primcli 1.17.0 → 1.19.0

package/dist/{cli-config-C-7V83Qd.js → cli-config-BKso8oJu.js}

@@ -322,8 +322,8 @@ const checkForExistence = (options, name) => {
 	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
 	return false;
 };
-const setAuthParams = async ({ security, ...options }) => {
-	for (const auth of security) {
+async function setAuthParams(options) {
+	for (const auth of options.security ?? []) {
 		if (checkForExistence(options, auth.name)) continue;
 		const token = await getAuthToken(auth, options.auth);
 		if (!token) continue;
@@ -341,7 +341,7 @@ const setAuthParams = async ({ security, ...options }) => {
 				break;
 		}
 	}
-};
+}
 const buildUrl = (options) => getUrl({
 	baseUrl: options.baseUrl,
 	path: options.path,
@@ -448,10 +448,7 @@ const createClient = (config = {}) => {
 			headers: mergeHeaders(_config.headers, options.headers),
 			serializedBody: void 0
 		};
-		if (opts.security) await setAuthParams({
-			...opts,
-			security: opts.security
-		});
+		if (opts.security) await setAuthParams(opts);
 		if (opts.requestValidator) await opts.requestValidator(opts);
 		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
 		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
@@ -462,100 +459,95 @@ const createClient = (config = {}) => {
 		};
 	};
 	const request = async (options) => {
-		const { opts, url } = await beforeRequest(options);
-		const requestInit = {
-			redirect: "follow",
-			...opts,
-			body: getValidRequestBody(opts)
-		};
-		let request = new Request(url, requestInit);
-		for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
-		const _fetch = opts.fetch;
+		const throwOnError = options.throwOnError ?? _config.throwOnError;
+		const responseStyle = options.responseStyle ?? _config.responseStyle;
+		let request;
 		let response;
 		try {
+			const { opts, url } = await beforeRequest(options);
+			const requestInit = {
+				redirect: "follow",
+				...opts,
+				body: getValidRequestBody(opts)
+			};
+			request = new Request(url, requestInit);
+			for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+			const _fetch = opts.fetch;
 			response = await _fetch(request);
-		} catch (error) {
-			let finalError = error;
-			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(error, void 0, request, opts);
-			finalError = finalError || {};
-			if (opts.throwOnError) throw finalError;
-			return opts.responseStyle === "data" ? void 0 : {
-				error: finalError,
+			for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+			const result = {
 				request,
-				response: void 0
+				response
 			};
-		}
-		for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
-		const result = {
-			request,
-			response
-		};
-		if (response.ok) {
-			const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
-			if (response.status === 204 || response.headers.get("Content-Length") === "0") {
-				let emptyData;
+			if (response.ok) {
+				const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+				if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+					let emptyData;
+					switch (parseAs) {
+						case "arrayBuffer":
+						case "blob":
+						case "text":
+							emptyData = await response[parseAs]();
+							break;
+						case "formData":
+							emptyData = new FormData();
+							break;
+						case "stream":
+							emptyData = response.body;
+							break;
+						default:
+							emptyData = {};
+							break;
+					}
+					return opts.responseStyle === "data" ? emptyData : {
+						data: emptyData,
+						...result
+					};
+				}
+				let data;
 				switch (parseAs) {
 					case "arrayBuffer":
 					case "blob":
-					case "text":
-						emptyData = await response[parseAs]();
-						break;
 					case "formData":
-						emptyData = new FormData();
-						break;
-					case "stream":
-						emptyData = response.body;
+					case "text":
+						data = await response[parseAs]();
 						break;
-					default:
-						emptyData = {};
+					case "json": {
+						const text = await response.text();
+						data = text ? JSON.parse(text) : {};
 						break;
+					}
+					case "stream": return opts.responseStyle === "data" ? response.body : {
+						data: response.body,
+						...result
+					};
 				}
-				return opts.responseStyle === "data" ? emptyData : {
-					data: emptyData,
-					...result
-				};
-			}
-			let data;
-			switch (parseAs) {
-				case "arrayBuffer":
-				case "blob":
-				case "formData":
-				case "text":
-					data = await response[parseAs]();
-					break;
-				case "json": {
-					const text = await response.text();
-					data = text ? JSON.parse(text) : {};
-					break;
+				if (parseAs === "json") {
+					if (opts.responseValidator) await opts.responseValidator(data);
+					if (opts.responseTransformer) data = await opts.responseTransformer(data);
 				}
-				case "stream": return opts.responseStyle === "data" ? response.body : {
-					data: response.body,
+				return opts.responseStyle === "data" ? data : {
+					data,
 					...result
 				};
 			}
-			if (parseAs === "json") {
-				if (opts.responseValidator) await opts.responseValidator(data);
-				if (opts.responseTransformer) data = await opts.responseTransformer(data);
-			}
-			return opts.responseStyle === "data" ? data : {
-				data,
-				...result
+			const textError = await response.text();
+			let jsonError;
+			try {
+				jsonError = JSON.parse(textError);
+			} catch {}
+			throw jsonError ?? textError;
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(finalError, response, request, options);
+			finalError = finalError || {};
+			if (throwOnError) throw finalError;
+			return responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response
 			};
 		}
-		const textError = await response.text();
-		let jsonError;
-		try {
-			jsonError = JSON.parse(textError);
-		} catch {}
-		const error = jsonError ?? textError;
-		let finalError = error;
-		for (const fn of interceptors.error.fns) if (fn) finalError = await fn(error, response, request, opts);
-		finalError = finalError || {};
-		if (opts.throwOnError) throw finalError;
-		return opts.responseStyle === "data" ? void 0 : {
-			error: finalError,
-			...result
-		};
 	};
 	const makeMethodFn = (method) => (options) => request({
 		...options,
@@ -566,7 +558,6 @@ const createClient = (config = {}) => {
 		return createSseClient({
 			...opts,
 			body: opts.body,
-			headers: opts.headers,
 			method,
 			onRequest: async (url, init) => {
 				let request = new Request(url, init);

