6 +29191,434 @@ var ReplyCommand = class ReplyCommand extends Command {
 	}
 };
 //#endregion
+//#region src/oclif/commands/routes-add.ts
+function resolveCreateTarget(flags) {
+	if (flags.function) return { function_id: flags.function };
+	if (flags.endpoint) return { endpoint_id: flags.endpoint };
+	return { error: "Provide exactly one of --function (route to a function) or --endpoint (an existing endpoint)." };
+}
+var RoutesAddCommand = class RoutesAddCommand extends Command {
+	static description = `Create a recipient route binding an address pattern to a destination.
+
+  Provide exactly one of --function (route to a function; its route-target
+  endpoint is created in the same transaction) or --endpoint (an existing
+  endpoint). The match type defaults to exact; use --match wildcard for
+  patterns like 'support+*@acme.com'.`;
+	static summary = "Add a recipient route";
+	static examples = [
+		"<%= config.bin %> routes add alice@acme.com --function <fn-id>",
+		"<%= config.bin %> routes add 'support+*@acme.com' --match wildcard --function <fn-id>",
+		"<%= config.bin %> routes add billing@acme.com --endpoint <endpoint-id> --priority 10"
+	];
+	static args = { pattern: Args.string({
+		description: "Recipient address or wildcard pattern (e.g. alice@acme.com).",
+		required: true
+	}) };
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION }),
+		function: Flags.string({
+			description: "Function id to route this address to (its route-target endpoint is minted if needed). Mutually exclusive with --endpoint.",
+			exclusive: ["endpoint"]
+		}),
+		endpoint: Flags.string({
+			description: "Existing endpoint id to route to. Mutually exclusive with --function.",
+			exclusive: ["function"]
+		}),
+		match: Flags.string({
+			description: "Match type for the pattern. regex requires the Power plan and may be rejected if not enabled.",
+			options: [
+				"exact",
+				"wildcard",
+				"regex"
+			],
+			default: "exact"
+		}),
+		domain: Flags.string({ description: "Scope the route to this domain id (defaults to the pattern's domain)." }),
+		priority: Flags.integer({ description: "Evaluation order within a scope; lower is checked first." }),
+		disabled: Flags.boolean({ description: "Create the route disabled." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(RoutesAddCommand);
+		const target = resolveCreateTarget(flags);
+		if ("error" in target) {
+			process.stderr.write(`${target.error}\n`);
+			process.exitCode = 1;
+			return;
+		}
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const result = await createRoute({
+				client: apiClient.client,
+				body: {
+					match_type: flags.match,
+					pattern: args.pattern,
+					...target,
+					...flags.domain ? { domain_id: flags.domain } : {},
+					...flags.priority != null ? { priority: flags.priority } : {},
+					...flags.disabled ? { enabled: false } : {}
+				},
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const payload = extractErrorPayload(result.error);
+				writeErrorWithHints(payload);
+				surfaceUnauthorizedHint({
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir,
+					payload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			this.log(JSON.stringify(result.data.data, null, 2));
+		});
+	}
+};
+//#endregion
+//#region src/oclif/commands/routes-list.ts
+var RoutesListCommand = class RoutesListCommand extends Command {
+	static description = "List the org's recipient routes in evaluation order.";
+	static summary = "List recipient routes";
+	static examples = ["<%= config.bin %> routes list"];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(RoutesListCommand);
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const result = await listRoutes({
+				client: apiClient.client,
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const payload = extractErrorPayload(result.error);
+				writeErrorWithHints(payload);
+				surfaceUnauthorizedHint({
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir,
+					payload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			this.log(JSON.stringify(result.data.data, null, 2));
+		});
+	}
+};
+//#endregion
+//#region src/oclif/commands/routes-remove.ts
+var RoutesRemoveCommand = class RoutesRemoveCommand extends Command {
+	static description = "Delete a recipient route by id. Mail matching its pattern then falls back to the domain or organization default.";
+	static summary = "Remove a recipient route";
+	static examples = ["<%= config.bin %> routes remove <route-id>"];
+	static args = { id: Args.string({
+		description: "Route id (UUID) to delete.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { args, flags } = await this.parse(RoutesRemoveCommand);
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const result = await deleteRoute({
+				client: apiClient.client,
