primcli 1.26.0 → 1.27.0

package/dist/oclif/index.js

@@ -1,4 +1,4 @@
-import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient, N as createConfig, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-BKso8oJu.js";
+import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient$1, N as createConfig$1, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-BKso8oJu.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
 import { chmodSync, closeSync, constants, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
@@ -27,7 +27,7 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region ../packages/api-core/src/api/client.gen.ts
-const client = createClient(createConfig({ baseUrl: "https://api.primitive.dev/v1" }));
+const client = createClient$1(createConfig$1({ baseUrl: "https://api.primitive.dev/v1" }));
 //#endregion
 //#region ../packages/api-core/src/api/sdk.gen.ts
 var sdk_gen_exports = /* @__PURE__ */ __exportAll({
@@ -36,7 +36,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	cancelSentEmail: () => cancelSentEmail,
 	checkDomainDns: () => checkDomainDns,
 	cliLogout: () => cliLogout,
-	completeWebhookEvent: () => completeWebhookEvent,
+	completeWebhookEvent: () => completeWebhookEvent$1,
 	createAgentAccount: () => createAgentAccount,
 	createAgentClaimLink: () => createAgentClaimLink,
 	createChallenge: () => createChallenge,
@@ -71,7 +71,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	downloadEmailAttachmentPart: () => downloadEmailAttachmentPart,
 	downloadRawEmail: () => downloadRawEmail,
 	downloadSentAttachmentPart: () => downloadSentAttachmentPart,
-	getAccount: () => getAccount,
+	getAccount: () => getAccount$1,
 	getAgent: () => getAgent,
 	getChallenge: () => getChallenge,
 	getConversation: () => getConversation,
@@ -117,7 +117,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	payChallenge: () => payChallenge,
 	pollCliLogin: () => pollCliLogin,
 	publishAgent: () => publishAgent,
-	pullWebhookEvent: () => pullWebhookEvent,
+	pullWebhookEvent: () => pullWebhookEvent$1,
 	registerPayoutAddress: () => registerPayoutAddress,
 	removeAgentConnection: () => removeAgentConnection,
 	reorderRoutes: () => reorderRoutes,
@@ -411,7 +411,7 @@ const cliLogout = (options) => (options?.client ?? client).post({
 /**
 * Get account info
 */
-const getAccount = (options) => (options?.client ?? client).get({
+const getAccount$1 = (options) => (options?.client ?? client).get({
 	security: [{
 		scheme: "bearer",
 		type: "http"
@@ -1025,7 +1025,7 @@ const updateEndpoint = (options) => (options.client ?? client).patch({
 *
 * Wait up to 30 seconds for one existing event. The body string preserves the exact webhook serialization; headers and canonical occurrence/type metadata travel alongside it. A fixed lease protects the attempt while a short handler accepts input. Retry may redeliver an occurrence: deduplicate event_id. Empty delivery means no offer now, not proof all input was delivered; inspect backlog and persistent gap_count/last_gap_reason. Queue retention is 24 hours and does not extend source-content retention. Disconnecting preserves pending work. Same named destination shares consumption; different destinations get independent copies.
 */
-const pullWebhookEvent = (options) => (options.client ?? client).post({
+const pullWebhookEvent$1 = (options) => (options.client ?? client).post({
 	security: [{
 		scheme: "bearer",
 		type: "http"
@@ -1042,7 +1042,7 @@ const pullWebhookEvent = (options) => (options.client ?? client).post({
 *
 * Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
 */
-const completeWebhookEvent = (options) => (options.client ?? client).post({
+const completeWebhookEvent$1 = (options) => (options.client ?? client).post({
 	security: [{
 		scheme: "bearer",
 		type: "http"
@@ -5110,6 +5110,22 @@ const openapiDocument = {
 						"format": "date-time"
 					},
 					"description": "Inclusive upper bound on `created_at`."
+				},
+				{
+					"name": "q",
+					"in": "query",
+					"schema": { "type": "string" },
+					"description": "Literal case-insensitive substring filter over the\nsubject, the retained plain-text body, the sender, and\nthe To, CC and BCC recipients of each send. Matched\nverbatim: `%`, `_` and `\\` are ordinary characters and\ndo not act as wildcards, so a search for `10%` finds the\nliteral string `10%` rather than everything beginning\n`10`.\n\nLeading and trailing whitespace is trimmed, and the\nresult must be 3 to 500 UTF-16 code units. The\nthree-character minimum is the search index's: a shorter\npattern cannot be answered from the index and would scan\nthe whole mailbox, so it is rejected rather than served\nas a request that times out.\n\nThose bounds are deliberately NOT declared as\n`minLength`/`maxLength`. Both count Unicode code points\non the value as sent, while the server trims first and\ncounts UTF-16 code units, and the two disagree in both\ndirections: two astral characters are 2 code points but\n4 code units, so a declared minimum would reject a query\nthe server accepts, and `\"<499 chars> \"` is 500 code\npoints before trimming and 499 after, so a declared\nmaximum would reject another. Declaring a bound the\nserver does not enforce is worse than declaring none,\nbecause the client refuses locally and the caller never\nlearns why. The server validates; a violation is a `400`.\n\nRecipients are matched one address at a time rather than\nagainst the serialized recipient list, so a query\ncontaining a quote, comma or bracket matches only where\nthat character occurs inside an address. Bodies are\nsearched only where the plain-text body was retained;\nHTML-only bodies are not searched.\n\nNot served by every deployment. Where sent-mail search\nis not enabled the endpoint answers `503` with code\n`sent_mail_search_unavailable`, which callers should\ntreat as a capability answer and fall back on rather\nthan as an outage.\n"
+				},
+				{
+					"name": "from",
+					"in": "query",
+					"schema": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 320
+					},
+					"description": "Exact case-insensitive sender mailbox filter. Returns\nonly sends whose from address equals this value; it is\nnot a substring match, so a partial mailbox matches\nnothing. Use `q` to search sender text loosely.\nCombines with every other filter, and unlike `q` it is\nserved by every deployment.\n"
 				}
 			],
 			"responses": {
@@ -5124,7 +5140,20 @@ const openapiDocument = {
 					}] } } }
 				},
 				"400": { "$ref": "#/components/responses/ValidationError" },
-				"401": { "$ref": "#/components/responses/Unauthorized" }
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"503": {
+					"description": "Sent-mail text search is not enabled in this deployment,\nso `q` cannot be served. A capability answer, not an\noutage: it will not clear on retry, and the same request\nwithout `q` succeeds. Fall back to whatever local\nmatching the caller has. Distinguished from the generic\n503 by its `sent_mail_search_unavailable` code.\n",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "sent_mail_search_unavailable",
+								"message": "Sent-mail text search (`q`) is not enabled in this environment."