package/dist/oclif/index.js

@@ -1,4 +1,4 @@
-import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient, N as createConfig, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-C-7V83Qd.js";
+import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient, N as createConfig, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-BKso8oJu.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
 import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { randomUUID } from "node:crypto";
@@ -22242,6 +22242,31 @@ const operationManifest = [
 	}
 ];
 //#endregion
+//#region ../packages/api-core/src/memories.ts
+function isPlainJsonObject(value) {
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+function isMemoryJsonValue(value, seen = /* @__PURE__ */ new Set()) {
+	if (value === null) return true;
+	if (typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (typeof value !== "object") return false;
+	if (seen.has(value)) return false;
+	seen.add(value);
+	try {
+		if (Array.isArray(value)) {
+			for (let index = 0; index < value.length; index += 1) if (!(index in value) || !isMemoryJsonValue(value[index], seen)) return false;
+			return true;
+		}
+		if (!isPlainJsonObject(value)) return false;
+		for (const nested of Object.values(value)) if (!isMemoryJsonValue(nested, seen)) return false;
+		return true;
+	} finally {
+		seen.delete(value);
+	}
+}
+//#endregion
 //#region src/oclif/api-client.ts
 const API_HEADERS_ENV = "PRIMITIVE_API_HEADERS";
 const OAUTH_REFRESH_SKEW_MS = 60 * 1e3;
@@ -26542,8 +26567,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.17.0";
-const CLI_VERSION_RANGE = "^1.17.0";
+const SDK_VERSION_RANGE = "^1.19.0";
+const CLI_VERSION_RANGE = "^1.19.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -26645,6 +26670,14 @@ function inboundRecipientDomains(event: EmailReceivedEvent): Set<string> {
 //   - Track Message-ID / In-Reply-To chains to break ping-pong loops
 //     between two cooperating handlers on different domains.
 //   - Rate-limit replies per sender per hour as a safety net.
+//
+// Loop protection is NOT sender authentication. The address matching
+// here is deliberately loose (it exists to avoid replying to our own
+// mail, where a false positive just drops one reply). If your handler
+// gates any privileged action on WHO sent the email, do not reuse this
+// logic or regex the From header yourself; use isTrustedSender from
+// "@primitivedotdev/sdk/api", which anchors the DMARC verdict to your
+// expected domain and strict-parses the From header.
 export function isLoop(event: EmailReceivedEvent): boolean {
   // RFC 5321: bounce notifications use the null MAIL FROM (envelope
   // sender = empty string). Some MTAs report this as "<>" verbatim.
@@ -29689,6 +29722,7 @@ var LogoutCommand = class LogoutCommand extends Command {
 };
 //#endregion
 //#region src/oclif/commands/memories.ts
+var MemoryCliInputError = class extends Error {};
 const API_KEY_FLAG = Flags.string({
 	description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 	env: "PRIMITIVE_API_KEY"
@@ -29721,11 +29755,27 @@ function printData(command, responseData) {
 	const data = responseData?.data ?? null;
 	command.log(JSON.stringify(data, null, 2));
 }
+function handleMemoryInputError(error) {
+	if (!(error instanceof MemoryCliInputError)) return false;
+	process.stderr.write(`${error.message}\n`);
+	process.exitCode = 1;
+	return true;
+}
+function nonEmptyFlag(value, name) {
+	if (value === void 0) return void 0;
+	if (value.trim().length === 0) throw new MemoryCliInputError(`${name} must be a non-empty string.`);
+	return value;
+}
 function parseMemoryJson(source, label = "value") {
 	try {
+		const value = JSON.parse(source);
+		if (!isMemoryJsonValue(value)) return {
+			kind: "error",