+				path: { id: args.id },
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const payload = extractErrorPayload(result.error);
+				writeErrorWithHints(payload);
+				surfaceUnauthorizedHint({
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir,
+					payload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			this.log(JSON.stringify(result.data.data, null, 2));
+		});
+	}
+};
+//#endregion
+//#region src/oclif/commands/routes-reorder.ts
+function parseReorderUpdates(set) {
+	const updates = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const pair of set) {
+		const eq = pair.lastIndexOf("=");
+		const id = (eq >= 0 ? pair.slice(0, eq).trim() : "").toLowerCase();
+		const priority = eq >= 0 ? Number(pair.slice(eq + 1).trim()) : NaN;
+		if (!id || !Number.isInteger(priority) || priority < 0) return { error: `Invalid --set value "${pair}"; expected <route-id>=<priority> with a non-negative integer priority.` };
+		if (seen.has(id)) return { error: `Route ${id} appears more than once in --set; specify each route at most once.` };
+		seen.add(id);
+		updates.push({
+			id,
+			priority
+		});
+	}
+	return { updates };
+}
+var RoutesReorderCommand = class RoutesReorderCommand extends Command {
+	static description = `Set the priority of one or more recipient routes in a single call.
+
+  Priority controls evaluation order within a scope; lower is checked first.
+  Pass --set <route-id>=<priority> once per route you want to move.`;
+	static summary = "Reorder recipient routes";
+	static examples = ["<%= config.bin %> routes reorder --set <route-id>=10", "<%= config.bin %> routes reorder --set <id-a>=10 --set <id-b>=20"];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION }),
+		set: Flags.string({
+			description: "A route and its new priority as <route-id>=<priority>. Repeatable.",
+			multiple: true,
+			required: true
+		})
+	};
+	async run() {
+		const { flags } = await this.parse(RoutesReorderCommand);
+		const parsed = parseReorderUpdates(flags.set);
+		if ("error" in parsed) {
+			process.stderr.write(`${parsed.error}\n`);
+			process.exitCode = 1;
+			return;
+		}
+		const { updates } = parsed;
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const result = await reorderRoutes({
+				client: apiClient.client,
+				body: { updates },
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const payload = extractErrorPayload(result.error);
+				writeErrorWithHints(payload);
+				surfaceUnauthorizedHint({
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir,
+					payload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			this.log(JSON.stringify(result.data.data, null, 2));
+		});
+	}
+};
+//#endregion
+//#region src/oclif/commands/routes-test.ts
+var RoutesTestCommand = class RoutesTestCommand extends Command {
+	static description = `Simulate routing for a recipient address.
+
+  Shows the resolved destination and a trace of every rule evaluated (which
+  matched or missed, and why). Does not create or change anything.`;
+	static summary = "Simulate routing for a recipient";
+	static examples = ["<%= config.bin %> routes test alice@acme.com", "<%= config.bin %> routes test bounce@acme.com --event-type email.bounced"];
+	static args = { recipient: Args.string({
+		description: "Recipient address to simulate (e.g. alice@acme.com).",
+		required: true
+	}) };
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION }),
+		"event-type": Flags.string({ description: "Event type to model (defaults to email.received)." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(RoutesTestCommand);
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const result = await simulateRoute({
+				client: apiClient.client,
+				body: {
+					recipient: args.recipient,
+					...flags["event-type"] ? { event_type: flags["event-type"] } : {}
+				},
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const payload = extractErrorPayload(result.error);
+				writeErrorWithHints(payload);
+				surfaceUnauthorizedHint({
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir,
+					payload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			this.log(JSON.stringify(result.data.data, null, 2));
+		});
+	}
+};
+//#endregion
+//#region src/oclif/commands/routes-update.ts
+function buildUpdateBody(flags) {
+	return {
+		...flags.match ? { match_type: flags.match } : {},
+		...flags.pattern ? { pattern: flags.pattern } : {},
+		...flags.endpoint ? { endpoint_id: flags.endpoint } : {},
+		...flags.domain ? { domain_id: flags.domain } : {},
+		...flags.priority != null ? { priority: flags.priority } : {},
+		...flags.enable ? { enabled: true } : {},
+		...flags.disable ? { enabled: false } : {}
+	};
+}
+var RoutesUpdateCommand = class RoutesUpdateCommand extends Command {
+	static description = `Update an existing recipient route.