+							}
+						}
+					} }
+				}
 			}
 		} },
 		"/sent-emails/{id}": {
@@ -11376,14 +11405,16 @@ const openapiDocument = {
 				"oneOf": [
 					{ "$ref": "#/components/schemas/CompleteWebhookHttpInput" },
 					{ "$ref": "#/components/schemas/CompleteWebhookExecInput" },
-					{ "$ref": "#/components/schemas/CompleteWebhookStdoutInput" }
+					{ "$ref": "#/components/schemas/CompleteWebhookStdoutInput" },
+					{ "$ref": "#/components/schemas/CompleteWebhookSdkInput" }
 				],
 				"discriminator": {
 					"propertyName": "mode",
 					"mapping": {
 						"http": "#/components/schemas/CompleteWebhookHttpInput",
 						"exec": "#/components/schemas/CompleteWebhookExecInput",
-						"stdout": "#/components/schemas/CompleteWebhookStdoutInput"
+						"stdout": "#/components/schemas/CompleteWebhookStdoutInput",
+						"sdk": "#/components/schemas/CompleteWebhookSdkInput"
 					}
 				}
 			},
@@ -11537,6 +11568,49 @@ const openapiDocument = {
 				],
 				"additionalProperties": false
 			},
+			"CompleteWebhookSdkInput": {
+				"type": "object",
+				"properties": {
+					"queue_id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"delivery_id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"lease_token": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"duration_ms": {
+						"type": "integer",
+						"minimum": 0,
+						"maximum": 3e4
+					},
+					"mode": {
+						"type": "string",
+						"enum": ["sdk"]
+					},
+					"accepted": { "type": "boolean" },
+					"transport_error": {
+						"type": "string",
+						"enum": ["timeout", "io"]
+					}
+				},
+				"required": [
+					"queue_id",
+					"delivery_id",
+					"lease_token",
+					"duration_ms",
+					"mode",
+					"accepted"
+				],
+				"additionalProperties": false
+			},
 			"CompleteWebhookResponse": {
 				"type": "object",
 				"properties": {
@@ -11570,6 +11644,31 @@ const openapiDocument = {
 			"Endpoint": {
 				"type": "object",
 				"properties": {
+					"receiver_capabilities": {
+						"type": "object",
+						"properties": {
+							"completion_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"http",
+										"exec",
+										"stdout",
+										"sdk"
+									]
+								}
+							},
+							"stream_protocols": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": ["primitive.events.v1"]
+								}
+							}
+						},
+						"required": ["completion_modes", "stream_protocols"]
+					},
 					"id": {
 						"type": "string",
 						"format": "uuid"
@@ -17879,6 +17978,49 @@ const operationManifest = [
 						"write_succeeded"
 					],
 					"additionalProperties": false
+				},
+				{
+					"type": "object",
+					"properties": {
+						"queue_id": {
+							"type": "string",
+							"format": "uuid",
+							"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+						},
+						"delivery_id": {
+							"type": "string",
+							"format": "uuid",
+							"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+						},
+						"lease_token": {
+							"type": "string",
+							"format": "uuid",
+							"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+						},
+						"duration_ms": {
+							"type": "integer",
+							"minimum": 0,
+							"maximum": 3e4
+						},
+						"mode": {
+							"type": "string",
+							"enum": ["sdk"]
+						},
+						"accepted": { "type": "boolean" },
+						"transport_error": {
+							"type": "string",
+							"enum": ["timeout", "io"]
+						}
+					},
+					"required": [
+						"queue_id",
+						"delivery_id",
+						"lease_token",
+						"duration_ms",
+						"mode",
+						"accepted"
+					],
+					"additionalProperties": false
 				}
 			],
 			"discriminator": {
@@ -17886,7 +18028,8 @@ const operationManifest = [
 				"mapping": {
 					"http": "#/components/schemas/CompleteWebhookHttpInput",
 					"exec": "#/components/schemas/CompleteWebhookExecInput",
-					"stdout": "#/components/schemas/CompleteWebhookStdoutInput"
+					"stdout": "#/components/schemas/CompleteWebhookStdoutInput",
+					"sdk": "#/components/schemas/CompleteWebhookSdkInput"
 				}
 			}
 		},
@@ -17997,6 +18140,31 @@ const operationManifest = [
 		"responseSchema": {
 			"type": "object",
 			"properties": {
+				"receiver_capabilities": {
+					"type": "object",
+					"properties": {
+						"completion_modes": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"enum": [
+									"http",
+									"exec",
+									"stdout",
+									"sdk"
+								]
+							}
+						},
+						"stream_protocols": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"enum": ["primitive.events.v1"]
+							}
+						}
+					},
+					"required": ["completion_modes", "stream_protocols"]
+				},
 				"id": {
 					"type": "string",
 					"format": "uuid"
@@ -18148,6 +18316,31 @@ const operationManifest = [
 			"items": {
 				"type": "object",
 				"properties": {
+					"receiver_capabilities": {
+						"type": "object",
+						"properties": {
+							"completion_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"http",
+										"exec",
+										"stdout",
+										"sdk"
+									]
+								}
+							},
+							"stream_protocols": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": ["primitive.events.v1"]
+								}
+							}
+						},
+						"required": ["completion_modes", "stream_protocols"]
+					},
 					"id": {
 						"type": "string",
 						"format": "uuid"
@@ -18589,6 +18782,31 @@ const operationManifest = [
 		"responseSchema": {
 			"type": "object",
 			"properties": {
+				"receiver_capabilities": {
+					"type": "object",
+					"properties": {
+						"completion_modes": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"enum": [
+									"http",
+									"exec",
+									"stdout",
+									"sdk"
+								]
+							}
+						},
+						"stream_protocols": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"enum": ["primitive.events.v1"]
+							}
+						}
+					},
+					"required": ["completion_modes", "stream_protocols"]
+				},
 				"id": {
 					"type": "string",
 					"format": "uuid"
@@ -24914,6 +25132,20 @@ const operationManifest = [
 				"name": "date_to",
 				"required": false,
 				"type": "string"
+			},
+			{
+				"description": "Literal case-insensitive substring filter over the\nsubject, the retained plain-text body, the sender, and\nthe To, CC and BCC recipients of each send. Matched\nverbatim: `%`, `_` and `\\` are ordinary characters and\ndo not act as wildcards, so a search for `10%` finds the\nliteral string `10%` rather than everything beginning\n`10`.\n\nLeading and trailing whitespace is trimmed, and the\nresult must be 3 to 500 UTF-16 code units. The\nthree-character minimum is the search index's: a shorter\npattern cannot be answered from the index and would scan\nthe whole mailbox, so it is rejected rather than served\nas a request that times out.\n\nThose bounds are deliberately NOT declared as\n`minLength`/`maxLength`. Both count Unicode code points\non the value as sent, while the server trims first and\ncounts UTF-16 code units, and the two disagree in both\ndirections: two astral characters are 2 code points but\n4 code units, so a declared minimum would reject a query\nthe server accepts, and `\"<499 chars> \"` is 500 code\npoints before trimming and 499 after, so a declared\nmaximum would reject another. Declaring a bound the\nserver does not enforce is worse than declaring none,\nbecause the client refuses locally and the caller never\nlearns why. The server validates; a violation is a `400`.\n\nRecipients are matched one address at a time rather than\nagainst the serialized recipient list, so a query\ncontaining a quote, comma or bracket matches only where\nthat character occurs inside an address. Bodies are\nsearched only where the plain-text body was retained;\nHTML-only bodies are not searched.\n\nNot served by every deployment. Where sent-mail search\nis not enabled the endpoint answers `503` with code\n`sent_mail_search_unavailable`, which callers should\ntreat as a capability answer and fall back on rather\nthan as an outage.\n",
+				"enum": null,
+				"name": "q",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "Exact case-insensitive sender mailbox filter. Returns\nonly sends whose from address equals this value; it is\nnot a substring match, so a partial mailbox matches\nnothing. Use `q` to search sender text loosely.\nCombines with every other filter, and unlike `q` it is\nserved by every deployment.\n",
+				"enum": null,
+				"name": "from",
+				"required": false,
+				"type": "string"
 			}
 		],
 		"requestSchema": null,
@@ -27601,7 +27833,7 @@ function isMemoryJsonValue(value, seen = /* @__PURE__ */ new Set()) {
 const API_HEADERS_ENV = "PRIMITIVE_API_HEADERS";
 const OAUTH_REFRESH_SKEW_MS = 60 * 1e3;
 const SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE = "Saved Primitive CLI OAuth session expired or was revoked. Run `primitive signin` to authenticate again.";
-function mergeHeaders(...headers) {
+function mergeHeaders$1(...headers) {
 	const merged = {};
 	for (const headerSet of headers) {
 		if (!headerSet) continue;
@@ -27639,7 +27871,7 @@ function resolveCliApiRequestConfig(params) {
 		apiBaseUrl,
 		baseUrlOverridden: apiBaseUrl !== void 0,
 		environmentName: currentEnvironment?.name ?? null,
-		headers: mergeHeaders(currentEnvironment?.config.headers, cliApiHeadersFromEnv(params.env)),
+		headers: mergeHeaders$1(currentEnvironment?.config.headers, cliApiHeadersFromEnv(params.env)),
 		resolvedApiBaseUrl: normalizeApiBaseUrl(apiBaseUrl)
 	};
 }
@@ -30292,7 +30524,7 @@ function checkApiKey(opts) {
 }
 async function checkAccount(client) {
 	try {
-		const result = await getAccount({
+		const result = await getAccount$1({
 			client: client.client,
 			responseStyle: "fields"
 		});
@@ -32071,8 +32303,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.26.0";
-const CLI_VERSION_RANGE = "^1.26.0";
+const SDK_VERSION_RANGE = "^1.27.0";
+const CLI_VERSION_RANGE = "^1.27.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -34106,6 +34338,11 @@ const FORWARDED_HEADERS = new Set([
 	"x-primitive-email-id",
 	"x-primitive-endpoint-id"
 ]);
+function normalizeForwardTarget(target) {
+	if (/^\d+$/.test(target)) return `http://localhost:${target}`;
+	if (/^(localhost|127\.0\.0\.1|\[::1\])(?::|\/|$)/.test(target)) return `http://${target}`;
+	return target;
+}
 function validateListenHandlerOptions(options) {
 	if (options.exec !== void 0 && process.platform === "win32") throw new Error("--exec requires a POSIX shell and process groups. On Windows, use --forward-to with a local HTTP handler.");
 	if (options.exec !== void 0 && options.forwardTo !== void 0) throw new Error("Choose either --exec or --forward-to.");
@@ -34113,7 +34350,7 @@ function validateListenHandlerOptions(options) {
 	if (options.forwardTo !== void 0) {
 		let url;
 		try {
-			url = new URL(options.forwardTo);
+			url = new URL(normalizeForwardTarget(options.forwardTo));
 		} catch {
 			throw new Error("--forward-to requires an HTTP or HTTPS URL.");
 		}
@@ -34258,7 +34495,7 @@ var ForwardFailure = class extends Error {
 };
 async function forward(target, delivery, signal) {
 	signal.throwIfAborted();
-	const url = new URL(target);
+	const url = new URL(normalizeForwardTarget(target));
 	const body = Buffer.from(delivery.body, "utf8");
 	const headers = {};
 	for (const [name, value] of Object.entries(delivery.headers)) if (FORWARDED_HEADERS.has(name.toLowerCase())) headers[name.toLowerCase()] = value;
@@ -34398,6 +34635,1169 @@ function createListenHandler(options = {}) {
 	};
 }
 //#endregion
+//#region ../sdk-node/dist/payloads-BMngnJlE.js
+/**
+* Load a Node builtin at call time. Exported for direct testing of the
+* unavailable-module error path; production code goes through the typed
+* wrappers below.
