primcli 1.19.0 → 1.21.0

package/dist/oclif/index.js

@@ -1,12 +1,13 @@
 import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient, N as createConfig, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-BKso8oJu.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { chmodSync, closeSync, createWriteStream, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import path, { basename, dirname, join, relative, resolve, sep } from "node:path";
 import process$1 from "node:process";
 import { createInterface } from "node:readline/promises";
 import { hostname } from "node:os";
 import { spawn } from "node:child_process";
+import { open, rm, stat } from "node:fs/promises";
 import { gunzipSync } from "node:zlib";
 import { concat, getAddress, hexToBytes, keccak256, stringToBytes } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
@@ -76,9 +77,12 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getSentEmail: () => getSentEmail,
 	getSpendPolicy: () => getSpendPolicy,
 	getStorageStats: () => getStorageStats,
+	getTemplate: () => getTemplate,
+	getTemplateInstall: () => getTemplateInstall,
 	getThread: () => getThread,
 	getWakeSchedule: () => getWakeSchedule,
 	getWebhookSecret: () => getWebhookSecret,
+	installTemplate: () => installTemplate,
 	listDeclinedPayments: () => listDeclinedPayments,
 	listDeliveries: () => listDeliveries,
 	listDomains: () => listDomains,
@@ -95,6 +99,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	listRegistryRequests: () => listRegistryRequests,
 	listRoutes: () => listRoutes,
 	listSentEmails: () => listSentEmails,
+	listTemplates: () => listTemplates,
 	listWakeAuthorizations: () => listWakeAuthorizations,
 	listWakeDispatches: () => listWakeDispatches,
 	listWakeSchedules: () => listWakeSchedules,
@@ -2025,6 +2030,65 @@ const searchMemories = (options) => (options?.client ?? client).get({
 	...options
 });
 /**
+* List function templates
+*
+* List approved Function templates available for browsing and
+* installation. Results are cacheable and paginated with
+* `data.next_cursor`.
+*
+*/
+const listTemplates = (options) => (options?.client ?? client).get({
+	url: "/templates",
+	...options
+});
+/**
+* Get a function template
+*
+* Fetch one approved Function template by slug, including its manifest
+* snapshot and README. The stored source files used for install are not
+* returned.
+*
+*/
+const getTemplate = (options) => (options.client ?? client).get({
+	url: "/templates/{id}",
+	...options
+});
+/**
+* Install a function template
+*
+* Start a one-shot deploy of an approved deploy-mode Function template.
+* The response returns an install record immediately; poll
+* `GET /templates/installs/{id}` for progress.
+*
+*/
+const installTemplate = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/templates/{id}/install",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get template install status
+*
+* Fetch the current state of a template install. Reads may advance the
+* self-test phase when a reply effect has been observed.
+*
+*/
+const getTemplateInstall = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/templates/installs/{id}",
+	...options
+});
+/**
 * List payout addresses
 *
 * List your org's registered payout addresses, newest first.
@@ -2460,6 +2524,10 @@ const openapiDocument = {
 			"name": "Memories",
 			"description": "Durable org-scoped or function-scoped JSON key-value storage for\nagents and functions. Keys are caller-defined. Function scope is\nalways addressed by the function id UUID, not by function name.\n"
 		},
+		{
+			"name": "Templates",
+			"description": "Browse approved Function templates, install deploy-mode templates, and\npoll install progress.\n"
+		},
 		{
 			"name": "Registries",
 			"description": "The Agent Registry: ownable directories of agents, addressable by a\nregistry-scoped handle. A registry's publish policy (owner_only, request,\nor open) decides whether a publish lists immediately or pends owner\napproval. An agent is defined once with a globally unique,\nreachability-verified address, then published into any registry under a\nhandle. Discovery reads (list, resolve, get) are public for public\nregistries; managing a registry and moderating requests use the owner's\nAPI key.\n"
@@ -5285,6 +5353,167 @@ const openapiDocument = {
 				"429": { "$ref": "#/components/responses/RateLimited" }
 			}
 		} },
+		"/templates": { "get": {
+			"operationId": "listTemplates",
+			"summary": "List function templates",
+			"description": "List approved Function templates available for browsing and\ninstallation. Results are cacheable and paginated with\n`data.next_cursor`.\n",
+			"tags": ["Templates"],
+			"security": [],
+			"parameters": [
+				{
+					"name": "q",
+					"in": "query",
+					"required": false,
+					"description": "Search templates by title, summary, or slug.",
+					"schema": {
+						"type": "string",
+						"minLength": 1
+					}
+				},
+				{
+					"name": "tag",
+					"in": "query",
+					"required": false,
+					"description": "Filter templates by an exact tag.",
+					"schema": {
+						"type": "string",
+						"minLength": 1
+					}
+				},
+				{
+					"name": "cursor",
+					"in": "query",
+					"required": false,
+					"description": "Cursor from a previous response `data.next_cursor` value.",
+					"schema": { "type": "string" }
+				},
+				{
+					"name": "limit",
+					"in": "query",
+					"required": false,
+					"description": "Maximum number of templates to return. The server caps this at 100.",
+					"schema": {
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 100,
+						"default": 50
+					}
+				}
+			],
+			"responses": {
+				"200": {
+					"description": "Paginated template registry summaries",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/TemplateRegistryPage" } },
+						"required": ["data"]
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
+		"/templates/{id}": { "get": {
+			"operationId": "getTemplate",
+			"summary": "Get a function template",
+			"description": "Fetch one approved Function template by slug, including its manifest\nsnapshot and README. The stored source files used for install are not\nreturned.\n",
+			"tags": ["Templates"],
+			"security": [],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "Template slug from the template manifest.",
+				"schema": {
+					"type": "string",
+					"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$"
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Template registry detail",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/TemplateRegistryDetail" } },
+						"required": ["data"]
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"404": { "$ref": "#/components/responses/NotFound" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
+		"/templates/{id}/install": { "post": {
+			"operationId": "installTemplate",
+			"summary": "Install a function template",
+			"description": "Start a one-shot deploy of an approved deploy-mode Function template.\nThe response returns an install record immediately; poll\n`GET /templates/installs/{id}` for progress.\n",
+			"tags": ["Templates"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "Template slug from the template manifest.",
+				"schema": {
+					"type": "string",
+					"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$"
+				}
+			}],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/InstallTemplateBody" } } }
+			},
+			"responses": {
+				"201": {
+					"description": "Template install started",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/TemplateInstallStatus" } },
+						"required": ["data"]
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"404": { "$ref": "#/components/responses/NotFound" },
+				"409": { "$ref": "#/components/responses/Conflict" },