+
+  Change the pattern, match type, target endpoint, domain scope, priority, or
+  enabled state. Provide at least one field; anything omitted is left as-is.`;
+	static summary = "Update a recipient route";
+	static examples = [
+		"<%= config.bin %> routes update <route-id> --priority 5",
+		"<%= config.bin %> routes update <route-id> --pattern alice@acme.com",
+		"<%= config.bin %> routes update <route-id> --disable"
+	];
+	static args = { id: Args.string({
+		description: "Route id (UUID) to update.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION }),
+		match: Flags.string({
+			description: "New match type for the pattern.",
+			options: [
+				"exact",
+				"wildcard",
+				"regex"
+			]
+		}),
+		pattern: Flags.string({ description: "New recipient address or wildcard pattern." }),
+		endpoint: Flags.string({ description: "New target endpoint id (UUID)." }),
+		domain: Flags.string({ description: "New domain scope id (UUID)." }),
+		priority: Flags.integer({ description: "New evaluation priority within a scope; lower is checked first." }),
+		enable: Flags.boolean({
+			description: "Enable the route.",
+			exclusive: ["disable"]
+		}),
+		disable: Flags.boolean({
+			description: "Disable the route.",
+			exclusive: ["enable"]
+		})
+	};
+	async run() {
+		const { args, flags } = await this.parse(RoutesUpdateCommand);
+		const body = buildUpdateBody(flags);
+		if (Object.keys(body).length === 0) {
+			process.stderr.write("Provide at least one field to update (--match, --pattern, --endpoint, --domain, --priority, --enable/--disable).\n");
+			process.exitCode = 1;
+			return;
+		}
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const result = await updateRoute({
+				client: apiClient.client,
+				path: { id: args.id },
+				body,
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				const payload = extractErrorPayload(result.error);
+				writeErrorWithHints(payload);
+				surfaceUnauthorizedHint({
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir,
+					payload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			this.log(JSON.stringify(result.data.data, null, 2));
+		});
+	}
+};
+//#endregion
 //#region src/oclif/commands/semantic-search.ts
 const DEFAULT_LIMIT$1 = 10;
 const MAX_LIMIT$1 = 100;
@@ -30481,6 +30937,12 @@ const COMMANDS = {
 	"functions:route-unset": FunctionsRouteUnsetCommand,
 	"functions:route-get": FunctionsRouteGetCommand,
 	"functions:routing-topology": FunctionsRoutingTopologyCommand,
+	"routes:add": RoutesAddCommand,
+	"routes:list": RoutesListCommand,
+	"routes:test": RoutesTestCommand,
+	"routes:update": RoutesUpdateCommand,
+	"routes:reorder": RoutesReorderCommand,
+	"routes:remove": RoutesRemoveCommand,
 	...Object.fromEntries(Object.entries(CANONICAL_OPERATION_ALIASES).map(([alias, target]) => {
 		const command = generatedCommands[target];
 		if (!command) throw new Error(`Missing generated command target for alias ${alias}`);

package/dist/oclif/root-signup-hint.js

@@ -1,4 +1,4 @@
-import { c as resolveConfigEnvironment, i as loadCliConfig, x as normalizeApiBaseUrl } from "../cli-config-B5hrwe8q.js";
+import { S as normalizeApiBaseUrl, c as resolveConfigEnvironment, i as loadCliConfig } from "../cli-config-C-7V83Qd.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.14.1",
+  "version": "1.14.3",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,