+*/
+async function loadBuiltin(specifier, operation) {
+	let builtin;
+	if (typeof process !== "undefined" && typeof process.getBuiltinModule === "function") try {
+		builtin = process.getBuiltinModule(specifier);
+	} catch {
+		builtin = void 0;
+	}
+	if (builtin !== void 0 && builtin !== null) return builtin;
+	try {
+		return await import(specifier);
+	} catch (cause) {
+		throw new Error(`${operation} requires file system access, which this runtime does not provide. Pass in-memory bytes instead of a file path when running outside Node.js.`, { cause });
+	}
+}
+/** `node:fs`, loaded lazily so Workers-style bundles never see the import. */
+function loadNodeFs(operation) {
+	return loadBuiltin("node:fs", operation);
+}
+/** `node:fs/promises`, loaded lazily for the same reason as {@link loadNodeFs}. */
+function loadNodeFsPromises(operation) {
+	return loadBuiltin("node:fs/promises", operation);
+}
+const CHUNK_SIZE = 64 * 1024 * 1024;
+const MANIFEST_VERSION = 1;
+const CHUNK_KDF_INFO = "payloads-chunk";
+const OBJECT_ID_BYTES = 16;
+const CEK_BYTES = 32;
+function subtle() {
+	return globalThis.crypto.subtle;
+}
+const textEncoder = new TextEncoder();
+function randomBytes(length) {
+	const out = new Uint8Array(length);
+	globalThis.crypto.getRandomValues(out);
+	return out;
+}
+function toHex(bytes) {
+	let out = "";
+	for (const b of bytes) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+function fromHex(hex) {
+	if (hex.length % 2 !== 0) throw new Error("invalid hex: odd length");
+	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("invalid hex: non-hex character");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+	return out;
+}
+async function contentHash(bytes) {
+	return new Uint8Array(await subtle().digest("SHA-256", bytes));
+}
+async function contentHashHex(bytes) {
+	return toHex(await contentHash(bytes));
+}
+/** Binary Merkle root over ordered hex leaf hashes (odd node promoted). */
+async function merkleRoot(leafHashesHex) {
+	if (leafHashesHex.length === 0) return contentHashHex(new Uint8Array(0));
+	let level = leafHashesHex.map(fromHex);
+	while (level.length > 1) {
+		const next = [];
+		for (let i = 0; i < level.length; i += 2) {
+			const left = level[i];
+			const right = i + 1 < level.length ? level[i + 1] : level[i];
+			const combined = new Uint8Array(left.length + right.length);
+			combined.set(left, 0);
+			combined.set(right, left.length);
+			next.push(await contentHash(combined));
+		}
+		level = next;
+	}
+	return toHex(level[0]);
+}
+async function deriveChunkKey(cek, index) {
+	const baseKey = await subtle().importKey("raw", cek, "HKDF", false, ["deriveKey"]);
+	const info = textEncoder.encode(`${CHUNK_KDF_INFO}:${index}`);
+	return subtle().deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(32),
+		info
+	}, baseKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+function chunkNonce(index) {
+	const nonce = new Uint8Array(12);
+	new DataView(nonce.buffer).setUint32(8, index >>> 0, false);
+	return nonce;
+}
+function chunkAad(objectId, index) {
+	const aad = new Uint8Array(objectId.length + 4);
+	aad.set(objectId, 0);
+	new DataView(aad.buffer).setUint32(objectId.length, index >>> 0, false);
+	return aad;
+}
+async function encryptChunk(cek, objectId, index, plaintext) {
+	const key = await deriveChunkKey(cek, index);
+	const ct = await subtle().encrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, plaintext);
+	return new Uint8Array(ct);
+}
+async function decryptChunk(cek, objectId, index, ciphertext) {
+	const key = await deriveChunkKey(cek, index);
+	const pt = await subtle().decrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, ciphertext);
+	return new Uint8Array(pt);
+}
+function authHeaders(apiKey) {
+	return { authorization: `Bearer ${apiKey}` };
+}
+function apiRoot(baseUrl) {
+	let end = baseUrl.length;
+	while (end > 0 && baseUrl.charCodeAt(end - 1) === 47) end--;
+	return `${baseUrl.slice(0, end)}/v1/payloads`;
+}
+const DEFAULT_MAX_RETRIES = 6;
+const RETRYABLE_STATUS = new Set([
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+function sleep$1(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* fetch with exponential backoff on transient failures. Request bodies here are
+* in-memory buffers/strings (never streams), so a retry can safely resend them.
+*/
+async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES) {
+	for (let attempt = 0;; attempt++) {
+		let res;
+		let networkError;
+		try {
+			res = await fetch(url, init);
+		} catch (err) {
+			networkError = err;
+		}
+		if (res && !RETRYABLE_STATUS.has(res.status)) return res;
+		if (attempt >= maxRetries) {
+			if (res) return res;
+			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
+		}
+		if (res) await res.text().catch(() => {});
+		await sleep$1(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
+	}
+}
+async function initiate(opts, manifest) {
+	const res = await retryingFetch(apiRoot(opts.baseUrl), {
+		method: "POST",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({ manifest })
+	}, "initiate");
+	if (!res.ok) throw new Error(`initiate failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function putChunk(opts, root, d, bytes) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, {
+		method: "PUT",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/octet-stream"
+		},
+		body: bytes
+	}, `chunk ${d.index} upload`);
+	if (!res.ok) throw new Error(`chunk ${d.index} upload failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function finalize(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/finalize`, {
+		method: "POST",
+		headers: authHeaders(opts.apiKey)
+	}, "finalize");
+	if (!res.ok) throw new Error(`finalize failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function fetchManifest(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/manifest`, { headers: authHeaders(opts.apiKey) }, "get manifest");
+	if (!res.ok) throw new Error(`get manifest failed: HTTP ${res.status} ${await res.text()}`);
+	return (await res.json()).data.manifest;
+}
+async function getChunkBytes(opts, root, d) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, { headers: authHeaders(opts.apiKey) }, `get chunk ${d.index}`);
+	if (!res.ok) throw new Error(`get chunk ${d.index} failed: HTTP ${res.status}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+async function readWindow(fh, position, length) {
+	const buf = Buffer.allocUnsafe(length);
+	let read = 0;
+	while (read < length) {
+		const { bytesRead } = await fh.read(buf, read, length - read, position + read);
+		if (bytesRead === 0) break;
+		read += bytesRead;
+	}
+	return read === length ? buf : buf.subarray(0, read);
+}
+async function mapLimit(items, limit, fn) {
+	let next = 0;
+	let firstError;
+	const worker = async () => {
+		while (next < items.length && firstError === void 0) {
+			const i = next++;
+			try {
+				await fn(items[i], i);
+			} catch (err) {
+				if (firstError === void 0) firstError = err;
+				return;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length || 1) }, () => worker()));
+	if (firstError !== void 0) throw firstError;
+}
+/**
+* Stream a file up as a Primitive Payload. Two passes over the file (encrypt to
+* build the manifest, then encrypt again to upload) keep memory bounded to a few
+* chunks — the whole object is never resident. Returns the content address
+* (merkleRoot) and the hex CEK needed to download it.
+*/
+async function pushFile(filePath, opts) {
+	const { open, stat } = await loadNodeFsPromises("pushFile");
+	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
+	const concurrency = opts.concurrency ?? 3;
+	const { size } = await stat(filePath);
+	const cek = randomBytes(CEK_BYTES);
+	const objectId = randomBytes(OBJECT_ID_BYTES);
+	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
+	const fh = await open(filePath, "r");
+	try {
+		const descriptors = [];
+		for (let index = 0; index < chunkCount; index++) {
+			const position = index * chunkSize;
+			const length = Math.min(chunkSize, size - position);
+			const plaintext = await readWindow(fh, position, length);
+			const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
+			descriptors.push({
+				index,
+				ciphertextHash: await contentHashHex(ciphertext),
+				plaintextSize: length,
+				ciphertextSize: ciphertext.length
+			});
+			opts.onProgress?.("encrypt", index + 1, chunkCount);
+		}
+		const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
+		await initiate(opts, {
+			version: MANIFEST_VERSION,
+			objectId: toHex(objectId),
+			chunkSize,
+			totalPlaintextSize: size,
+			chunkCount,
+			chunks: descriptors,
+			merkleRoot: root
+		});
+		let uploaded = 0;
+		await mapLimit(descriptors, concurrency, async (d) => {
+			const plaintext = await readWindow(fh, d.index * chunkSize, d.plaintextSize);
+			await putChunk(opts, root, d, await encryptChunk(cek, objectId, d.index, plaintext));
+			opts.onProgress?.("upload", ++uploaded, chunkCount);
+		});
+		await finalize(opts, root);
+		return {
+			merkleRoot: root,
+			cek: toHex(cek),
+			chunkCount,
+			totalBytes: size
+		};
+	} finally {
+		await fh.close();
+	}
+}
+/**
+* Stream a Primitive Payload down to a file, verifying and decrypting one chunk
+* at a time (bounded memory). Every chunk is content-address-checked before
+* decryption, so a corrupt or substituted chunk throws.