+				"422": { "$ref": "#/components/responses/UnprocessableEntity" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
+		"/templates/installs/{id}": { "get": {
+			"operationId": "getTemplateInstall",
+			"summary": "Get template install status",
+			"description": "Fetch the current state of a template install. Reads may advance the\nself-test phase when a reply effect has been observed.\n",
+			"tags": ["Templates"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "Template install UUID.",
+				"schema": {
+					"type": "string",
+					"format": "uuid",
+					"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Current template install status",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/TemplateInstallStatus" } },
+						"required": ["data"]
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"404": { "$ref": "#/components/responses/NotFound" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
 		"/x402/payout-addresses": {
 			"post": {
 				"operationId": "registerPayoutAddress",
@@ -6955,6 +7184,16 @@ const openapiDocument = {
 									"org_not_accessible",
 									"feature_disabled",
 									"memory_conflict",
+									"template_not_installable",
+									"scaffold_only",
+									"invalid_variables",
+									"unknown_secrets",
+									"missing_secrets",
+									"no_inbound_domain",
+									"domain_cannot_send",
+									"address_taken",
+									"route_cap_reached",
+									"name_exhausted",
 									"developer_usage_credit_exhausted",
 									"no_payout_address",
 									"ownership_proof_failed",
@@ -9003,6 +9242,40 @@ const openapiDocument = {
 				},
 				"required": ["filename", "content_base64"]
 			},
+			"SendMailPayloadRef": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "A reference to an already-uploaded Primitive Payloads object, delivered as an attachment without inlining the bytes — the way to send an attachment larger than the inline cap. Upload the object via /v1/payloads (with a client-held CEK the server never sees), then reference it here.",
+				"properties": {
+					"root": {
+						"type": "string",
+						"pattern": "^[0-9a-f]{64}$",
+						"description": "The 64-char lowercase-hex Merkle root of a finalized payloads object."
+					},
+					"filename": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 255,
+						"description": "Attachment filename presented to the recipient."
+					},
+					"content_type": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 255,
+						"description": "Optional MIME content type."
+					},
+					"cek": {
+						"type": "string",
+						"pattern": "^[A-Za-z0-9_-]{1,128}$",
+						"description": "Base64url-encoded (unpadded) content-encryption key the recipient uses to decrypt. Travels with the email; the object store only ever holds ciphertext."
+					}
+				},
+				"required": [
+					"root",
+					"filename",
+					"cek"
+				]
+			},
 			"SendMailInput": {
 				"type": "object",
 				"additionalProperties": false,
@@ -9057,6 +9330,12 @@ const openapiDocument = {
 						"description": "Inline attachments. Send requests with attachments to https://api.primitive.dev/v1/send-mail. Combined raw decoded attachment bytes must be at most 31457280.",
 						"items": { "$ref": "#/components/schemas/SendMailAttachment" }
 					},
+					"payload_attachments": {
+						"type": "array",
+						"maxItems": 1,
+						"description": "Deliver an already-uploaded Primitive Payloads object as an attachment by reference, without inlining the bytes — the way to send attachments larger than the inline cap. Upload the object via /v1/payloads (client-held CEK), then reference it here. v1 supports at most one.",
+						"items": { "$ref": "#/components/schemas/SendMailPayloadRef" }
+					},
 					"wait": {
 						"type": "boolean",
 						"description": "When true, wait for the first downstream SMTP delivery outcome before returning."
@@ -11697,6 +11976,476 @@ const openapiDocument = {
 					"key",
 					"scope"
 				]
+			},
+			"TemplateAuthor": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"id": {
+						"type": "string",
+						"minLength": 1
+					},
+					"name": {
+						"type": "string",
+						"minLength": 1
+					},
+					"url": {
+						"type": "string",
+						"format": "uri"
+					}
+				},
+				"required": ["id", "name"]
+			},
+			"TemplateSource": { "oneOf": [{
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"mode": {
+						"type": "string",
+						"const": "managed-build"
+					},
+					"dir": {
+						"type": "string",
+						"minLength": 1,
+						"default": "."
+					}
+				},
+				"required": ["mode", "dir"]
+			}, {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"mode": {
+						"type": "string",
+						"const": "bundle"
+					},
+					"file": {
+						"type": "string",
+						"minLength": 1
+					}
+				},
+				"required": ["mode", "file"]
+			}] },
+			"TemplateInstall": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"mode": {
+						"type": "string",
+						"enum": ["deploy", "scaffold"]
+					},
+					"editFiles": {
+						"type": "array",
+						"items": {
+							"type": "string",
+							"minLength": 1
+						}
+					},
+					"reason": {
+						"type": "string",
+						"default": ""
+					}
+				},
+				"required": [
+					"mode",
+					"editFiles",
+					"reason"
+				]
+			},
+			"TemplateSecret": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"key": {
+						"type": "string",
+						"pattern": "^[A-Z_][A-Z0-9_]*$"
+					},
+					"required": {
+						"type": "boolean",
+						"default": true
+					},
+					"description": { "type": "string" }
+				},
+				"required": ["key", "required"]
+			},
+			"TemplateSecretGroup": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"keys": {
+						"type": "array",
+						"minItems": 2,
+						"items": {
+							"type": "string",
+							"pattern": "^[A-Z_][A-Z0-9_]*$"
+						}
+					},
+					"min": {
+						"type": "integer",
+						"minimum": 1,
+						"default": 1
+					},
+					"description": { "type": "string" }
+				},
+				"required": ["keys", "min"]
+			},
+			"TemplateVariableValidation": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"pattern": {
+						"type": "string",
+						"minLength": 1
+					},
+					"maxLength": {
+						"type": "integer",
+						"minimum": 1
+					}
+				}
+			},
+			"TemplateVariable": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"key": {
+						"type": "string",
+						"minLength": 1
+					},
+					"prompt": {
+						"type": "string",
+						"minLength": 1
+					},
+					"default": { "type": "string" },
+					"file": {
+						"type": "string",
+						"minLength": 1
+					},
+					"type": {
+						"type": "string",
+						"enum": [
+							"string",
+							"select",
+							"url",
+							"email"
+						],
+						"default": "string"
+					},
+					"options": {
+						"type": "array",
+						"items": {
+							"type": "string",
+							"minLength": 1
+						}
+					},
+					"validation": { "$ref": "#/components/schemas/TemplateVariableValidation" }
+				},
+				"required": [
+					"key",
+					"prompt",
+					"type"
+				]
+			},
+			"TemplateSetup": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"agent": {
+						"type": "string",
+						"minLength": 1
+					},
+					"prompt": {
+						"type": "string",
+						"minLength": 1
+					},
+					"produces": {
+						"type": "array",
+						"items": {
+							"type": "string",
+							"minLength": 1
+						}
+					}
+				},
+				"required": [
+					"agent",
+					"prompt",
+					"produces"
+				]
+			},
+			"TemplateManifest": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"schemaVersion": {
+						"type": "integer",
+						"const": 1
+					},
+					"id": {
+						"type": "string",
+						"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+						"description": "Stable template slug from the manifest."
