primcli 1.20.0 → 1.22.0

package/dist/oclif/index.js

@@ -1,12 +1,13 @@
 import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient, N as createConfig, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-BKso8oJu.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { chmodSync, closeSync, createWriteStream, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import path, { basename, dirname, join, relative, resolve, sep } from "node:path";
 import process$1 from "node:process";
 import { createInterface } from "node:readline/promises";
 import { hostname } from "node:os";
 import { spawn } from "node:child_process";
+import { open, rm, stat } from "node:fs/promises";
 import { gunzipSync } from "node:zlib";
 import { concat, getAddress, hexToBytes, keccak256, stringToBytes } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
@@ -9241,6 +9242,40 @@ const openapiDocument = {
 				},
 				"required": ["filename", "content_base64"]
 			},
+			"SendMailPayloadRef": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "A reference to an already-uploaded Primitive Payloads object, delivered as an attachment without inlining the bytes — the way to send an attachment larger than the inline cap. Upload the object via /v1/payloads (with a client-held CEK the server never sees), then reference it here.",
+				"properties": {
+					"root": {
+						"type": "string",
+						"pattern": "^[0-9a-f]{64}$",
+						"description": "The 64-char lowercase-hex Merkle root of a finalized payloads object."
+					},
+					"filename": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 255,
+						"description": "Attachment filename presented to the recipient."
+					},
+					"content_type": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 255,
+						"description": "Optional MIME content type."
+					},
+					"cek": {
+						"type": "string",
+						"pattern": "^[A-Za-z0-9_-]{1,128}$",
+						"description": "Base64url-encoded (unpadded) content-encryption key the recipient uses to decrypt. Travels with the email; the object store only ever holds ciphertext."
+					}
+				},
+				"required": [
+					"root",
+					"filename",
+					"cek"
+				]
+			},
 			"SendMailInput": {
 				"type": "object",
 				"additionalProperties": false,
@@ -9257,6 +9292,36 @@ const openapiDocument = {
 						"maxLength": 320,
 						"description": "Recipient address. Recipient eligibility depends on your account's outbound entitlements."
 					},
+					"cc": {
+						"description": "Carbon-copy recipients. Either a single address or an array of addresses. Each entry must be a single address; use the array form for multiple recipients. Cc recipients are visible to everyone who receives the message. The combined number of to, cc, and bcc recipients must not exceed 100.",
+						"oneOf": [{
+							"type": "string",
+							"minLength": 1
+						}, {
+							"type": "array",
+							"minItems": 1,
+							"maxItems": 100,
+							"items": {
+								"type": "string",
+								"minLength": 1
+							}
+						}]
+					},
+					"bcc": {
+						"description": "Blind-carbon-copy recipients. Either a single address or an array of addresses. Each entry must be a single address; use the array form for multiple recipients. Bcc recipients receive the message but are not disclosed to the other recipients: no Bcc header is sent. The combined number of to, cc, and bcc recipients must not exceed 100.",
+						"oneOf": [{
+							"type": "string",
+							"minLength": 1
+						}, {
+							"type": "array",
+							"minItems": 1,
+							"maxItems": 100,
+							"items": {
+								"type": "string",
+								"minLength": 1
+							}
+						}]
+					},
 					"subject": {
 						"type": "string",
 						"minLength": 1,
@@ -9295,6 +9360,12 @@ const openapiDocument = {
 						"description": "Inline attachments. Send requests with attachments to https://api.primitive.dev/v1/send-mail. Combined raw decoded attachment bytes must be at most 31457280.",
 						"items": { "$ref": "#/components/schemas/SendMailAttachment" }
 					},
+					"payload_attachments": {
+						"type": "array",
+						"maxItems": 1,
+						"description": "Deliver an already-uploaded Primitive Payloads object as an attachment by reference, without inlining the bytes — the way to send attachments larger than the inline cap. Upload the object via /v1/payloads (client-held CEK), then reference it here. v1 supports at most one.",
+						"items": { "$ref": "#/components/schemas/SendMailPayloadRef" }
+					},
 					"wait": {
 						"type": "boolean",
 						"description": "When true, wait for the first downstream SMTP delivery outcome before returning."