+			message: `${label} must be valid JSON. Numbers must be finite, arrays must not be sparse, and values may not contain undefined, bigint, symbol, function, class instance, or cyclic entries.`
+		};
 		return {
 			kind: "ok",
-			value: JSON.parse(source)
+			value
 		};
 	} catch (error) {
 		return {
@@ -29762,31 +29812,63 @@ function resolveMemoryValueSource(input) {
 	};
 }
 function memoryScopeForBody(flags) {
-	if (flags.function) return {
+	const functionId = nonEmptyFlag(flags.function, "--function");
+	if (functionId !== void 0) return {
 		type: "function",
-		id: flags.function
+		id: functionId
 	};
 	if (flags.org) return { type: "org" };
 }
 function memoryScopeForQuery(flags) {
-	if (flags.function) return {
+	const functionId = nonEmptyFlag(flags.function, "--function");
+	if (functionId !== void 0) return {
 		scope_type: "function",
-		scope_id: flags.function
+		scope_id: functionId
 	};
 	if (flags.org) return { scope_type: "org" };
 	return {};
 }
 function buildSetMemoryInput(params) {
 	const scope = memoryScopeForBody(params.flags);
+	const expiresAt = nonEmptyFlag(params.flags["expires-at"], "--expires-at");
+	const ifVersion = nonEmptyFlag(params.flags["if-version"], "--if-version");
 	return {
 		key: params.key,
 		value: params.value,
 		...scope ? { scope } : {},
 		...params.flags["ttl-seconds"] !== void 0 ? { ttl_seconds: params.flags["ttl-seconds"] } : {},
-		...params.flags["expires-at"] ? { expires_at: params.flags["expires-at"] } : {},
+		...expiresAt !== void 0 ? { expires_at: expiresAt } : {},
 		...params.flags["clear-ttl"] ? { clear_ttl: true } : {},
 		...params.flags["if-absent"] ? { if_absent: true } : {},
-		...params.flags["if-version"] ? { if_version: params.flags["if-version"] } : {}
+		...ifVersion !== void 0 ? { if_version: ifVersion } : {}
+	};
+}
+function buildGetMemoryQuery(params) {
+	return {
+		key: params.key,
+		...memoryScopeForQuery(params.flags)
+	};
+}
+function buildDeleteMemoryQuery(params) {
+	const ifVersion = nonEmptyFlag(params.flags["if-version"], "--if-version");
+	return {
+		key: params.key,
+		...memoryScopeForQuery(params.flags),
+		...ifVersion !== void 0 ? { if_version: ifVersion } : {}
+	};
+}
+function buildSearchMemoriesQuery(params) {
+	const cursor = nonEmptyFlag(params.flags.cursor, "--cursor");
+	const updatedAfter = nonEmptyFlag(params.flags["updated-after"], "--updated-after");
+	const updatedBefore = nonEmptyFlag(params.flags["updated-before"], "--updated-before");
+	return {
+		...params.prefix !== void 0 ? { prefix: params.prefix } : {},
+		limit: params.flags.limit,
+		...cursor !== void 0 ? { cursor } : {},
+		...params.flags["metadata-only"] ? { include_value: "false" } : {},
+		...updatedAfter !== void 0 ? { updated_after: updatedAfter } : {},
+		...updatedBefore !== void 0 ? { updated_before: updatedBefore } : {},
+		...memoryScopeForQuery(params.flags)
 	};
 }
 var MemoriesSetCommand = class MemoriesSetCommand extends Command {
@@ -29857,6 +29939,17 @@ var MemoriesSetCommand = class MemoriesSetCommand extends Command {
 			process.exitCode = 1;
 			return;
 		}
+		let body;
+		try {
+			body = buildSetMemoryInput({
+				key: args.key,
+				value: parsed.value,
+				flags
+			});
+		} catch (error) {
+			if (handleMemoryInputError(error)) return;
+			throw error;
+		}
 		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
 			apiKey: flags["api-key"],
 			apiBaseUrl: flags["api-base-url"],
@@ -29865,11 +29958,7 @@ var MemoriesSetCommand = class MemoriesSetCommand extends Command {
 		await runWithTiming(flags.time, async () => {
 			const result = await setMemory({
 				client: apiClient.client,
-				body: buildSetMemoryInput({
-					key: args.key,
-					value: parsed.value,
-					flags
-				}),
+				body,
 				responseStyle: "fields"
 			});
 			if (result.error) {
@@ -29903,6 +29992,16 @@ var MemoriesGetCommand = class MemoriesGetCommand extends Command {
 	};
 	async run() {