+					},
+					"title": {
+						"type": "string",
+						"minLength": 1
+					},
+					"summary": {
+						"type": "string",
+						"minLength": 1
+					},
+					"description": { "type": "string" },
+					"author": { "$ref": "#/components/schemas/TemplateAuthor" },
+					"tags": {
+						"type": "array",
+						"items": {
+							"type": "string",
+							"minLength": 1
+						}
+					},
+					"source": { "$ref": "#/components/schemas/TemplateSource" },
+					"install": { "$ref": "#/components/schemas/TemplateInstall" },
+					"secrets": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/TemplateSecret" }
+					},
+					"secretGroups": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/TemplateSecretGroup" }
+					},
+					"variables": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/TemplateVariable" }
+					},
+					"setup": { "$ref": "#/components/schemas/TemplateSetup" },
+					"postInstall": { "type": "string" }
+				},
+				"required": [
+					"schemaVersion",
+					"id",
+					"title",
+					"summary",
+					"author",
+					"tags",
+					"source",
+					"install",
+					"secrets",
+					"secretGroups",
+					"variables"
+				]
+			},
+			"TemplateRegistryStatus": {
+				"type": "string",
+				"enum": [
+					"pending",
+					"approved",
+					"rejected"
+				]
+			},
+			"TemplateRegistrySummary": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"slug": {
+						"type": "string",
+						"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+						"description": "Stable template slug used in template URLs and install commands."
+					},
+					"title": { "type": "string" },
+					"summary": { "type": "string" },
+					"author": { "$ref": "#/components/schemas/TemplateAuthor" },
+					"tags": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"verified": { "type": "boolean" },
+					"install_count": {
+						"type": "integer",
+						"minimum": 0
+					},
+					"github_repo": {
+						"type": "string",
+						"pattern": "^[A-Za-z0-9-]+/[A-Za-z0-9_.-]+$",
+						"description": "GitHub repository in owner/repo form."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"slug",
+					"title",
+					"summary",
+					"author",
+					"tags",
+					"verified",
+					"install_count",
+					"github_repo",
+					"created_at",
+					"updated_at"
+				]
+			},
+			"TemplateRegistryDetail": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"slug": {
+						"type": "string",
+						"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+						"description": "Stable template slug used in template URLs and install commands."
+					},
+					"title": { "type": "string" },
+					"summary": { "type": "string" },
+					"author": { "$ref": "#/components/schemas/TemplateAuthor" },
+					"tags": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"verified": { "type": "boolean" },
+					"install_count": {
+						"type": "integer",
+						"minimum": 0
+					},
+					"github_repo": {
+						"type": "string",
+						"pattern": "^[A-Za-z0-9-]+/[A-Za-z0-9_.-]+$",
+						"description": "GitHub repository in owner/repo form."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"description": { "type": ["string", "null"] },
+					"github_sha": { "type": "string" },
+					"github_path": { "type": ["string", "null"] },
+					"manifest": { "$ref": "#/components/schemas/TemplateManifest" },
+					"readme": { "type": ["string", "null"] },
+					"status": { "$ref": "#/components/schemas/TemplateRegistryStatus" }
+				},
+				"required": [
+					"id",
+					"slug",
+					"title",
+					"summary",
+					"author",
+					"tags",
+					"verified",
+					"install_count",
+					"github_repo",
+					"created_at",
+					"updated_at",
+					"description",
+					"github_sha",
+					"github_path",
+					"manifest",
+					"readme",
+					"status"
+				]
+			},
+			"TemplateRegistryPage": {
+				"type": "object",
+				"properties": {
+					"items": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/TemplateRegistrySummary" }
+					},
+					"next_cursor": {
+						"type": ["string", "null"],
+						"description": "Cursor to pass as the next `cursor` query value, or null when there are no more templates."
+					}
+				},
+				"required": ["items", "next_cursor"]
+			},
+			"InstallTemplateBody": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"address": {
+						"type": "string",
+						"pattern": "^[a-z0-9][a-z0-9._-]{0,63}$",
+						"description": "Localpart to claim on the selected inbound domain. Defaults to the template slug."
+					},
+					"domain": {
+						"type": "string",
+						"minLength": 3,
+						"description": "Org domain name to claim the address on. Defaults to the org's newest active domain."
+					},
+					"variables": {
+						"type": "object",
+						"additionalProperties": { "type": "string" },
+						"description": "Template variable values keyed by manifest variable key."
+					},
+					"secrets": {
+						"type": "object",
+						"additionalProperties": { "type": "string" },
+						"description": "Secret values keyed by manifest secret key."
+					}
+				}
+			},
+			"TemplateInstallState": {
+				"type": "string",
+				"enum": [
+					"deploying",
+					"connecting",
+					"bound",
+					"tested",
+					"deploy_failed",
+					"bind_failed",
+					"test_failed"
+				]
+			},
+			"TemplateInstallStatus": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"template_slug": {
+						"type": "string",
+						"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+						"description": "Template slug for this install."
+					},
+					"state": { "$ref": "#/components/schemas/TemplateInstallState" },
+					"address": { "type": ["string", "null"] },
+					"function_id": {
+						"type": ["string", "null"],
+						"format": "uuid"
+					},
+					"error": { "type": ["string", "null"] },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"template_slug",
+					"state",
+					"address",
+					"function_id",
+					"error",
+					"created_at",
+					"updated_at"
+				]
 			}
 		}
 	}
@@ -21124,6 +21873,45 @@ const operationManifest = [
 						"required": ["filename", "content_base64"]
 					}
 				},
+				"payload_attachments": {
+					"type": "array",
+					"maxItems": 1,
+					"description": "Deliver an already-uploaded Primitive Payloads object as an attachment by reference, without inlining the bytes — the way to send attachments larger than the inline cap. Upload the object via /v1/payloads (client-held CEK), then reference it here. v1 supports at most one.",
+					"items": {
+						"type": "object",
+						"additionalProperties": false,
+						"description": "A reference to an already-uploaded Primitive Payloads object, delivered as an attachment without inlining the bytes — the way to send an attachment larger than the inline cap. Upload the object via /v1/payloads (with a client-held CEK the server never sees), then reference it here.",
+						"properties": {
+							"root": {
+								"type": "string",
+								"pattern": "^[0-9a-f]{64}$",
+								"description": "The 64-char lowercase-hex Merkle root of a finalized payloads object."