+*/
+async function pullFile(root, outPath, opts) {
+	const { createWriteStream } = await loadNodeFs("pullFile");
+	const { rm } = await loadNodeFsPromises("pullFile");
+	const manifest = await fetchManifest(opts, root);
+	const computedRoot = await merkleRoot(manifest.chunks.map((c) => c.ciphertextHash));
+	if (computedRoot !== root) throw new Error(`manifest does not match the requested content address (got ${computedRoot})`);
+	const cek = fromHex(opts.cek);
+	const objectId = fromHex(manifest.objectId);
+	const out = createWriteStream(outPath);
+	let onWriteError = () => {};
+	const writeErrored = new Promise((_, reject) => {
+		onWriteError = reject;
+	});
+	writeErrored.catch(() => {});
+	out.on("error", (err) => onWriteError(err));
+	try {
+		let done = 0;
+		for (const d of manifest.chunks) {
+			const ciphertext = await getChunkBytes(opts, root, d);
+			if (await contentHashHex(ciphertext) !== d.ciphertextHash) throw new Error(`chunk ${d.index} failed integrity check`);
+			const plaintext = await decryptChunk(cek, objectId, d.index, ciphertext);
+			if (!out.write(plaintext)) await Promise.race([new Promise((resolve) => out.once("drain", resolve)), writeErrored]);
+			opts.onProgress?.("download", ++done, manifest.chunkCount);
+		}
+		await Promise.race([new Promise((resolve) => out.end(resolve)), writeErrored]);
+	} catch (err) {
+		out.destroy();
+		await rm(outPath, { force: true });
+		throw err;
+	}
+	return manifest;
+}
+//#endregion
+//#region ../sdk-node/dist/api-D4xf448r.js
+const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
+function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
+	let lastEventId;
+	const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const createStream = async function* () {
+		let retryDelay = sseDefaultRetryDelay ?? 3e3;
+		let attempt = 0;
+		const signal = options.signal ?? new AbortController().signal;
+		while (true) {
+			if (signal.aborted) break;
+			attempt++;
+			const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+			if (lastEventId !== void 0) headers.set("Last-Event-ID", lastEventId);
+			try {
+				const requestInit = {
+					redirect: "follow",
+					...options,
+					body: options.serializedBody,
+					headers,
+					signal
+				};
+				let request = new Request(url, requestInit);
+				if (onRequest) request = await onRequest(url, requestInit);
+				const response = await (options.fetch ?? globalThis.fetch)(request);
+				if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+				if (!response.body) throw new Error("No body in SSE response");
+				const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+				let buffer = "";
+				const abortHandler = () => {
+					try {
+						reader.cancel();
+					} catch {}
+				};
+				signal.addEventListener("abort", abortHandler);
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						buffer += value;
+						buffer = buffer.replace(/\r\n?/g, "\n");
+						const chunks = buffer.split("\n\n");
+						buffer = chunks.pop() ?? "";
+						for (const chunk of chunks) {
+							const lines = chunk.split("\n");
+							const dataLines = [];
+							let eventName;
+							for (const line of lines) if (line.startsWith("data:")) dataLines.push(line.replace(/^data:\s*/, ""));
+							else if (line.startsWith("event:")) eventName = line.replace(/^event:\s*/, "");
+							else if (line.startsWith("id:")) lastEventId = line.replace(/^id:\s*/, "");
+							else if (line.startsWith("retry:")) {
+								const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+								if (!Number.isNaN(parsed)) retryDelay = parsed;
+							}
+							let data;
+							let parsedJson = false;
+							if (dataLines.length) {
+								const rawData = dataLines.join("\n");
+								try {
+									data = JSON.parse(rawData);
+									parsedJson = true;
+								} catch {
+									data = rawData;
+								}
+							}
+							if (parsedJson) {
+								if (responseValidator) await responseValidator(data);
+								if (responseTransformer) data = await responseTransformer(data);
+							}
+							onSseEvent?.({
+								data,
+								event: eventName,
+								id: lastEventId,
+								retry: retryDelay
+							});
+							if (dataLines.length) yield data;
+						}
+					}
+				} finally {
+					signal.removeEventListener("abort", abortHandler);
+					reader.releaseLock();
+				}
+				break;
+			} catch (error) {
+				onSseError?.(error);
+				if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) break;
+				await sleep(Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4));
+			}
+		}
+	};
+	return { stream: createStream() };
+}
+const separatorArrayExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const separatorArrayNoExplode = (style) => {
+	switch (style) {
+		case "form": return ",";
+		case "pipeDelimited": return "|";
+		case "spaceDelimited": return "%20";
+		default: return ",";
+	}
+};
+const separatorObjectExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const serializeArrayParam = ({ allowReserved, explode, name, style, value }) => {
+	if (!explode) {
+		const joinedValues = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+		switch (style) {
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			case "simple": return joinedValues;
+			default: return `${name}=${joinedValues}`;
+		}
+	}
+	const separator = separatorArrayExplode(style);
+	const joinedValues = value.map((v) => {
+		if (style === "label" || style === "simple") return allowReserved ? v : encodeURIComponent(v);
+		return serializePrimitiveParam({
+			allowReserved,
+			name,
+			value: v
+		});
+	}).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+const serializePrimitiveParam = ({ allowReserved, name, value }) => {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+const serializeObjectParam = ({ allowReserved, explode, name, style, value, valueOnly }) => {
+	if (value instanceof Date) return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+	if (style !== "deepObject" && !explode) {
+		let values = [];
+		Object.entries(value).forEach(([key, v]) => {
+			values = [
+				...values,
+				key,
+				allowReserved ? v : encodeURIComponent(v)
+			];
+		});
+		const joinedValues = values.join(",");
+		switch (style) {
+			case "form": return `${name}=${joinedValues}`;
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			default: return joinedValues;
+		}
+	}
+	const separator = separatorObjectExplode(style);
+	const joinedValues = Object.entries(value).map(([key, v]) => serializePrimitiveParam({
+		allowReserved,
+		name: style === "deepObject" ? `${name}[${key}]` : key,
+		value: v
+	})).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+const PATH_PARAM_RE = /\{[^{}]+\}/g;
+const defaultPathSerializer = ({ path, url: _url }) => {
+	let url = _url;
+	const matches = _url.match(PATH_PARAM_RE);
+	if (matches) for (const match of matches) {
+		let explode = false;
+		let name = match.substring(1, match.length - 1);
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			name = name.substring(1);
+			style = "label";
+		} else if (name.startsWith(";")) {
+			name = name.substring(1);
+			style = "matrix";
+		}
+		const value = path[name];
+		if (value === void 0 || value === null) continue;
+		if (Array.isArray(value)) {
+			url = url.replace(match, serializeArrayParam({
+				explode,
+				name,
+				style,
+				value
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			url = url.replace(match, serializeObjectParam({
+				explode,
+				name,
+				style,
+				value,
+				valueOnly: true
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			url = url.replace(match, `;${serializePrimitiveParam({
+				name,
+				value
+			})}`);
+			continue;
+		}
+		const replaceValue = encodeURIComponent(style === "label" ? `.${value}` : value);
+		url = url.replace(match, replaceValue);
+	}
+	return url;
+};
+const getUrl = ({ baseUrl, path, query, querySerializer, url: _url }) => {
+	const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+	let url = (baseUrl ?? "") + pathUrl;
+	if (path) url = defaultPathSerializer({
+		path,
+		url
+	});
+	let search = query ? querySerializer(query) : "";
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) url += `?${search}`;
+	return url;
+};
+function getValidRequestBody(options) {
+	const hasBody = options.body !== void 0;
+	if (hasBody && options.bodySerializer) {
+		if ("serializedBody" in options) return options.serializedBody !== void 0 && options.serializedBody !== "" ? options.serializedBody : null;
+		return options.body !== "" ? options.body : null;
+	}
+	if (hasBody) return options.body;
+}
+const getAuthToken = async (auth, callback) => {
+	const token = typeof callback === "function" ? await callback(auth) : callback;
+	if (!token) return;
+	if (auth.scheme === "bearer") return `Bearer ${token}`;
+	if (auth.scheme === "basic") return `Basic ${btoa(token)}`;
+	return token;
+};
+const createQuerySerializer = ({ parameters = {}, ...args } = {}) => {
+	const querySerializer = (queryParams) => {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			const options = parameters[name] || args;
+			if (Array.isArray(value)) {
+				const serializedArray = serializeArrayParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "form",
+					value,
+					...options.array
+				});
+				if (serializedArray) search.push(serializedArray);
+			} else if (typeof value === "object") {
+				const serializedObject = serializeObjectParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "deepObject",
+					value,
+					...options.object
+				});
+				if (serializedObject) search.push(serializedObject);
+			} else {
+				const serializedPrimitive = serializePrimitiveParam({
+					allowReserved: options.allowReserved,
+					name,
+					value
+				});
+				if (serializedPrimitive) search.push(serializedPrimitive);
+			}
+		}
+		return search.join("&");
+	};
+	return querySerializer;
+};
+/**
+* Infers parseAs value from provided Content-Type header.