@@ -21770,6 +21841,36 @@ const operationManifest = [
 					"maxLength": 320,
 					"description": "Recipient address. Recipient eligibility depends on your account's outbound entitlements."
 				},
+				"cc": {
+					"description": "Carbon-copy recipients. Either a single address or an array of addresses. Each entry must be a single address; use the array form for multiple recipients. Cc recipients are visible to everyone who receives the message. The combined number of to, cc, and bcc recipients must not exceed 100.",
+					"oneOf": [{
+						"type": "string",
+						"minLength": 1
+					}, {
+						"type": "array",
+						"minItems": 1,
+						"maxItems": 100,
+						"items": {
+							"type": "string",
+							"minLength": 1
+						}
+					}]
+				},
+				"bcc": {
+					"description": "Blind-carbon-copy recipients. Either a single address or an array of addresses. Each entry must be a single address; use the array form for multiple recipients. Bcc recipients receive the message but are not disclosed to the other recipients: no Bcc header is sent. The combined number of to, cc, and bcc recipients must not exceed 100.",
+					"oneOf": [{
+						"type": "string",
+						"minLength": 1
+					}, {
+						"type": "array",
+						"minItems": 1,
+						"maxItems": 100,
+						"items": {
+							"type": "string",
+							"minLength": 1
+						}
+					}]
+				},
 				"subject": {
 					"type": "string",
 					"minLength": 1,
@@ -21832,6 +21933,45 @@ const operationManifest = [
 						"required": ["filename", "content_base64"]
 					}
 				},
+				"payload_attachments": {
+					"type": "array",
+					"maxItems": 1,
+					"description": "Deliver an already-uploaded Primitive Payloads object as an attachment by reference, without inlining the bytes — the way to send attachments larger than the inline cap. Upload the object via /v1/payloads (client-held CEK), then reference it here. v1 supports at most one.",
+					"items": {
+						"type": "object",
+						"additionalProperties": false,
+						"description": "A reference to an already-uploaded Primitive Payloads object, delivered as an attachment without inlining the bytes — the way to send an attachment larger than the inline cap. Upload the object via /v1/payloads (with a client-held CEK the server never sees), then reference it here.",
+						"properties": {
+							"root": {
+								"type": "string",
+								"pattern": "^[0-9a-f]{64}$",
+								"description": "The 64-char lowercase-hex Merkle root of a finalized payloads object."
+							},
+							"filename": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 255,
+								"description": "Attachment filename presented to the recipient."
+							},
+							"content_type": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 255,
+								"description": "Optional MIME content type."
+							},
+							"cek": {
+								"type": "string",
+								"pattern": "^[A-Za-z0-9_-]{1,128}$",
+								"description": "Base64url-encoded (unpadded) content-encryption key the recipient uses to decrypt. Travels with the email; the object store only ever holds ciphertext."
+							}
+						},
+						"required": [
+							"root",
+							"filename",
+							"cek"
+						]
+					}
+				},
 				"wait": {
 					"type": "boolean",
 					"description": "When true, wait for the first downstream SMTP delivery outcome before returning."