+							},
+							"filename": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 255,
+								"description": "Attachment filename presented to the recipient."
+							},
+							"content_type": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 255,
+								"description": "Optional MIME content type."
+							},
+							"cek": {
+								"type": "string",
+								"pattern": "^[A-Za-z0-9_-]{1,128}$",
+								"description": "Base64url-encoded (unpadded) content-encryption key the recipient uses to decrypt. Travels with the email; the object store only ever holds ciphertext."
+							}
+						},
+						"required": [
+							"root",
+							"filename",
+							"cek"
+						]
+					}
+				},
 				"wait": {
 					"type": "boolean",
 					"description": "When true, wait for the first downstream SMTP delivery outcome before returning."
@@ -21234,6 +22022,667 @@ const operationManifest = [
 		"tag": "Sending",
 		"tagCommand": "sending"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-template",
+		"description": "Fetch one approved Function template by slug, including its manifest\nsnapshot and README. The stored source files used for install are not\nreturned.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getTemplate",
+		"path": "/templates/{id}",
+		"pathParams": [{
+			"description": "Template slug from the template manifest.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"slug": {
+					"type": "string",
+					"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+					"description": "Stable template slug used in template URLs and install commands."
+				},
+				"title": { "type": "string" },
+				"summary": { "type": "string" },
+				"author": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": {
+						"id": {
+							"type": "string",
+							"minLength": 1
+						},
+						"name": {
+							"type": "string",
+							"minLength": 1
+						},
+						"url": {
+							"type": "string",
+							"format": "uri"
+						}
+					},
+					"required": ["id", "name"]
+				},
+				"tags": {
+					"type": "array",
+					"items": { "type": "string" }
+				},
+				"verified": { "type": "boolean" },
+				"install_count": {
+					"type": "integer",
+					"minimum": 0
+				},
+				"github_repo": {
+					"type": "string",
+					"pattern": "^[A-Za-z0-9-]+/[A-Za-z0-9_.-]+$",
+					"description": "GitHub repository in owner/repo form."
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"updated_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"description": { "type": ["string", "null"] },
+				"github_sha": { "type": "string" },
+				"github_path": { "type": ["string", "null"] },
+				"manifest": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": {
+						"schemaVersion": {
+							"type": "integer",
+							"const": 1
+						},
+						"id": {
+							"type": "string",
+							"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+							"description": "Stable template slug from the manifest."
+						},
+						"title": {
+							"type": "string",
+							"minLength": 1
+						},
+						"summary": {
+							"type": "string",
+							"minLength": 1
+						},
+						"description": { "type": "string" },
+						"author": {
+							"type": "object",
+							"additionalProperties": false,
+							"properties": {
+								"id": {
+									"type": "string",
+									"minLength": 1
+								},
+								"name": {
+									"type": "string",
+									"minLength": 1
+								},
+								"url": {
+									"type": "string",
+									"format": "uri"
+								}
+							},
+							"required": ["id", "name"]
+						},
+						"tags": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1
+							}
+						},
+						"source": { "oneOf": [{
+							"type": "object",
+							"additionalProperties": false,
+							"properties": {
+								"mode": {
+									"type": "string",
+									"const": "managed-build"
+								},
+								"dir": {
+									"type": "string",
+									"minLength": 1,
+									"default": "."
+								}
+							},
+							"required": ["mode", "dir"]
+						}, {
+							"type": "object",
+							"additionalProperties": false,
+							"properties": {
+								"mode": {
+									"type": "string",
+									"const": "bundle"
+								},
+								"file": {
+									"type": "string",
+									"minLength": 1
+								}
+							},
+							"required": ["mode", "file"]
+						}] },
+						"install": {
+							"type": "object",
+							"additionalProperties": false,
+							"properties": {
+								"mode": {
+									"type": "string",
+									"enum": ["deploy", "scaffold"]
+								},
+								"editFiles": {
+									"type": "array",
+									"items": {
+										"type": "string",
+										"minLength": 1
+									}
+								},
+								"reason": {
+									"type": "string",
+									"default": ""
+								}
+							},
+							"required": [
+								"mode",
+								"editFiles",
+								"reason"
+							]
+						},
+						"secrets": {
+							"type": "array",
+							"items": {
+								"type": "object",
+								"additionalProperties": false,
+								"properties": {
+									"key": {
+										"type": "string",
+										"pattern": "^[A-Z_][A-Z0-9_]*$"
+									},
+									"required": {
+										"type": "boolean",
+										"default": true
+									},
+									"description": { "type": "string" }
+								},
+								"required": ["key", "required"]
+							}
+						},
+						"secretGroups": {
+							"type": "array",
+							"items": {
+								"type": "object",
+								"additionalProperties": false,
+								"properties": {
+									"keys": {
+										"type": "array",
+										"minItems": 2,
+										"items": {
+											"type": "string",
+											"pattern": "^[A-Z_][A-Z0-9_]*$"
+										}
+									},
+									"min": {
+										"type": "integer",
+										"minimum": 1,
+										"default": 1
+									},
+									"description": { "type": "string" }
+								},
+								"required": ["keys", "min"]
+							}
+						},
+						"variables": {
+							"type": "array",
+							"items": {
+								"type": "object",
+								"additionalProperties": false,
+								"properties": {
+									"key": {
+										"type": "string",
+										"minLength": 1
+									},
+									"prompt": {
+										"type": "string",
+										"minLength": 1
+									},
+									"default": { "type": "string" },
+									"file": {
+										"type": "string",
+										"minLength": 1
+									},
+									"type": {
+										"type": "string",
+										"enum": [
+											"string",
+											"select",
+											"url",
+											"email"
+										],
+										"default": "string"
+									},
+									"options": {
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1
+										}
+									},
+									"validation": {
+										"type": "object",
+										"additionalProperties": false,
+										"properties": {
+											"pattern": {
+												"type": "string",
+												"minLength": 1
+											},
+											"maxLength": {
+												"type": "integer",
+												"minimum": 1
+											}
+										}
+									}
+								},
+								"required": [
+									"key",
+									"prompt",
+									"type"
+								]
+							}
+						},
+						"setup": {
+							"type": "object",
+							"additionalProperties": false,
+							"properties": {
+								"agent": {
+									"type": "string",
+									"minLength": 1
+								},
+								"prompt": {
+									"type": "string",
+									"minLength": 1
+								},
+								"produces": {
+									"type": "array",
+									"items": {
+										"type": "string",
+										"minLength": 1
+									}
+								}
+							},
+							"required": [
+								"agent",
+								"prompt",
+								"produces"
+							]
+						},
+						"postInstall": { "type": "string" }
+					},
+					"required": [
+						"schemaVersion",
+						"id",
+						"title",
+						"summary",
+						"author",
+						"tags",
+						"source",
+						"install",
+						"secrets",
+						"secretGroups",
+						"variables"
+					]
+				},
+				"readme": { "type": ["string", "null"] },
+				"status": {
+					"type": "string",
+					"enum": [
+						"pending",
+						"approved",
+						"rejected"
+					]
+				}
+			},
+			"required": [
+				"id",
+				"slug",
+				"title",
+				"summary",
+				"author",
+				"tags",
+				"verified",
+				"install_count",
+				"github_repo",
+				"created_at",
+				"updated_at",
+				"description",
+				"github_sha",
+				"github_path",
+				"manifest",
+				"readme",
+				"status"
+			]
+		},
+		"sdkName": "getTemplate",
+		"summary": "Get a function template",
+		"tag": "Templates",
+		"tagCommand": "templates"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-template-install",
+		"description": "Fetch the current state of a template install. Reads may advance the\nself-test phase when a reply effect has been observed.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getTemplateInstall",
+		"path": "/templates/installs/{id}",
+		"pathParams": [{
+			"description": "Template install UUID.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"template_slug": {
+					"type": "string",
+					"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+					"description": "Template slug for this install."