+*/
+const getParseAs = (contentType) => {
+	if (!contentType) return "stream";
+	const cleanContent = contentType.split(";")[0]?.trim();
+	if (!cleanContent) return;
+	if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) return "json";
+	if (cleanContent === "multipart/form-data") return "formData";
+	if ([
+		"application/",
+		"audio/",
+		"image/",
+		"video/"
+	].some((type) => cleanContent.startsWith(type))) return "blob";
+	if (cleanContent.startsWith("text/")) return "text";
+};
+const checkForExistence = (options, name) => {
+	if (!name) return false;
+	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
+	return false;
+};
+async function setAuthParams(options) {
+	for (const auth of options.security ?? []) {
+		if (checkForExistence(options, auth.name)) continue;
+		const token = await getAuthToken(auth, options.auth);
+		if (!token) continue;
+		const name = auth.name ?? "Authorization";
+		switch (auth.in) {
+			case "query":
+				if (!options.query) options.query = {};
+				options.query[name] = token;
+				break;
+			case "cookie":
+				options.headers.append("Cookie", `${name}=${token}`);
+				break;
+			default:
+				options.headers.set(name, token);
+				break;
+		}
+	}
+}
+const buildUrl = (options) => getUrl({
+	baseUrl: options.baseUrl,
+	path: options.path,
+	query: options.query,
+	querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+	url: options.url
+});
+const mergeConfigs = (a, b) => {
+	const config = {
+		...a,
+		...b
+	};
+	if (config.baseUrl?.endsWith("/")) config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+	config.headers = mergeHeaders(a.headers, b.headers);
+	return config;
+};
+const headersEntries = (headers) => {
+	const entries = [];
+	headers.forEach((value, key) => {
+		entries.push([key, value]);
+	});
+	return entries;
+};
+const mergeHeaders = (...headers) => {
+	const mergedHeaders = new Headers();
+	for (const header of headers) {
+		if (!header) continue;
+		const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+		for (const [key, value] of iterator) if (value === null) mergedHeaders.delete(key);
+		else if (Array.isArray(value)) for (const v of value) mergedHeaders.append(key, v);
+		else if (value !== void 0) mergedHeaders.set(key, typeof value === "object" ? JSON.stringify(value) : value);
+	}
+	return mergedHeaders;
+};
+var Interceptors = class {
+	fns = [];
+	clear() {
+		this.fns = [];
+	}
+	eject(id) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) this.fns[index] = null;
+	}
+	exists(id) {
+		const index = this.getInterceptorIndex(id);
+		return Boolean(this.fns[index]);
+	}
+	getInterceptorIndex(id) {
+		if (typeof id === "number") return this.fns[id] ? id : -1;
+		return this.fns.indexOf(id);
+	}
+	update(id, fn) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) {
+			this.fns[index] = fn;
+			return id;
+		}
+		return false;
+	}
+	use(fn) {
+		this.fns.push(fn);
+		return this.fns.length - 1;
+	}
+};
+const createInterceptors = () => ({
+	error: new Interceptors(),
+	request: new Interceptors(),
+	response: new Interceptors()
+});
+const defaultQuerySerializer = createQuerySerializer({
+	allowReserved: false,
+	array: {
+		explode: true,
+		style: "form"
+	},
+	object: {
+		explode: true,
+		style: "deepObject"
+	}
+});
+const defaultHeaders = { "Content-Type": "application/json" };
+const createConfig = (override = {}) => ({
+	...jsonBodySerializer,
+	headers: defaultHeaders,
+	parseAs: "auto",
+	querySerializer: defaultQuerySerializer,
+	...override
+});
+const createClient = (config = {}) => {
+	let _config = mergeConfigs(createConfig(), config);
+	const getConfig = () => ({ ..._config });
+	const setConfig = (config) => {
+		_config = mergeConfigs(_config, config);
+		return getConfig();
+	};
+	const interceptors = createInterceptors();
+	const beforeRequest = async (options) => {
+		const opts = {
+			..._config,
+			...options,
+			fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+			headers: mergeHeaders(_config.headers, options.headers),
+			serializedBody: void 0
+		};
+		if (opts.security) await setAuthParams(opts);
+		if (opts.requestValidator) await opts.requestValidator(opts);
+		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
+		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
+		const resolvedOpts = opts;
+		return {
+			opts: resolvedOpts,
+			url: buildUrl(resolvedOpts)
+		};
+	};
+	const request = async (options) => {
+		const throwOnError = options.throwOnError ?? _config.throwOnError;
+		const responseStyle = options.responseStyle ?? _config.responseStyle;
+		let request;
+		let response;
+		try {
+			const { opts, url } = await beforeRequest(options);
+			const requestInit = {
+				redirect: "follow",
+				...opts,
+				body: getValidRequestBody(opts)
+			};
+			request = new Request(url, requestInit);
+			for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+			const _fetch = opts.fetch;
+			response = await _fetch(request);
+			for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+			const result = {
+				request,
+				response
+			};
+			if (response.ok) {
+				const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+				if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+					let emptyData;
+					switch (parseAs) {
+						case "arrayBuffer":
+						case "blob":
+						case "text":
+							emptyData = await response[parseAs]();
+							break;
+						case "formData":
+							emptyData = new FormData();
+							break;
+						case "stream":
+							emptyData = response.body;
+							break;
+						default:
+							emptyData = {};
+							break;
+					}
+					return opts.responseStyle === "data" ? emptyData : {
+						data: emptyData,
+						...result
+					};
+				}
+				let data;
+				switch (parseAs) {
+					case "arrayBuffer":
+					case "blob":
+					case "formData":
+					case "text":
+						data = await response[parseAs]();
+						break;
+					case "json": {
+						const text = await response.text();
+						data = text ? JSON.parse(text) : {};
+						break;
+					}
+					case "stream": return opts.responseStyle === "data" ? response.body : {
+						data: response.body,
+						...result
+					};
+				}
+				if (parseAs === "json") {
+					if (opts.responseValidator) await opts.responseValidator(data);
+					if (opts.responseTransformer) data = await opts.responseTransformer(data);
+				}
+				return opts.responseStyle === "data" ? data : {
+					data,
+					...result
+				};
+			}
+			const textError = await response.text();
+			let jsonError;
+			try {
+				jsonError = JSON.parse(textError);
+			} catch {}
+			throw jsonError ?? textError;
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(finalError, response, request, options);
+			finalError = finalError || {};
+			if (throwOnError) throw finalError;
+			return responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response
+			};
+		}
+	};
+	const makeMethodFn = (method) => (options) => request({
+		...options,
+		method
+	});
+	const makeSseFn = (method) => async (options) => {
+		const { opts, url } = await beforeRequest(options);
+		return createSseClient({
+			...opts,
+			body: opts.body,
+			method,
+			onRequest: async (url, init) => {
+				let request = new Request(url, init);
+				for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+				return request;
+			},
+			serializedBody: getValidRequestBody(opts),
+			url
+		});
+	};
+	const _buildUrl = (options) => buildUrl({
+		..._config,
+		...options
+	});
+	return {
+		buildUrl: _buildUrl,
+		connect: makeMethodFn("CONNECT"),
+		delete: makeMethodFn("DELETE"),
+		get: makeMethodFn("GET"),
+		getConfig,
+		head: makeMethodFn("HEAD"),
+		interceptors,
+		options: makeMethodFn("OPTIONS"),
+		patch: makeMethodFn("PATCH"),
+		post: makeMethodFn("POST"),
+		put: makeMethodFn("PUT"),
+		request,
+		setConfig,
+		sse: {
+			connect: makeSseFn("CONNECT"),
+			delete: makeSseFn("DELETE"),
+			get: makeSseFn("GET"),
+			head: makeSseFn("HEAD"),
+			options: makeSseFn("OPTIONS"),
+			patch: makeSseFn("PATCH"),
+			post: makeSseFn("POST"),
+			put: makeSseFn("PUT"),
+			trace: makeSseFn("TRACE")
+		},
+		trace: makeMethodFn("TRACE")
+	};
+};
+const client$1 = createClient(createConfig({ baseUrl: "https://api.primitive.dev/v1" }));
+/**
+* Get account info
+*/
+const getAccount = (options) => (options?.client ?? client$1).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/account",
+	...options
+});
+/**
+* Receive a pending webhook event without a public endpoint
+*
+* Wait up to 30 seconds for one existing event. The body string preserves the exact webhook serialization; headers and canonical occurrence/type metadata travel alongside it. A fixed lease protects the attempt while a short handler accepts input. Retry may redeliver an occurrence: deduplicate event_id. Empty delivery means no offer now, not proof all input was delivered; inspect backlog and persistent gap_count/last_gap_reason. Queue retention is 24 hours and does not extend source-content retention. Disconnecting preserves pending work. Same named destination shares consumption; different destinations get independent copies.