 		const { args, flags } = await this.parse(MemoriesGetCommand);
+		let query;
+		try {
+			query = buildGetMemoryQuery({
+				key: args.key,
+				flags
+			});
+		} catch (error) {
+			if (handleMemoryInputError(error)) return;
+			throw error;
+		}
 		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
 			apiKey: flags["api-key"],
 			apiBaseUrl: flags["api-base-url"],
@@ -29911,10 +30010,7 @@ var MemoriesGetCommand = class MemoriesGetCommand extends Command {
 		await runWithTiming(flags.time, async () => {
 			const result = await getMemory({
 				client: apiClient.client,
-				query: {
-					key: args.key,
-					...memoryScopeForQuery(flags)
-				},
+				query,
 				responseStyle: "fields"
 			});
 			if (result.error) {
@@ -29950,6 +30046,16 @@ var MemoriesDeleteCommand = class MemoriesDeleteCommand extends Command {
 	};
 	async run() {
 		const { args, flags } = await this.parse(MemoriesDeleteCommand);
+		let query;
+		try {
+			query = buildDeleteMemoryQuery({
+				key: args.key,
+				flags
+			});
+		} catch (error) {
+			if (handleMemoryInputError(error)) return;
+			throw error;
+		}
 		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
 			apiKey: flags["api-key"],
 			apiBaseUrl: flags["api-base-url"],
@@ -29958,11 +30064,7 @@ var MemoriesDeleteCommand = class MemoriesDeleteCommand extends Command {
 		await runWithTiming(flags.time, async () => {
 			const result = await deleteMemory({
 				client: apiClient.client,
-				query: {
-					key: args.key,
-					...memoryScopeForQuery(flags),
-					...flags["if-version"] ? { if_version: flags["if-version"] } : {}
-				},
+				query,
 				responseStyle: "fields"
 			});
 			if (result.error) {
@@ -30007,6 +30109,16 @@ var MemoriesSearchCommand = class MemoriesSearchCommand extends Command {
 	};
 	async run() {
 		const { args, flags } = await this.parse(MemoriesSearchCommand);
+		let query;
+		try {
+			query = buildSearchMemoriesQuery({
+				prefix: args.prefix,
+				flags
+			});
+		} catch (error) {
+			if (handleMemoryInputError(error)) return;
+			throw error;
+		}
 		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
 			apiKey: flags["api-key"],
 			apiBaseUrl: flags["api-base-url"],
@@ -30015,15 +30127,7 @@ var MemoriesSearchCommand = class MemoriesSearchCommand extends Command {
 		await runWithTiming(flags.time, async () => {
 			const result = await searchMemories({
 				client: apiClient.client,
-				query: {
-					...args.prefix !== void 0 ? { prefix: args.prefix } : {},
-					limit: flags.limit,
-					...flags.cursor ? { cursor: flags.cursor } : {},
-					...flags["metadata-only"] ? { include_value: "false" } : {},
-					...flags["updated-after"] ? { updated_after: flags["updated-after"] } : {},
-					...flags["updated-before"] ? { updated_before: flags["updated-before"] } : {},
-					...memoryScopeForQuery(flags)
-				},
+				query,
 				responseStyle: "fields"
 			});
 			if (result.error) {

package/dist/oclif/root-signup-hint.js

@@ -1,4 +1,4 @@
-import { S as normalizeApiBaseUrl, c as resolveConfigEnvironment, i as loadCliConfig } from "../cli-config-C-7V83Qd.js";
+import { S as normalizeApiBaseUrl, c as resolveConfigEnvironment, i as loadCliConfig } from "../cli-config-BKso8oJu.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";

package/man/primitive.1

@@ -77,6 +77,15 @@ Scaffold a Primitive Function.
 .B primitive functions deploy --name NAME --file PATH
 Deploy a Primitive Function bundle.
 .TP
+.B primitive memories set KEY JSON
+Store a durable JSON memory.
+.TP
+.B primitive memories get KEY
+Read a durable memory by key.
+.TP
+.B primitive memories search PREFIX
+List memories by key prefix.
+.TP
 .B primitive list-operations
 Print the generated API operation manifest.
 .TP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.17.0",
+  "version": "1.19.0",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,