+				},
+				"state": {
+					"type": "string",
+					"enum": [
+						"deploying",
+						"connecting",
+						"bound",
+						"tested",
+						"deploy_failed",
+						"bind_failed",
+						"test_failed"
+					]
+				},
+				"address": { "type": ["string", "null"] },
+				"function_id": {
+					"type": ["string", "null"],
+					"format": "uuid"
+				},
+				"error": { "type": ["string", "null"] },
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"updated_at": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
+			"required": [
+				"id",
+				"template_slug",
+				"state",
+				"address",
+				"function_id",
+				"error",
+				"created_at",
+				"updated_at"
+			]
+		},
+		"sdkName": "getTemplateInstall",
+		"summary": "Get template install status",
+		"tag": "Templates",
+		"tagCommand": "templates"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "install-template",
+		"description": "Start a one-shot deploy of an approved deploy-mode Function template.\nThe response returns an install record immediately; poll\n`GET /templates/installs/{id}` for progress.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "installTemplate",
+		"path": "/templates/{id}/install",
+		"pathParams": [{
+			"description": "Template slug from the template manifest.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"address": {
+					"type": "string",
+					"pattern": "^[a-z0-9][a-z0-9._-]{0,63}$",
+					"description": "Localpart to claim on the selected inbound domain. Defaults to the template slug."
+				},
+				"domain": {
+					"type": "string",
+					"minLength": 3,
+					"description": "Org domain name to claim the address on. Defaults to the org's newest active domain."
+				},
+				"variables": {
+					"type": "object",
+					"additionalProperties": { "type": "string" },
+					"description": "Template variable values keyed by manifest variable key."
+				},
+				"secrets": {
+					"type": "object",
+					"additionalProperties": { "type": "string" },
+					"description": "Secret values keyed by manifest secret key."
+				}
+			}
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"template_slug": {
+					"type": "string",
+					"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+					"description": "Template slug for this install."
+				},
+				"state": {
+					"type": "string",
+					"enum": [
+						"deploying",
+						"connecting",
+						"bound",
+						"tested",
+						"deploy_failed",
+						"bind_failed",
+						"test_failed"
+					]
+				},
+				"address": { "type": ["string", "null"] },
+				"function_id": {
+					"type": ["string", "null"],
+					"format": "uuid"
+				},
+				"error": { "type": ["string", "null"] },
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"updated_at": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
+			"required": [
+				"id",
+				"template_slug",
+				"state",
+				"address",
+				"function_id",
+				"error",
+				"created_at",
+				"updated_at"
+			]
+		},
+		"sdkName": "installTemplate",
+		"summary": "Install a function template",
+		"tag": "Templates",
+		"tagCommand": "templates"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-templates",
+		"description": "List approved Function templates available for browsing and\ninstallation. Results are cacheable and paginated with\n`data.next_cursor`.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listTemplates",
+		"path": "/templates",
+		"pathParams": [],
+		"queryParams": [
+			{
+				"description": "Search templates by title, summary, or slug.",
+				"enum": null,
+				"name": "q",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "Filter templates by an exact tag.",
+				"enum": null,
+				"name": "tag",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "Cursor from a previous response `data.next_cursor` value.",
+				"enum": null,
+				"name": "cursor",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"default": 50,
+				"description": "Maximum number of templates to return. The server caps this at 100.",
+				"enum": null,
+				"maximum": 100,
+				"minimum": 1,
+				"name": "limit",
+				"required": false,
+				"type": "integer"
+			}
+		],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"items": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"slug": {
+								"type": "string",
+								"pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+								"description": "Stable template slug used in template URLs and install commands."
+							},
+							"title": { "type": "string" },
+							"summary": { "type": "string" },
+							"author": {
+								"type": "object",
+								"additionalProperties": false,
+								"properties": {
+									"id": {
+										"type": "string",
+										"minLength": 1
+									},
+									"name": {
+										"type": "string",
+										"minLength": 1
+									},
+									"url": {
+										"type": "string",
+										"format": "uri"
+									}
+								},
+								"required": ["id", "name"]
+							},
+							"tags": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"verified": { "type": "boolean" },
+							"install_count": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"github_repo": {
+								"type": "string",
+								"pattern": "^[A-Za-z0-9-]+/[A-Za-z0-9_.-]+$",
+								"description": "GitHub repository in owner/repo form."
+							},
+							"created_at": {
+								"type": "string",
+								"format": "date-time"
+							},
+							"updated_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"slug",
+							"title",
+							"summary",
+							"author",
+							"tags",
+							"verified",
+							"install_count",
+							"github_repo",
+							"created_at",
+							"updated_at"
+						]
+					}
+				},
+				"next_cursor": {
+					"type": ["string", "null"],
+					"description": "Cursor to pass as the next `cursor` query value, or null when there are no more templates."