@@ -24841,7 +24981,7 @@ async function fetchEmailSearchPage(params) {
 		rows
 	};
 }
-function sleep$1(ms) {
+function sleep$2(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function cliError$6(message) {
@@ -25874,7 +26014,7 @@ async function waitForReply(params) {
 			if (lastAccepted !== void 0) continue;
 			if (phase.deadline !== null && Date.now() >= phase.deadline) break;
 			if (totalDeadline !== null && Date.now() >= totalDeadline) return null;
-			await sleep$1(params.interval * 1e3);
+			await sleep$2(params.interval * 1e3);
 		}
 	}
 	return null;
@@ -26656,7 +26796,7 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 			}
 			if (cursorAdvanced) continue;
 			if (deadline !== null && Date.now() >= deadline) break;
-			await sleep$1(flags.interval * 1e3);
+			await sleep$2(flags.interval * 1e3);
 		}
 		process.stderr.write(`Timed out waiting for ${flags.number} matching email${flags.number === 1 ? "" : "s"}; received ${matched}.\n`);
 		process.exitCode = 1;
@@ -26775,7 +26915,7 @@ var EmailsWatchCommand = class EmailsWatchCommand extends Command {
 			}
 			if (cursorAdvanced) continue;
 			if (deadline !== null && Date.now() >= deadline) break;
-			await sleep$1(flags.interval * 1e3);
+			await sleep$2(flags.interval * 1e3);
 		}
 	}
 };
@@ -27936,8 +28076,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.20.0";
-const CLI_VERSION_RANGE = "^1.20.0";
+const SDK_VERSION_RANGE = "^1.22.0";
+const CLI_VERSION_RANGE = "^1.22.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -28672,7 +28812,7 @@ var FunctionsLogsCommand = class FunctionsLogsCommand extends Command {
 					return;
 				}
 				completedInitialFollowPoll = true;
-				await sleep$1(flags["poll-interval"] * 1e3);
+				await sleep$2(flags["poll-interval"] * 1e3);
 			}
 		});
 	}
@@ -29583,7 +29723,7 @@ var FunctionsTestFunctionCommand = class FunctionsTestFunctionCommand extends Co
 					trace = fetched;
 					break;
 				}
-				await sleep$1(pollIntervalMs);
+				await sleep$2(pollIntervalMs);
 			}
 			if (!trace) {
 				const finalTrace = ((await getFunctionTestRunTrace({
@@ -29962,7 +30102,7 @@ const MAX_CLI_LOGIN_POLL_INTERVAL_SECONDS = 60;
 function cliError$3(message) {
 	return new Errors.CLIError(message, { exit: 1 });
 }
-function sleep(ms) {
+function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function openBrowser(url) {
@@ -30127,7 +30267,7 @@ var LoginCommand$1 = class extends Command {
 		let interval = Math.min(Math.max(1, start.interval), MAX_CLI_LOGIN_POLL_INTERVAL_SECONDS);
 		let nextPollDelay = 1;
 		while (Date.now() < deadline) {
-			await sleep(nextPollDelay * 1e3);
+			await sleep$1(nextPollDelay * 1e3);
 			nextPollDelay = interval;
 			const polled = await pollCliLogin({
 				body: { device_code: start.device_code },
@@ -31757,6 +31897,434 @@ var OrgSecretsSetCommand = class OrgSecretsSetCommand extends Command {
 	}
 };
 //#endregion
+//#region ../sdk-node/dist/payloads/index.js
+/**
+* Primitive Payloads — streaming client for large, content-addressed,
+* end-to-end-encrypted objects (attachments up to ~1 TB).
+*
+* Objects are split into fixed 64 MiB chunks; each chunk is encrypted with a
+* per-chunk AES-256-GCM key (HKDF-derived from the object CEK), content-addressed
+* by its ciphertext SHA-256, and committed under a Merkle root. This module
+* streams: it processes one chunk at a time and never holds the whole object in
+* memory, so a multi-GB file uploads/downloads in bounded memory.
+*
+* The chunk/manifest construction is byte-compatible with the server's object
+* model (packages/payloads-core in the API monorepo).
