primcli 1.18.0 → 1.19.0

package/dist/{cli-config-C-7V83Qd.js → cli-config-BKso8oJu.js}

@@ -322,8 +322,8 @@ const checkForExistence = (options, name) => {
 	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
 	return false;
 };
-const setAuthParams = async ({ security, ...options }) => {
-	for (const auth of security) {
+async function setAuthParams(options) {
+	for (const auth of options.security ?? []) {
 		if (checkForExistence(options, auth.name)) continue;
 		const token = await getAuthToken(auth, options.auth);
 		if (!token) continue;
@@ -341,7 +341,7 @@ const setAuthParams = async ({ security, ...options }) => {
 				break;
 		}
 	}
-};
+}
 const buildUrl = (options) => getUrl({
 	baseUrl: options.baseUrl,
 	path: options.path,
@@ -448,10 +448,7 @@ const createClient = (config = {}) => {
 			headers: mergeHeaders(_config.headers, options.headers),
 			serializedBody: void 0
 		};
-		if (opts.security) await setAuthParams({
-			...opts,
-			security: opts.security
-		});
+		if (opts.security) await setAuthParams(opts);
 		if (opts.requestValidator) await opts.requestValidator(opts);
 		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
 		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
@@ -462,100 +459,95 @@ const createClient = (config = {}) => {
 		};
 	};
 	const request = async (options) => {
-		const { opts, url } = await beforeRequest(options);
-		const requestInit = {
-			redirect: "follow",
-			...opts,
-			body: getValidRequestBody(opts)
-		};
-		let request = new Request(url, requestInit);
-		for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
-		const _fetch = opts.fetch;
+		const throwOnError = options.throwOnError ?? _config.throwOnError;
+		const responseStyle = options.responseStyle ?? _config.responseStyle;
+		let request;
 		let response;
 		try {
+			const { opts, url } = await beforeRequest(options);
+			const requestInit = {
+				redirect: "follow",
+				...opts,
+				body: getValidRequestBody(opts)
+			};
+			request = new Request(url, requestInit);
+			for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+			const _fetch = opts.fetch;
 			response = await _fetch(request);
-		} catch (error) {
-			let finalError = error;
-			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(error, void 0, request, opts);
-			finalError = finalError || {};
-			if (opts.throwOnError) throw finalError;
-			return opts.responseStyle === "data" ? void 0 : {
-				error: finalError,
+			for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+			const result = {
 				request,
-				response: void 0
+				response
 			};
-		}
-		for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
-		const result = {
-			request,
-			response
-		};
-		if (response.ok) {
-			const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
-			if (response.status === 204 || response.headers.get("Content-Length") === "0") {
-				let emptyData;
+			if (response.ok) {
+				const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+				if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+					let emptyData;
+					switch (parseAs) {
+						case "arrayBuffer":
+						case "blob":
+						case "text":
+							emptyData = await response[parseAs]();
+							break;
+						case "formData":
+							emptyData = new FormData();
+							break;
+						case "stream":
+							emptyData = response.body;
+							break;
+						default:
+							emptyData = {};
+							break;
+					}
+					return opts.responseStyle === "data" ? emptyData : {
+						data: emptyData,
+						...result
+					};
+				}
+				let data;
 				switch (parseAs) {
 					case "arrayBuffer":
 					case "blob":
-					case "text":
-						emptyData = await response[parseAs]();
-						break;
 					case "formData":
-						emptyData = new FormData();
-						break;
-					case "stream":
-						emptyData = response.body;
+					case "text":
+						data = await response[parseAs]();
 						break;
-					default:
-						emptyData = {};
+					case "json": {
+						const text = await response.text();
+						data = text ? JSON.parse(text) : {};
 						break;
+					}
+					case "stream": return opts.responseStyle === "data" ? response.body : {
+						data: response.body,
+						...result
+					};
 				}
-				return opts.responseStyle === "data" ? emptyData : {
-					data: emptyData,
-					...result
-				};
-			}
-			let data;
-			switch (parseAs) {
-				case "arrayBuffer":
-				case "blob":
-				case "formData":
-				case "text":
-					data = await response[parseAs]();
-					break;
-				case "json": {
-					const text = await response.text();
-					data = text ? JSON.parse(text) : {};
-					break;
+				if (parseAs === "json") {
+					if (opts.responseValidator) await opts.responseValidator(data);
+					if (opts.responseTransformer) data = await opts.responseTransformer(data);
 				}
-				case "stream": return opts.responseStyle === "data" ? response.body : {
-					data: response.body,
+				return opts.responseStyle === "data" ? data : {
+					data,
 					...result
 				};
 			}
-			if (parseAs === "json") {
-				if (opts.responseValidator) await opts.responseValidator(data);
-				if (opts.responseTransformer) data = await opts.responseTransformer(data);
-			}
-			return opts.responseStyle === "data" ? data : {
-				data,
-				...result
+			const textError = await response.text();
+			let jsonError;
+			try {
+				jsonError = JSON.parse(textError);
+			} catch {}
+			throw jsonError ?? textError;
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(finalError, response, request, options);
+			finalError = finalError || {};
+			if (throwOnError) throw finalError;
+			return responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response
 			};
 		}
-		const textError = await response.text();
-		let jsonError;
-		try {
-			jsonError = JSON.parse(textError);
-		} catch {}
-		const error = jsonError ?? textError;
-		let finalError = error;
-		for (const fn of interceptors.error.fns) if (fn) finalError = await fn(error, response, request, opts);
-		finalError = finalError || {};
-		if (opts.throwOnError) throw finalError;
-		return opts.responseStyle === "data" ? void 0 : {
-			error: finalError,
-			...result
-		};
 	};
 	const makeMethodFn = (method) => (options) => request({
 		...options,
@@ -566,7 +558,6 @@ const createClient = (config = {}) => {
 		return createSseClient({
 			...opts,
 			body: opts.body,
-			headers: opts.headers,
 			method,
 			onRequest: async (url, init) => {
 				let request = new Request(url, init);