+				}
+			},
+			"required": ["items", "next_cursor"]
+		},
+		"sdkName": "listTemplates",
+		"summary": "List function templates",
+		"tag": "Templates",
+		"tagCommand": "templates"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -23472,7 +24921,7 @@ async function fetchEmailSearchPage(params) {
 		rows
 	};
 }
-function sleep$1(ms) {
+function sleep$2(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function cliError$6(message) {
@@ -24505,7 +25954,7 @@ async function waitForReply(params) {
 			if (lastAccepted !== void 0) continue;
 			if (phase.deadline !== null && Date.now() >= phase.deadline) break;
 			if (totalDeadline !== null && Date.now() >= totalDeadline) return null;
-			await sleep$1(params.interval * 1e3);
+			await sleep$2(params.interval * 1e3);
 		}
 	}
 	return null;
@@ -25287,7 +26736,7 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 			}
 			if (cursorAdvanced) continue;
 			if (deadline !== null && Date.now() >= deadline) break;
-			await sleep$1(flags.interval * 1e3);
+			await sleep$2(flags.interval * 1e3);
 		}
 		process.stderr.write(`Timed out waiting for ${flags.number} matching email${flags.number === 1 ? "" : "s"}; received ${matched}.\n`);
 		process.exitCode = 1;
@@ -25406,7 +26855,7 @@ var EmailsWatchCommand = class EmailsWatchCommand extends Command {
 			}
 			if (cursorAdvanced) continue;
 			if (deadline !== null && Date.now() >= deadline) break;
-			await sleep$1(flags.interval * 1e3);
+			await sleep$2(flags.interval * 1e3);
 		}
 	}
 };
@@ -26567,8 +28016,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.19.0";
-const CLI_VERSION_RANGE = "^1.19.0";
+const SDK_VERSION_RANGE = "^1.21.0";
+const CLI_VERSION_RANGE = "^1.21.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -27303,7 +28752,7 @@ var FunctionsLogsCommand = class FunctionsLogsCommand extends Command {
 					return;
 				}
 				completedInitialFollowPoll = true;
-				await sleep$1(flags["poll-interval"] * 1e3);
+				await sleep$2(flags["poll-interval"] * 1e3);
 			}
 		});
 	}
@@ -28214,7 +29663,7 @@ var FunctionsTestFunctionCommand = class FunctionsTestFunctionCommand extends Co
 					trace = fetched;
 					break;
 				}
-				await sleep$1(pollIntervalMs);
+				await sleep$2(pollIntervalMs);
 			}
 			if (!trace) {
 				const finalTrace = ((await getFunctionTestRunTrace({
@@ -28593,7 +30042,7 @@ const MAX_CLI_LOGIN_POLL_INTERVAL_SECONDS = 60;
 function cliError$3(message) {
 	return new Errors.CLIError(message, { exit: 1 });
 }
-function sleep(ms) {
+function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function openBrowser(url) {
@@ -28758,7 +30207,7 @@ var LoginCommand$1 = class extends Command {
 		let interval = Math.min(Math.max(1, start.interval), MAX_CLI_LOGIN_POLL_INTERVAL_SECONDS);
 		let nextPollDelay = 1;
 		while (Date.now() < deadline) {
-			await sleep(nextPollDelay * 1e3);
+			await sleep$1(nextPollDelay * 1e3);
 			nextPollDelay = interval;
 			const polled = await pollCliLogin({
 				body: { device_code: start.device_code },
@@ -30388,6 +31837,434 @@ var OrgSecretsSetCommand = class OrgSecretsSetCommand extends Command {
 	}
 };
 //#endregion
+//#region ../sdk-node/dist/payloads/index.js
+/**
+* Primitive Payloads — streaming client for large, content-addressed,
+* end-to-end-encrypted objects (attachments up to ~1 TB).
+*
+* Objects are split into fixed 64 MiB chunks; each chunk is encrypted with a
+* per-chunk AES-256-GCM key (HKDF-derived from the object CEK), content-addressed
+* by its ciphertext SHA-256, and committed under a Merkle root. This module
+* streams: it processes one chunk at a time and never holds the whole object in
+* memory, so a multi-GB file uploads/downloads in bounded memory.
+*
+* The chunk/manifest construction is byte-compatible with the server's object
+* model (packages/payloads-core in the API monorepo).
+*/
+const CHUNK_SIZE = 64 * 1024 * 1024;
+const MANIFEST_VERSION = 1;
+const CHUNK_KDF_INFO = "payloads-chunk";
+const OBJECT_ID_BYTES = 16;
+const CEK_BYTES = 32;
+const subtle = globalThis.crypto.subtle;
+const textEncoder = new TextEncoder();
+function randomBytes(length) {
+	const out = new Uint8Array(length);
+	globalThis.crypto.getRandomValues(out);
+	return out;
+}
+function toHex(bytes) {
+	let out = "";
+	for (const b of bytes) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+function fromHex(hex) {
+	if (hex.length % 2 !== 0) throw new Error("invalid hex: odd length");
+	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("invalid hex: non-hex character");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+	return out;
+}
+async function contentHash(bytes) {
+	return new Uint8Array(await subtle.digest("SHA-256", bytes));
+}
+async function contentHashHex(bytes) {
+	return toHex(await contentHash(bytes));
+}
+/** Binary Merkle root over ordered hex leaf hashes (odd node promoted). */
+async function merkleRoot(leafHashesHex) {
+	if (leafHashesHex.length === 0) return contentHashHex(new Uint8Array(0));
+	let level = leafHashesHex.map(fromHex);
+	while (level.length > 1) {
+		const next = [];
+		for (let i = 0; i < level.length; i += 2) {
+			const left = level[i];
+			const right = i + 1 < level.length ? level[i + 1] : level[i];
+			const combined = new Uint8Array(left.length + right.length);
+			combined.set(left, 0);
+			combined.set(right, left.length);
+			next.push(await contentHash(combined));
+		}
+		level = next;
+	}
+	return toHex(level[0]);
+}
+async function deriveChunkKey(cek, index) {
+	const baseKey = await subtle.importKey("raw", cek, "HKDF", false, ["deriveKey"]);
+	const info = textEncoder.encode(`${CHUNK_KDF_INFO}:${index}`);
+	return subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(32),
+		info
+	}, baseKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+function chunkNonce(index) {
+	const nonce = new Uint8Array(12);
+	new DataView(nonce.buffer).setUint32(8, index >>> 0, false);
+	return nonce;
+}
+function chunkAad(objectId, index) {
+	const aad = new Uint8Array(objectId.length + 4);
+	aad.set(objectId, 0);
+	new DataView(aad.buffer).setUint32(objectId.length, index >>> 0, false);
+	return aad;
+}
+async function encryptChunk(cek, objectId, index, plaintext) {
+	const key = await deriveChunkKey(cek, index);
+	const ct = await subtle.encrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, plaintext);
+	return new Uint8Array(ct);
+}
+async function decryptChunk(cek, objectId, index, ciphertext) {
+	const key = await deriveChunkKey(cek, index);
+	const pt = await subtle.decrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, ciphertext);
+	return new Uint8Array(pt);
+}
+function authHeaders(apiKey) {
+	return { authorization: `Bearer ${apiKey}` };
+}
+function apiRoot(baseUrl) {
+	let end = baseUrl.length;
+	while (end > 0 && baseUrl.charCodeAt(end - 1) === 47) end--;
+	return `${baseUrl.slice(0, end)}/v1/payloads`;
+}
+const DEFAULT_MAX_RETRIES = 6;
+const RETRYABLE_STATUS = new Set([
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* fetch with exponential backoff on transient failures. Request bodies here are
+* in-memory buffers/strings (never streams), so a retry can safely resend them.