+*/
+const CHUNK_SIZE = 64 * 1024 * 1024;
+const MANIFEST_VERSION = 1;
+const CHUNK_KDF_INFO = "payloads-chunk";
+const OBJECT_ID_BYTES = 16;
+const CEK_BYTES = 32;
+const subtle = globalThis.crypto.subtle;
+const textEncoder = new TextEncoder();
+function randomBytes(length) {
+	const out = new Uint8Array(length);
+	globalThis.crypto.getRandomValues(out);
+	return out;
+}
+function toHex(bytes) {
+	let out = "";
+	for (const b of bytes) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+function fromHex(hex) {
+	if (hex.length % 2 !== 0) throw new Error("invalid hex: odd length");
+	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("invalid hex: non-hex character");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+	return out;
+}
+async function contentHash(bytes) {
+	return new Uint8Array(await subtle.digest("SHA-256", bytes));
+}
+async function contentHashHex(bytes) {
+	return toHex(await contentHash(bytes));
+}
+/** Binary Merkle root over ordered hex leaf hashes (odd node promoted). */
+async function merkleRoot(leafHashesHex) {
+	if (leafHashesHex.length === 0) return contentHashHex(new Uint8Array(0));
+	let level = leafHashesHex.map(fromHex);
+	while (level.length > 1) {
+		const next = [];
+		for (let i = 0; i < level.length; i += 2) {
+			const left = level[i];
+			const right = i + 1 < level.length ? level[i + 1] : level[i];
+			const combined = new Uint8Array(left.length + right.length);
+			combined.set(left, 0);
+			combined.set(right, left.length);
+			next.push(await contentHash(combined));
+		}
+		level = next;
+	}
+	return toHex(level[0]);
+}
+async function deriveChunkKey(cek, index) {
+	const baseKey = await subtle.importKey("raw", cek, "HKDF", false, ["deriveKey"]);
+	const info = textEncoder.encode(`${CHUNK_KDF_INFO}:${index}`);
+	return subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(32),
+		info
+	}, baseKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+function chunkNonce(index) {
+	const nonce = new Uint8Array(12);
+	new DataView(nonce.buffer).setUint32(8, index >>> 0, false);
+	return nonce;
+}
+function chunkAad(objectId, index) {
+	const aad = new Uint8Array(objectId.length + 4);
+	aad.set(objectId, 0);
+	new DataView(aad.buffer).setUint32(objectId.length, index >>> 0, false);
+	return aad;
+}
+async function encryptChunk(cek, objectId, index, plaintext) {
+	const key = await deriveChunkKey(cek, index);
+	const ct = await subtle.encrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, plaintext);
+	return new Uint8Array(ct);
+}
+async function decryptChunk(cek, objectId, index, ciphertext) {
+	const key = await deriveChunkKey(cek, index);
+	const pt = await subtle.decrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, ciphertext);
+	return new Uint8Array(pt);
+}
+function authHeaders(apiKey) {
+	return { authorization: `Bearer ${apiKey}` };
+}
+function apiRoot(baseUrl) {
+	let end = baseUrl.length;
+	while (end > 0 && baseUrl.charCodeAt(end - 1) === 47) end--;
+	return `${baseUrl.slice(0, end)}/v1/payloads`;
+}
+const DEFAULT_MAX_RETRIES = 6;
+const RETRYABLE_STATUS = new Set([
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* fetch with exponential backoff on transient failures. Request bodies here are
+* in-memory buffers/strings (never streams), so a retry can safely resend them.
+*/
+async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES) {
+	for (let attempt = 0;; attempt++) {
+		let res;
+		let networkError;
+		try {
+			res = await fetch(url, init);
+		} catch (err) {
+			networkError = err;
+		}
+		if (res && !RETRYABLE_STATUS.has(res.status)) return res;
+		if (attempt >= maxRetries) {
+			if (res) return res;
+			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
+		}
+		if (res) await res.text().catch(() => {});
+		await sleep(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
+	}
+}
+async function initiate(opts, manifest) {
+	const res = await retryingFetch(apiRoot(opts.baseUrl), {
+		method: "POST",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({ manifest })
+	}, "initiate");
+	if (!res.ok) throw new Error(`initiate failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function putChunk(opts, root, d, bytes) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, {
+		method: "PUT",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/octet-stream"
+		},
+		body: bytes
+	}, `chunk ${d.index} upload`);
+	if (!res.ok) throw new Error(`chunk ${d.index} upload failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function finalize(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/finalize`, {
+		method: "POST",
+		headers: authHeaders(opts.apiKey)
+	}, "finalize");
+	if (!res.ok) throw new Error(`finalize failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function fetchManifest(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/manifest`, { headers: authHeaders(opts.apiKey) }, "get manifest");
+	if (!res.ok) throw new Error(`get manifest failed: HTTP ${res.status} ${await res.text()}`);
+	return (await res.json()).data.manifest;
+}
+async function getChunkBytes(opts, root, d) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, { headers: authHeaders(opts.apiKey) }, `get chunk ${d.index}`);
+	if (!res.ok) throw new Error(`get chunk ${d.index} failed: HTTP ${res.status}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+async function readWindow(fh, position, length) {
+	const buf = Buffer.allocUnsafe(length);
+	let read = 0;
+	while (read < length) {
+		const { bytesRead } = await fh.read(buf, read, length - read, position + read);
+		if (bytesRead === 0) break;
+		read += bytesRead;
+	}
+	return read === length ? buf : buf.subarray(0, read);
+}
+async function mapLimit(items, limit, fn) {
+	let next = 0;
+	let firstError;
+	const worker = async () => {
+		while (next < items.length && firstError === void 0) {
+			const i = next++;
+			try {
+				await fn(items[i], i);
+			} catch (err) {
+				if (firstError === void 0) firstError = err;
+				return;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length || 1) }, () => worker()));
+	if (firstError !== void 0) throw firstError;
+}
+/**
+* Stream a file up as a Primitive Payload. Two passes over the file (encrypt to
+* build the manifest, then encrypt again to upload) keep memory bounded to a few
+* chunks — the whole object is never resident. Returns the content address
+* (merkleRoot) and the hex CEK needed to download it.