+*/
+const pullWebhookEvent = (options) => (options.client ?? client$1).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/pull",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Report the outcome of a local webhook delivery attempt
+*
+* Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
+*/
+const completeWebhookEvent = (options) => (options.client ?? client$1).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/complete",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+var EventReceiverError = class extends Error {
+	constructor(message, code, status = 0, retryAfterMs = 0) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.retryAfterMs = retryAfterMs;
+		this.name = "EventReceiverError";
+	}
+};
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateOffer(value) {
+	if (!record(value) || !Number.isSafeInteger(value.backlog) || Number(value.backlog) < 0 || !Number.isSafeInteger(value.gap_count) || Number(value.gap_count) < 0 || value.last_gap_reason !== null && typeof value.last_gap_reason !== "string" || value.retention_seconds !== 86400 || value.handler_timeout_seconds !== 30) throw new EventReceiverError("Invalid event status response", "invalid_response");
+	const d = value.delivery;
+	if (d !== null && (!record(d) || ![
+		"queue_id",
+		"event_id",
+		"delivery_id",
+		"lease_token",
+		"event_type",
+		"body",
+		"lease_expires_at"
+	].every((key) => typeof d[key] === "string") || !Number.isFinite(Date.parse(String(d.lease_expires_at))) || !record(d.headers) || !Object.values(d.headers).every((header) => typeof header === "string"))) throw new EventReceiverError("Invalid event delivery response", "invalid_response");
+	return value;
+}
+function retryAfter(value) {
+	if (!value) return 0;
+	const ms = /^\d+(\.\d+)?$/.test(value) ? Number(value) * 1e3 : Date.parse(value) - Date.now();
+	return Number.isFinite(ms) ? Math.max(0, ms) : 0;
+}
+function unwrap(result) {
+	if (result.data !== void 0 && !result.error) return result.data;
+	const code = record(result.error) && record(result.error.error) && typeof result.error.error.code === "string" ? result.error.error.code : "request_failed";
+	throw new EventReceiverError(`Event request failed (${result.response?.status ?? 0}, ${code})`, code, result.response?.status ?? 0, retryAfter(result.response?.headers.get("retry-after") ?? null));
+}
+/** Shared by the SDK and CLI. Completion retries preserve the original evidence. */
+var EventConnection = class {
+	socket;
+	pending;
+	accountId;
+	touch;
+	constructor(client, endpointId, options = {}) {
+		this.client = client;
+		this.endpointId = endpointId;
+		this.options = options;
+	}
+	close() {
+		const socket = this.socket;
+		this.socket = void 0;
+		this.pending?.reject(new EventReceiverError("Event connection closed", "disconnected"));
+		this.pending = void 0;
+		socket?.close();
+	}
+	async open(signal) {
+		if (this.options.transport === "poll" || this.socket?.readyState === 1) return;
+		const account = unwrap(await getAccount({
+			client: this.client,
+			responseStyle: "fields",
+			throwOnError: false,
+			signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
+		}));
+		if (!account.data?.id || this.accountId && account.data.id !== this.accountId) throw new EventReceiverError("The authenticated account changed; restart the receiver", "identity_changed", 403);
+		this.accountId = account.data.id;
+		const config = this.client.getConfig();
+		const auth = typeof config.auth === "function" ? await config.auth({
+			type: "http",
+			scheme: "bearer"
+		}) : config.auth;
+		const authorization = new Headers(config.headers).get("authorization");
+		const token = typeof auth === "string" ? auth.replace(/^Bearer /i, "") : authorization?.replace(/^Bearer /i, "");
+		if (!token) throw new EventReceiverError("Event receiver requires bearer credentials", "unauthorized", 401);
+		const url = new URL(`${config.baseUrl?.replace(/\/+$/, "")}/endpoints/${encodeURIComponent(this.endpointId)}/stream`);
+		if (url.protocol !== "https:" && !(url.protocol === "http:" && [
+			"localhost",
+			"127.0.0.1",
+			"[::1]"
+		].includes(url.hostname))) throw new EventReceiverError("Event connections require HTTPS (except loopback development)", "unsupported");
+		url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+		const socket = (this.options.webSocketFactory ?? ((address, protocol) => new WebSocket(address, protocol)))(url.href, "primitive.events.v1");
+		this.socket = socket;
+		socket.addEventListener("message", (message) => {
+			if (this.socket !== socket) return;
+			let frame;
+			try {
+				frame = JSON.parse(String(message.data));
+			} catch {
+				this.fail(new EventReceiverError("Invalid event frame", "invalid_response"));
+				return;
+			}
+			this.touch?.();
+			if (!record(frame)) {
+				this.fail(new EventReceiverError("Invalid event frame", "invalid_response"));
+				return;
+			}
+			if (frame.type === "ping") {
+				socket.send(JSON.stringify({ type: "pong" }));
+				return;
+			}
+			if (frame.type === "status") {
+				try {
+					this.options.onStatus?.(validateOffer(frame.data));
+				} catch (error) {
+					this.fail(error);
+				}
+				return;
+			}
+			if (frame.type === "error") {
+				this.fail(new EventReceiverError("Event stream request failed", typeof frame.code === "string" ? frame.code : "request_failed", typeof frame.status === "number" ? frame.status : 0, retryAfter(typeof frame.retry_after === "string" ? frame.retry_after : null)));
+				return;
+			}
+			this.pending?.resolve(frame);
+		});
+		socket.addEventListener("close", () => {
+			if (this.socket === socket) this.fail(new EventReceiverError("Event stream disconnected", "disconnected"));
+		});
+		socket.addEventListener("error", () => {
+			if (this.socket === socket) this.fail(new EventReceiverError("Event stream connection failed", "disconnected"));
+		});
+		const ready = await this.exchange(signal, void 0, () => {
+			socket.addEventListener("open", () => socket.send(JSON.stringify({
+				type: "authenticate",
+				token
+			})), { once: true });
+		}, 15e3);
+		if (!record(ready) || ready.type !== "ready" || ready.protocol !== "primitive.events.v1") {
+			this.close();
+			throw new EventReceiverError("Unsupported event stream protocol", "unsupported");
+		}
+	}
+	fail(error) {
+		this.pending?.reject(error);
+		this.pending = void 0;
+		this.close();
+	}
+	async exchange(signal, frame, start, timeoutMs = 6e4) {
+		signal.throwIfAborted();
+		if (this.pending) throw new EventReceiverError("Concurrent event operation", "busy", 409);
+		let cleanup = () => {};
+		try {
+			return await new Promise((resolve, reject) => {
+				const abort = () => {
+					reject(signal.reason);
+					this.close();
+				};
+				let timer;
+				this.touch = () => {
+					clearTimeout(timer);
+					timer = setTimeout(() => this.fail(new EventReceiverError("Event stream timed out", "disconnected")), timeoutMs);
+				};
+				this.touch();
+				cleanup = () => {
+					this.touch = void 0;
+					clearTimeout(timer);
+					signal.removeEventListener("abort", abort);
+					this.pending = void 0;
+				};
+				this.pending = {
+					resolve,
+					reject
+				};
+				signal.addEventListener("abort", abort, { once: true });
+				if (frame) this.socket?.send(JSON.stringify(frame));
+				start?.();
+			});
+		} finally {
+			cleanup();
+		}
+	}
+	async receive(signal) {
+		if (this.options.transport === "poll") return validateOffer(unwrap(await pullWebhookEvent({
+			client: this.client,
+			path: { id: this.endpointId },
+			body: { wait_seconds: 25 },
+			responseStyle: "fields",
+			throwOnError: false,
+			signal: AbortSignal.any([signal, AbortSignal.timeout(45e3)])
+		})).data);
+		await this.open(signal);
+		const frame = await this.exchange(signal, { type: "receive" }, void 0, 9e4);
+		if (!record(frame) || frame.type !== "event") throw new EventReceiverError("Invalid event frame", "invalid_response");
+		return validateOffer(frame.data);
+	}
+	async complete(body, signal) {
+		let receipt;
+		if (this.options.transport === "poll") receipt = unwrap(await completeWebhookEvent({
+			client: this.client,
+			path: { id: this.endpointId },
+			body,
+			responseStyle: "fields",
+			throwOnError: false,