package/dist/oclif/index.js

@@ -1,4 +1,4 @@
-import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient, N as createConfig, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-C-7V83Qd.js";
+import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient, N as createConfig, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-BKso8oJu.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
 import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { randomUUID } from "node:crypto";
@@ -26567,8 +26567,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.18.0";
-const CLI_VERSION_RANGE = "^1.18.0";
+const SDK_VERSION_RANGE = "^1.19.0";
+const CLI_VERSION_RANGE = "^1.19.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -26670,6 +26670,14 @@ function inboundRecipientDomains(event: EmailReceivedEvent): Set<string> {
 //   - Track Message-ID / In-Reply-To chains to break ping-pong loops
 //     between two cooperating handlers on different domains.
 //   - Rate-limit replies per sender per hour as a safety net.
+//
+// Loop protection is NOT sender authentication. The address matching
+// here is deliberately loose (it exists to avoid replying to our own
+// mail, where a false positive just drops one reply). If your handler
+// gates any privileged action on WHO sent the email, do not reuse this
+// logic or regex the From header yourself; use isTrustedSender from
+// "@primitivedotdev/sdk/api", which anchors the DMARC verdict to your
+// expected domain and strict-parses the From header.
 export function isLoop(event: EmailReceivedEvent): boolean {
   // RFC 5321: bounce notifications use the null MAIL FROM (envelope
   // sender = empty string). Some MTAs report this as "<>" verbatim.

package/dist/oclif/root-signup-hint.js

@@ -1,4 +1,4 @@
-import { S as normalizeApiBaseUrl, c as resolveConfigEnvironment, i as loadCliConfig } from "../cli-config-C-7V83Qd.js";
+import { S as normalizeApiBaseUrl, c as resolveConfigEnvironment, i as loadCliConfig } from "../cli-config-BKso8oJu.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,