+*/
+async function pushFile(filePath, opts) {
+	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
+	const concurrency = opts.concurrency ?? 3;
+	const { size } = await stat(filePath);
+	const cek = randomBytes(CEK_BYTES);
+	const objectId = randomBytes(OBJECT_ID_BYTES);
+	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
+	const fh = await open(filePath, "r");
+	try {
+		const descriptors = [];
+		for (let index = 0; index < chunkCount; index++) {
+			const position = index * chunkSize;
+			const length = Math.min(chunkSize, size - position);
+			const plaintext = await readWindow(fh, position, length);
+			const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
+			descriptors.push({
+				index,
+				ciphertextHash: await contentHashHex(ciphertext),
+				plaintextSize: length,
+				ciphertextSize: ciphertext.length
+			});
+			opts.onProgress?.("encrypt", index + 1, chunkCount);
+		}
+		const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
+		await initiate(opts, {
+			version: MANIFEST_VERSION,
+			objectId: toHex(objectId),
+			chunkSize,
+			totalPlaintextSize: size,
+			chunkCount,
+			chunks: descriptors,
+			merkleRoot: root
+		});
+		let uploaded = 0;
+		await mapLimit(descriptors, concurrency, async (d) => {
+			const plaintext = await readWindow(fh, d.index * chunkSize, d.plaintextSize);
+			await putChunk(opts, root, d, await encryptChunk(cek, objectId, d.index, plaintext));
+			opts.onProgress?.("upload", ++uploaded, chunkCount);
+		});
+		await finalize(opts, root);
+		return {
+			merkleRoot: root,
+			cek: toHex(cek),
+			chunkCount,
+			totalBytes: size
+		};
+	} finally {
+		await fh.close();
+	}
+}
+/**
+* Stream a Primitive Payload down to a file, verifying and decrypting one chunk
+* at a time (bounded memory). Every chunk is content-address-checked before
+* decryption, so a corrupt or substituted chunk throws.
+*/
+async function pullFile(root, outPath, opts) {
+	const manifest = await fetchManifest(opts, root);
+	const computedRoot = await merkleRoot(manifest.chunks.map((c) => c.ciphertextHash));
+	if (computedRoot !== root) throw new Error(`manifest does not match the requested content address (got ${computedRoot})`);
+	const cek = fromHex(opts.cek);
+	const objectId = fromHex(manifest.objectId);
+	const out = createWriteStream(outPath);
+	let onWriteError = () => {};
+	const writeErrored = new Promise((_, reject) => {
+		onWriteError = reject;
+	});
+	writeErrored.catch(() => {});
+	out.on("error", (err) => onWriteError(err));
+	try {
+		let done = 0;
+		for (const d of manifest.chunks) {
+			const ciphertext = await getChunkBytes(opts, root, d);
+			if (await contentHashHex(ciphertext) !== d.ciphertextHash) throw new Error(`chunk ${d.index} failed integrity check`);
+			const plaintext = await decryptChunk(cek, objectId, d.index, ciphertext);
+			if (!out.write(plaintext)) await Promise.race([new Promise((resolve) => out.once("drain", resolve)), writeErrored]);
+			opts.onProgress?.("download", ++done, manifest.chunkCount);
+		}
+		await Promise.race([new Promise((resolve) => out.end(resolve)), writeErrored]);
+	} catch (err) {
+		out.destroy();
+		await rm(outPath, { force: true });
+		throw err;
+	}
+	return manifest;
+}
+//#endregion
+//#region src/oclif/commands/payloads.ts
+const DEFAULT_API_BASE_URL = "https://api.primitive.dev";
+const authFlags = {
+	"api-key": Flags.string({
+		description: "Primitive API key (defaults to PRIMITIVE_API_KEY or saved login credentials)",
+		env: "PRIMITIVE_API_KEY"
+	}),
+	"api-base-url": Flags.string({
+		description: "Override the API base URL. Internal testing only.",
+		env: "PRIMITIVE_API_BASE_URL",
+		hidden: true
+	})
+};
+function resolveClient(configDir, flags) {
+	const auth = resolveCliAuth({