+			signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
+		})).data;
+		else {
+			await this.open(signal);
+			const frame = await this.exchange(signal, {
+				type: "complete",
+				body
+			}, void 0, 15e3);
+			if (!record(frame) || frame.type !== "receipt") throw new EventReceiverError("Invalid event receipt", "invalid_response");
+			receipt = frame.data;
+		}
+		if (!record(receipt) || !["completed", "already_completed"].includes(String(receipt.result))) throw new EventReceiverError("Invalid event receipt", "invalid_response");
+	}
+};
+//#endregion
 //#region src/oclif/listen-state.ts
 var ListenStateError = class extends Error {};
 function normalizeListenOrigin(value) {
@@ -34683,6 +36083,7 @@ async function runListen(options) {
 	let verified = false;
 	let confirmed = 0;
 	let release;
+	let stream;
 	async function retry(operation) {
 		for (let attempt = 0;; attempt++) {
 			signal.throwIfAborted();
@@ -34693,9 +36094,14 @@ async function runListen(options) {
 				error = failure(result, now());
 			} catch (caught) {
 				if (signal.aborted) throw signal.reason;
-				if (caught instanceof ListenError) throw caught;
-				if (caught instanceof SyntaxError) throw new ListenError("The API returned malformed JSON.");
-				error = new RequestFailure(0, "transport", 0);
+				if (caught instanceof EventReceiverError) {
+					if (["invalid_response", "unsupported"].includes(caught.code)) throw new ListenError(caught.message);
+					error = new RequestFailure(caught.status, caught.code, caught.retryAfterMs);
+				} else {
+					if (caught instanceof ListenError) throw caught;
+					if (caught instanceof SyntaxError) throw new ListenError("The API returned malformed JSON.");
+					error = new RequestFailure(0, "transport", 0);
+				}
 			}
 			if (![
 				0,
@@ -34719,7 +36125,7 @@ async function runListen(options) {
 					signal: AbortSignal.any([
 						signal,
 						...init?.signal ? [init.signal] : [],
-						AbortSignal.timeout(3e4)
+						AbortSignal.timeout(45e3)
 					])
 				})
 			});
@@ -34730,7 +36136,7 @@ async function runListen(options) {
 		if (origin !== void 0 && origin !== base) throw new ListenError("The API environment changed while listening. Restart the listener.");
 		origin = base;
 		if (!verified || auth.auth.apiKey !== verifiedKey) {
-			const account = await retry(() => getAccount({
+			const account = await retry(() => getAccount$1({
 				client: auth.apiClient.client,
 				responseStyle: "fields",
 				signal: AbortSignal.any([signal, AbortSignal.timeout(3e4)])
@@ -34766,6 +36172,12 @@ async function runListen(options) {
 		});
 		const endpoint = registered.data;
 		if (registered.success !== true || !endpoint || typeof endpoint.id !== "string" || endpoint.kind !== "pull" || endpoint.enabled === false) throw new ListenError("The API did not return an enabled pull subscription.");
+		const streamClient = await freshClient();
+		if (options.transport !== "poll") {
+			if (!endpoint.receiver_capabilities?.stream_protocols.includes("primitive.events.v1")) throw new ListenError("This API does not support WebSocket events. Use --transport poll explicitly for an older API.");
+			if (!endpoint.receiver_capabilities.completion_modes.includes(options.mode ?? "stdout")) throw new ListenError("This API does not support the selected listener handler mode.");
+			stream = new EventConnection(streamClient, endpoint.id);
+		}
 		const selected = endpoint.rules?.event_types;
 		const selection = Array.isArray(selected) && selected.every((value) => typeof value === "string" && /^[a-zA-Z0-9_.-]+$/.test(value)) ? selected.join(", ") : "all events";
 		stderr.write(`Listening on subscription ${subscription.name} (${endpoint.id}); ${resumed ? "resumed" : "created"}, mode ${options.mode ?? "stdout"}, selection: ${selection}. Retention: 24 hours; handler limit: 30 seconds. Pending count follows the first poll. Ctrl-C disconnects; delete with primitive endpoints delete --id ${endpoint.id}.\n`);
@@ -34773,13 +36185,22 @@ async function runListen(options) {
 		let lastBacklog = -1;
 		while (!signal.aborted && (options.number === void 0 || confirmed < options.number)) {
 			const pollStarted = now();
-			const result = await retry(async () => pullWebhookEvent({
-				client: await freshClient(),
-				path: { id: endpoint.id },
-				body: { wait_seconds: 25 },
-				responseStyle: "fields",
-				signal: AbortSignal.any([signal, AbortSignal.timeout(4e4)])
-			}));
+			const result = await retry(async () => {
+				if (stream) {
+					streamClient.setConfig((await freshClient()).getConfig());
+					return { data: {
+						success: true,
+						data: await stream.receive(signal)
+					} };
+				}
+				return pullWebhookEvent$1({
+					client: await freshClient(),
+					path: { id: endpoint.id },
+					body: { wait_seconds: 25 },
+					responseStyle: "fields",
+					signal: AbortSignal.any([signal, AbortSignal.timeout(45e3)])
+				});
+			});
 			if (result.success !== true || !result.data || !Number.isSafeInteger(result.data.gap_count) || result.data.gap_count < 0 || result.data.last_gap_reason !== null && typeof result.data.last_gap_reason !== "string" || !Number.isSafeInteger(result.data.backlog) || result.data.backlog < 0 || result.data.handler_timeout_seconds !== 30 || result.data.retention_seconds !== 86400) throw new ListenError("The API returned an invalid pull response.");
 			const data = result.data;
 			const gapReasons = {
@@ -34822,13 +36243,23 @@ async function runListen(options) {
 				lease_token: delivery.lease_token
 			};
 			try {
-				const receipt = await retry(async () => completeWebhookEvent({
-					client: await freshClient(),
-					path: { id: endpoint.id },
-					body: completion,
-					responseStyle: "fields",
-					signal: AbortSignal.any([signal, AbortSignal.timeout(3e4)])
-				}));
+				const receipt = await retry(async () => {
+					if (stream) {
+						streamClient.setConfig((await freshClient()).getConfig());
+						await stream.complete(completion, signal);
+						return { data: {
+							success: true,
+							data: { result: "completed" }
+						} };
+					}
+					return completeWebhookEvent$1({
+						client: await freshClient(),
+						path: { id: endpoint.id },
+						body: completion,
+						responseStyle: "fields",
+						signal: AbortSignal.any([signal, AbortSignal.timeout(3e4)])
+					});
+				});
 				if (receipt.success !== true || !["completed", "already_completed"].includes(receipt.data?.result)) throw new ListenError("The API returned an invalid completion receipt.");
 				if (handled.succeeded) confirmed++;
 				else stderr.write("Handler reported failure; the server will apply its retry policy.\n");
@@ -34840,6 +36271,7 @@ async function runListen(options) {
 	} catch (error) {
 		if (!signal.aborted) throw error;
 	} finally {
+		stream?.close();
 		release?.();
 	}
 	return confirmed;
@@ -34852,9 +36284,24 @@ var ListenCommand = class ListenCommand extends Command {
 	static examples = [
 		"<%= config.bin %> listen",
 		"<%= config.bin %> listen --subscription my-agent --exec \"python3 accept.py\"",
-		"<%= config.bin %> listen --forward-to http://127.0.0.1:3000/webhook"
+		"<%= config.bin %> listen --forward-to localhost:3000",
+		"<%= config.bin %> listen --once --timeout 60"
 	];
 	static flags = {
+		transport: Flags.string({
+			description: "Event transport; WebSocket is the default.",
+			options: ["websocket", "poll"],
+			default: "websocket"
+		}),
+		once: Flags.boolean({
+			description: "Exit after one successfully handled and confirmed event.",
+			exclusive: ["number"]
+		}),
+		timeout: Flags.integer({
+			description: "Stop after this many seconds; exit 2 if the requested count was not reached.",
+			min: 1,
+			max: 2147483
+		}),
 		subscription: Flags.string({ description: "Stable subscription name. Defaults to a saved name for this account and API environment." }),
 		exec: Flags.string({
 			description: "Short POSIX shell command accepting each complete event on stdin.",
@@ -34888,17 +36335,23 @@ var ListenCommand = class ListenCommand extends Command {
 			forwardTo: flags["forward-to"]
 		});
 		const controller = new AbortController();
+		let timedOut = false;
+		const timer = flags.timeout === void 0 ? void 0 : setTimeout(() => {