+*/
+async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES) {
+	for (let attempt = 0;; attempt++) {
+		let res;
+		let networkError;
+		try {
+			res = await fetch(url, init);
+		} catch (err) {
+			networkError = err;
+		}
+		if (res && !RETRYABLE_STATUS.has(res.status)) return res;
+		if (attempt >= maxRetries) {
+			if (res) return res;
+			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
+		}
+		if (res) await res.text().catch(() => {});
+		await sleep(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
+	}
+}
+async function initiate(opts, manifest) {
+	const res = await retryingFetch(apiRoot(opts.baseUrl), {
+		method: "POST",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({ manifest })
+	}, "initiate");
+	if (!res.ok) throw new Error(`initiate failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function putChunk(opts, root, d, bytes) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, {
+		method: "PUT",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/octet-stream"
+		},
+		body: bytes
+	}, `chunk ${d.index} upload`);
+	if (!res.ok) throw new Error(`chunk ${d.index} upload failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function finalize(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/finalize`, {
+		method: "POST",
+		headers: authHeaders(opts.apiKey)
+	}, "finalize");
+	if (!res.ok) throw new Error(`finalize failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function fetchManifest(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/manifest`, { headers: authHeaders(opts.apiKey) }, "get manifest");
+	if (!res.ok) throw new Error(`get manifest failed: HTTP ${res.status} ${await res.text()}`);
+	return (await res.json()).data.manifest;
+}
+async function getChunkBytes(opts, root, d) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, { headers: authHeaders(opts.apiKey) }, `get chunk ${d.index}`);
+	if (!res.ok) throw new Error(`get chunk ${d.index} failed: HTTP ${res.status}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+async function readWindow(fh, position, length) {
+	const buf = Buffer.allocUnsafe(length);
+	let read = 0;
+	while (read < length) {
+		const { bytesRead } = await fh.read(buf, read, length - read, position + read);
+		if (bytesRead === 0) break;
+		read += bytesRead;
+	}
+	return read === length ? buf : buf.subarray(0, read);
+}
+async function mapLimit(items, limit, fn) {
+	let next = 0;
+	let firstError;
+	const worker = async () => {
+		while (next < items.length && firstError === void 0) {
+			const i = next++;
+			try {
+				await fn(items[i], i);
+			} catch (err) {
+				if (firstError === void 0) firstError = err;
+				return;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length || 1) }, () => worker()));
+	if (firstError !== void 0) throw firstError;
+}
+/**
+* Stream a file up as a Primitive Payload. Two passes over the file (encrypt to
+* build the manifest, then encrypt again to upload) keep memory bounded to a few
+* chunks — the whole object is never resident. Returns the content address
+* (merkleRoot) and the hex CEK needed to download it.
+*/
+async function pushFile(filePath, opts) {
+	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
+	const concurrency = opts.concurrency ?? 3;
+	const { size } = await stat(filePath);
+	const cek = randomBytes(CEK_BYTES);
+	const objectId = randomBytes(OBJECT_ID_BYTES);
+	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
+	const fh = await open(filePath, "r");
+	try {
+		const descriptors = [];
+		for (let index = 0; index < chunkCount; index++) {
+			const position = index * chunkSize;
+			const length = Math.min(chunkSize, size - position);
+			const plaintext = await readWindow(fh, position, length);
+			const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
+			descriptors.push({
+				index,
+				ciphertextHash: await contentHashHex(ciphertext),
+				plaintextSize: length,
+				ciphertextSize: ciphertext.length
+			});
+			opts.onProgress?.("encrypt", index + 1, chunkCount);
+		}
+		const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
+		await initiate(opts, {
+			version: MANIFEST_VERSION,
+			objectId: toHex(objectId),
+			chunkSize,
+			totalPlaintextSize: size,
+			chunkCount,
+			chunks: descriptors,
+			merkleRoot: root
+		});
+		let uploaded = 0;
+		await mapLimit(descriptors, concurrency, async (d) => {
+			const plaintext = await readWindow(fh, d.index * chunkSize, d.plaintextSize);
+			await putChunk(opts, root, d, await encryptChunk(cek, objectId, d.index, plaintext));
+			opts.onProgress?.("upload", ++uploaded, chunkCount);
+		});
+		await finalize(opts, root);
+		return {
+			merkleRoot: root,
+			cek: toHex(cek),
+			chunkCount,
+			totalBytes: size
+		};
+	} finally {
+		await fh.close();
+	}
+}
+/**
+* Stream a Primitive Payload down to a file, verifying and decrypting one chunk
+* at a time (bounded memory). Every chunk is content-address-checked before
+* decryption, so a corrupt or substituted chunk throws.