+		configDir,
+		apiKey: flags["api-key"],
+		apiBaseUrl: flags["api-base-url"]
+	});
+	if (!auth.apiKey) throw new Error("Not authenticated: set PRIMITIVE_API_KEY, pass --api-key, or run `primitive login`.");
+	return {
+		baseUrl: auth.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+		apiKey: auth.apiKey
+	};
+}
+function progressToStderr() {
+	let lastPct = -1;
+	return (phase, done, total) => {
+		const pct = total === 0 ? 100 : Math.floor(done / total * 100);
+		if (pct !== lastPct) {
+			lastPct = pct;
+			process.stderr.write(`\r${phase}: ${done}/${total} (${pct}%)   `);
+			if (done === total) process.stderr.write("\n");
+		}
+	};
+}
+var PayloadsPushCommand = class PayloadsPushCommand extends Command {
+	static description = `Upload a file as a Primitive Payload — a large, content-addressed, end-to-end-encrypted object.
+
+  The file is chunked and encrypted client-side and streamed up in bounded
+  memory (multi-GB files never load fully into RAM). Prints the object's content
+  address (merkle_root) and the hex CEK required to download it — keep the CEK
+  secret; without it the object cannot be decrypted.`;
+	static summary = "Stream-upload a file as an encrypted payload";
+	static examples = ["<%= config.bin %> payloads push ./big-video.mp4"];
+	static args = { file: Args.string({
+		required: true,
+		description: "Path to the file to upload"
+	}) };
+	static flags = {
+		...authFlags,
+		concurrency: Flags.integer({
+			description: "Parallel chunk uploads",
+			default: 3
+		}),
+		quiet: Flags.boolean({
+			description: "Suppress progress output",
+			default: false
+		})
+	};
+	async run() {
+		const { args, flags } = await this.parse(PayloadsPushCommand);
+		const { baseUrl, apiKey } = resolveClient(this.config.configDir, flags);
+		const result = await pushFile(args.file, {
+			baseUrl,
+			apiKey,
+			concurrency: flags.concurrency,
+			onProgress: flags.quiet ? void 0 : progressToStderr()
+		});
+		this.log(JSON.stringify({
+			merkle_root: result.merkleRoot,
+			cek: result.cek,
+			chunk_count: result.chunkCount,
+			total_bytes: result.totalBytes
+		}, null, 2));
+	}
+};
+var PayloadsPullCommand = class PayloadsPullCommand extends Command {
+	static description = `Download and decrypt a Primitive Payload to a file.
+
+  Streams one chunk at a time, verifying each against its content address before
+  decryption, so a corrupt or substituted chunk fails loudly. Requires the hex
+  CEK printed by \`payloads push\`.`;
+	static summary = "Stream-download and decrypt a payload to a file";
+	static examples = ["<%= config.bin %> payloads pull <merkle_root> --cek <hex> --out ./restored.mp4"];
+	static args = { root: Args.string({
+		required: true,
+		description: "Object content address (merkle_root)"
+	}) };
+	static flags = {
+		...authFlags,
+		out: Flags.string({
+			required: true,
+			description: "Output file path"
+		}),
+		cek: Flags.string({
+			required: true,
+			description: "Hex content-encryption key from `payloads push`"
+		}),
+		quiet: Flags.boolean({
+			description: "Suppress progress output",
+			default: false
+		})
+	};
+	async run() {
+		const { args, flags } = await this.parse(PayloadsPullCommand);
+		const { baseUrl, apiKey } = resolveClient(this.config.configDir, flags);
+		const manifest = await pullFile(args.root, flags.out, {
+			baseUrl,
+			apiKey,
+			cek: flags.cek,
+			onProgress: flags.quiet ? void 0 : progressToStderr()
+		});
+		this.log(JSON.stringify({
+			merkle_root: args.root,
+			out: flags.out,
+			chunk_count: manifest.chunkCount,
+			total_bytes: manifest.totalPlaintextSize
+		}, null, 2));
+	}
+};
+//#endregion
 //#region ../sdk-node/dist/x402/index.js
 /**
 * x402 client-side signing.