+*/
+async function pullFile(root, outPath, opts) {
+	const manifest = await fetchManifest(opts, root);
+	const computedRoot = await merkleRoot(manifest.chunks.map((c) => c.ciphertextHash));
+	if (computedRoot !== root) throw new Error(`manifest does not match the requested content address (got ${computedRoot})`);
+	const cek = fromHex(opts.cek);
+	const objectId = fromHex(manifest.objectId);
+	const out = createWriteStream(outPath);
+	let onWriteError = () => {};
+	const writeErrored = new Promise((_, reject) => {
+		onWriteError = reject;
+	});
+	writeErrored.catch(() => {});
+	out.on("error", (err) => onWriteError(err));
+	try {
+		let done = 0;
+		for (const d of manifest.chunks) {
+			const ciphertext = await getChunkBytes(opts, root, d);
+			if (await contentHashHex(ciphertext) !== d.ciphertextHash) throw new Error(`chunk ${d.index} failed integrity check`);
+			const plaintext = await decryptChunk(cek, objectId, d.index, ciphertext);
+			if (!out.write(plaintext)) await Promise.race([new Promise((resolve) => out.once("drain", resolve)), writeErrored]);
+			opts.onProgress?.("download", ++done, manifest.chunkCount);
+		}
+		await Promise.race([new Promise((resolve) => out.end(resolve)), writeErrored]);
+	} catch (err) {
+		out.destroy();
+		await rm(outPath, { force: true });
+		throw err;
+	}
+	return manifest;
+}
+//#endregion
+//#region src/oclif/commands/payloads.ts
+const DEFAULT_API_BASE_URL = "https://api.primitive.dev";
+const authFlags = {
+	"api-key": Flags.string({
+		description: "Primitive API key (defaults to PRIMITIVE_API_KEY or saved login credentials)",
+		env: "PRIMITIVE_API_KEY"
+	}),
+	"api-base-url": Flags.string({
+		description: "Override the API base URL. Internal testing only.",
+		env: "PRIMITIVE_API_BASE_URL",
+		hidden: true
+	})
+};
+function resolveClient(configDir, flags) {
+	const auth = resolveCliAuth({
+		configDir,
+		apiKey: flags["api-key"],
+		apiBaseUrl: flags["api-base-url"]
+	});
+	if (!auth.apiKey) throw new Error("Not authenticated: set PRIMITIVE_API_KEY, pass --api-key, or run `primitive login`.");
+	return {
+		baseUrl: auth.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+		apiKey: auth.apiKey
+	};
+}
+function progressToStderr() {
+	let lastPct = -1;
+	return (phase, done, total) => {
+		const pct = total === 0 ? 100 : Math.floor(done / total * 100);
+		if (pct !== lastPct) {
+			lastPct = pct;
+			process.stderr.write(`\r${phase}: ${done}/${total} (${pct}%)   `);
+			if (done === total) process.stderr.write("\n");
+		}
+	};
+}
+var PayloadsPushCommand = class PayloadsPushCommand extends Command {
+	static description = `Upload a file as a Primitive Payload — a large, content-addressed, end-to-end-encrypted object.
+
+  The file is chunked and encrypted client-side and streamed up in bounded
+  memory (multi-GB files never load fully into RAM). Prints the object's content
+  address (merkle_root) and the hex CEK required to download it — keep the CEK
+  secret; without it the object cannot be decrypted.`;
+	static summary = "Stream-upload a file as an encrypted payload";
+	static examples = ["<%= config.bin %> payloads push ./big-video.mp4"];
+	static args = { file: Args.string({
+		required: true,
+		description: "Path to the file to upload"
+	}) };
+	static flags = {
+		...authFlags,
+		concurrency: Flags.integer({
+			description: "Parallel chunk uploads",
+			default: 3
+		}),
+		quiet: Flags.boolean({
+			description: "Suppress progress output",
+			default: false
+		})
+	};
+	async run() {
+		const { args, flags } = await this.parse(PayloadsPushCommand);
+		const { baseUrl, apiKey } = resolveClient(this.config.configDir, flags);
+		const result = await pushFile(args.file, {
+			baseUrl,
+			apiKey,
+			concurrency: flags.concurrency,
+			onProgress: flags.quiet ? void 0 : progressToStderr()
+		});
+		this.log(JSON.stringify({
+			merkle_root: result.merkleRoot,
+			cek: result.cek,
+			chunk_count: result.chunkCount,
+			total_bytes: result.totalBytes
+		}, null, 2));
+	}
+};
+var PayloadsPullCommand = class PayloadsPullCommand extends Command {
+	static description = `Download and decrypt a Primitive Payload to a file.
+
+  Streams one chunk at a time, verifying each against its content address before
+  decryption, so a corrupt or substituted chunk fails loudly. Requires the hex
+  CEK printed by \`payloads push\`.`;
+	static summary = "Stream-download and decrypt a payload to a file";
+	static examples = ["<%= config.bin %> payloads pull <merkle_root> --cek <hex> --out ./restored.mp4"];
+	static args = { root: Args.string({
+		required: true,
+		description: "Object content address (merkle_root)"
+	}) };
+	static flags = {
+		...authFlags,
+		out: Flags.string({
+			required: true,
+			description: "Output file path"
+		}),
+		cek: Flags.string({
+			required: true,
+			description: "Hex content-encryption key from `payloads push`"
+		}),
+		quiet: Flags.boolean({
+			description: "Suppress progress output",
+			default: false
+		})
+	};
+	async run() {
+		const { args, flags } = await this.parse(PayloadsPullCommand);
+		const { baseUrl, apiKey } = resolveClient(this.config.configDir, flags);
+		const manifest = await pullFile(args.root, flags.out, {
+			baseUrl,
+			apiKey,
+			cek: flags.cek,
+			onProgress: flags.quiet ? void 0 : progressToStderr()
+		});
+		this.log(JSON.stringify({
+			merkle_root: args.root,
+			out: flags.out,
+			chunk_count: manifest.chunkCount,
+			total_bytes: manifest.totalPlaintextSize
+		}, null, 2));
+	}
+};
+//#endregion
 //#region ../sdk-node/dist/x402/index.js
 /**
 * x402 client-side signing.
@@ -31817,7 +33694,7 @@ async function pollForSettlementInteraction(params) {
 		}
 		if (receipt) return receipt;
 		if (deadline !== null && Date.now() >= deadline) break;
-		await sleep$1(params.intervalSeconds * 1e3);
+		await sleep$2(params.intervalSeconds * 1e3);
 	}
 	return null;
 }
@@ -34779,6 +36656,8 @@ const COMMANDS = {
 	"org:secrets:list": OrgSecretsListCommand,
 	"org:secrets:set": OrgSecretsSetCommand,
 	"org:secrets:remove": OrgSecretsRemoveCommand,
+	"payloads:push": PayloadsPushCommand,
+	"payloads:pull": PayloadsPullCommand,
 	"functions:test": FunctionsTestFunctionCommand,
 	"functions:test-function": FunctionsTestFunctionCommand,
 	"functions:route-set": FunctionsRouteSetCommand,