@@ -33186,7 +33754,7 @@ async function pollForSettlementInteraction(params) {
 		}
 		if (receipt) return receipt;
 		if (deadline !== null && Date.now() >= deadline) break;
-		await sleep$1(params.intervalSeconds * 1e3);
+		await sleep$2(params.intervalSeconds * 1e3);
 	}
 	return null;
 }
@@ -34569,6 +35137,7 @@ var SendCommand = class SendCommand extends Command {
 		"<%= config.bin %> send --to alice@example.com --body 'See attached.' --attachment ./report.pdf",
 		"<%= config.bin %> send --to alice@example.com --from support@yourcompany.com --subject 'Quick question' --body 'Are you free Thursday?'",
 		"<%= config.bin %> send --to alice@example.com --html '<p>Hello!</p>'",
+		"<%= config.bin %> send --to alice@example.com --cc bob@example.com --bcc audit@example.com --body 'Loop bob in; audit copy stays hidden.'",
 		"<%= config.bin %> send --to alice@example.com --body 'Confirmed' --wait",
 		"<%= config.bin %> send --to inbox@your-managed-domain.primitive.email --body 'self-loop smoke test' --wait  # any *.primitive.email address routes back to the sending account; useful for proving outbound + inbound work end-to-end"
 	];
@@ -34598,6 +35167,14 @@ var SendCommand = class SendCommand extends Command {
 			description: "Attach a file to the email. Repeatable. Sends file bytes as a MIME attachment; use --body-file only for message body text.",
 			multiple: true
 		}),
+		cc: Flags.string({
+			description: "Carbon-copy recipient. Repeatable for multiple. Cc recipients are visible to everyone who receives the message.",
+			multiple: true
+		}),
+		bcc: Flags.string({
+			description: "Blind-carbon-copy recipient. Repeatable for multiple. Bcc recipients receive the message but are not disclosed to the other recipients.",
+			multiple: true
+		}),
 		"in-reply-to": Flags.string({ description: "Message-Id of the parent email when threading a reply on the wire. For replying to an inbound message you received, prefer `primitive reply --id <inbound-id>`." }),
 		wait: Flags.boolean({ description: "Block until the receiving MTA returns an outcome. Without --wait, the call returns once Primitive has accepted the message for delivery." }),
 		"wait-timeout-ms": Flags.integer({ description: "Maximum time to wait when --wait is set. Defaults to 30000ms." }),
@@ -34632,6 +35209,8 @@ var SendCommand = class SendCommand extends Command {
 				body: {
 					from,
 					to: flags.to,
+					...flags.cc !== void 0 ? { cc: flags.cc } : {},
+					...flags.bcc !== void 0 ? { bcc: flags.bcc } : {},
 					subject,
 					...bodies.body !== void 0 ? { body_text: bodies.body } : {},
 					...bodies.html !== void 0 ? { body_html: bodies.html } : {},
@@ -36148,6 +36727,8 @@ const COMMANDS = {
 	"org:secrets:list": OrgSecretsListCommand,
 	"org:secrets:set": OrgSecretsSetCommand,
 	"org:secrets:remove": OrgSecretsRemoveCommand,
+	"payloads:push": PayloadsPushCommand,
+	"payloads:pull": PayloadsPullCommand,
 	"functions:test": FunctionsTestFunctionCommand,
 	"functions:test-function": FunctionsTestFunctionCommand,
 	"functions:route-set": FunctionsRouteSetCommand,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.20.0",
+  "version": "1.22.0",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,