+			timedOut = true;
+			controller.abort();
+		}, flags.timeout * 1e3);
 		const cancel = () => controller.abort();
 		process.on("SIGINT", cancel);
 		process.on("SIGTERM", cancel);
 		try {
 			await runListen({
+				transport: flags.transport === "poll" ? "poll" : "websocket",
 				configDir: this.config.configDir,
 				apiKey: flags["api-key"],
 				apiBaseUrl: flags["api-base-url"],
 				subscription: flags.subscription,
 				events: events === void 0 ? void 0 : [...new Set(events)],
-				number: flags.number,
+				number: flags.once ? 1 : flags.number,
 				mode: flags.exec ? "exec" : flags["forward-to"] ? "http" : "stdout",
 				handler,
 				signal: controller.signal
@@ -34906,10 +36359,11 @@ var ListenCommand = class ListenCommand extends Command {
 		} catch (error) {
 			throw new Errors.CLIError(error instanceof ListenError || error instanceof ListenStateError ? error.message : "The listener stopped because of a local state or connection error.");
 		} finally {
+			clearTimeout(timer);
 			process.removeListener("SIGINT", cancel);
 			process.removeListener("SIGTERM", cancel);
 		}
-		if (controller.signal.aborted) process.exitCode = 130;
+		if (controller.signal.aborted) process.exitCode = timedOut ? 2 : 130;
 	}
 };
 //#endregion
@@ -35172,7 +36626,7 @@ const MAX_CLI_LOGIN_POLL_INTERVAL_SECONDS = 60;
 function cliError$3(message) {
 	return new Errors.CLIError(message, { exit: 1 });
 }
-function sleep$1(ms) {
+function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function openBrowser(url) {
@@ -35225,7 +36679,7 @@ async function checkExistingLogin(params) {
 		apiBaseUrl: probeApiBaseUrl,
 		headers: requestConfig.headers
 	});
-	const result = await (params.checkAccount ?? ((client) => getAccount({
+	const result = await (params.checkAccount ?? ((client) => getAccount$1({
 		client: client.client,
 		responseStyle: "fields"
 	})))(apiClient);
@@ -35337,7 +36791,7 @@ var LoginCommand$1 = class extends Command {
 		let interval = Math.min(Math.max(1, start.interval), MAX_CLI_LOGIN_POLL_INTERVAL_SECONDS);
 		let nextPollDelay = 1;
 		while (Date.now() < deadline) {
-			await sleep$1(nextPollDelay * 1e3);
+			await sleep(nextPollDelay * 1e3);
 			nextPollDelay = interval;
 			const polled = await pollCliLogin({
 				body: { device_code: start.device_code },
@@ -36967,331 +38421,6 @@ var OrgSecretsSetCommand = class OrgSecretsSetCommand extends Command {
 	}
 };
 //#endregion
-//#region ../sdk-node/dist/payloads-BfJAtqW9.js
-/**
-* Load a Node builtin at call time. Exported for direct testing of the
-* unavailable-module error path; production code goes through the typed
-* wrappers below.
-*/
-async function loadBuiltin(specifier, operation) {
-	let builtin;
-	if (typeof process !== "undefined" && typeof process.getBuiltinModule === "function") try {
-		builtin = process.getBuiltinModule(specifier);
-	} catch {
-		builtin = void 0;
-	}
-	if (builtin !== void 0 && builtin !== null) return builtin;
-	try {
-		return await import(specifier);
-	} catch (cause) {
-		throw new Error(`${operation} requires file system access, which this runtime does not provide. Pass in-memory bytes instead of a file path when running outside Node.js.`, { cause });
-	}
-}
-/** `node:fs`, loaded lazily so Workers-style bundles never see the import. */
-function loadNodeFs(operation) {
-	return loadBuiltin("node:fs", operation);
-}
-/** `node:fs/promises`, loaded lazily for the same reason as {@link loadNodeFs}. */
-function loadNodeFsPromises(operation) {
-	return loadBuiltin("node:fs/promises", operation);
-}
-const CHUNK_SIZE = 64 * 1024 * 1024;
-const MANIFEST_VERSION = 1;
-const CHUNK_KDF_INFO = "payloads-chunk";
-const OBJECT_ID_BYTES = 16;
-const CEK_BYTES = 32;
-function subtle() {
-	return globalThis.crypto.subtle;
-}
-const textEncoder = new TextEncoder();
-function randomBytes(length) {
-	const out = new Uint8Array(length);
-	globalThis.crypto.getRandomValues(out);
-	return out;
-}
-function toHex(bytes) {
-	let out = "";
-	for (const b of bytes) out += b.toString(16).padStart(2, "0");
-	return out;
-}
-function fromHex(hex) {
-	if (hex.length % 2 !== 0) throw new Error("invalid hex: odd length");
-	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("invalid hex: non-hex character");
-	const out = new Uint8Array(hex.length / 2);
-	for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-	return out;
-}
-async function contentHash(bytes) {
-	return new Uint8Array(await subtle().digest("SHA-256", bytes));
-}
-async function contentHashHex(bytes) {
-	return toHex(await contentHash(bytes));
-}
-/** Binary Merkle root over ordered hex leaf hashes (odd node promoted). */
-async function merkleRoot(leafHashesHex) {
-	if (leafHashesHex.length === 0) return contentHashHex(new Uint8Array(0));
-	let level = leafHashesHex.map(fromHex);
-	while (level.length > 1) {
-		const next = [];
-		for (let i = 0; i < level.length; i += 2) {
-			const left = level[i];
-			const right = i + 1 < level.length ? level[i + 1] : level[i];
-			const combined = new Uint8Array(left.length + right.length);
-			combined.set(left, 0);
-			combined.set(right, left.length);
-			next.push(await contentHash(combined));
-		}
-		level = next;
-	}
-	return toHex(level[0]);
-}
-async function deriveChunkKey(cek, index) {
-	const baseKey = await subtle().importKey("raw", cek, "HKDF", false, ["deriveKey"]);
-	const info = textEncoder.encode(`${CHUNK_KDF_INFO}:${index}`);
-	return subtle().deriveKey({
-		name: "HKDF",
-		hash: "SHA-256",
-		salt: new Uint8Array(32),
-		info
-	}, baseKey, {
-		name: "AES-GCM",
-		length: 256
-	}, false, ["encrypt", "decrypt"]);
-}
-function chunkNonce(index) {
-	const nonce = new Uint8Array(12);
-	new DataView(nonce.buffer).setUint32(8, index >>> 0, false);
-	return nonce;
-}
-function chunkAad(objectId, index) {
-	const aad = new Uint8Array(objectId.length + 4);
-	aad.set(objectId, 0);
-	new DataView(aad.buffer).setUint32(objectId.length, index >>> 0, false);
-	return aad;
-}
-async function encryptChunk(cek, objectId, index, plaintext) {
-	const key = await deriveChunkKey(cek, index);
-	const ct = await subtle().encrypt({
-		name: "AES-GCM",
-		iv: chunkNonce(index),
-		additionalData: chunkAad(objectId, index)
-	}, key, plaintext);
-	return new Uint8Array(ct);
-}
-async function decryptChunk(cek, objectId, index, ciphertext) {
-	const key = await deriveChunkKey(cek, index);
-	const pt = await subtle().decrypt({
-		name: "AES-GCM",
-		iv: chunkNonce(index),
-		additionalData: chunkAad(objectId, index)
-	}, key, ciphertext);
-	return new Uint8Array(pt);
-}
-function authHeaders(apiKey) {
-	return { authorization: `Bearer ${apiKey}` };
-}
-function apiRoot(baseUrl) {
-	let end = baseUrl.length;
-	while (end > 0 && baseUrl.charCodeAt(end - 1) === 47) end--;
-	return `${baseUrl.slice(0, end)}/v1/payloads`;
-}
-const DEFAULT_MAX_RETRIES = 6;
-const RETRYABLE_STATUS = new Set([
-	429,
-	500,
-	502,
-	503,
-	504
-]);
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/**
-* fetch with exponential backoff on transient failures. Request bodies here are
-* in-memory buffers/strings (never streams), so a retry can safely resend them.
-*/
-async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES) {
-	for (let attempt = 0;; attempt++) {
-		let res;
-		let networkError;
-		try {
-			res = await fetch(url, init);
-		} catch (err) {
-			networkError = err;
-		}
-		if (res && !RETRYABLE_STATUS.has(res.status)) return res;
-		if (attempt >= maxRetries) {
-			if (res) return res;
-			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
-		}
-		if (res) await res.text().catch(() => {});
-		await sleep(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
-	}
-}
-async function initiate(opts, manifest) {
-	const res = await retryingFetch(apiRoot(opts.baseUrl), {
-		method: "POST",
-		headers: {
-			...authHeaders(opts.apiKey),
-			"content-type": "application/json"
-		},
-		body: JSON.stringify({ manifest })
-	}, "initiate");
-	if (!res.ok) throw new Error(`initiate failed: HTTP ${res.status} ${await res.text()}`);
-	await res.text();
-}
-async function putChunk(opts, root, d, bytes) {
-	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, {
-		method: "PUT",
-		headers: {
-			...authHeaders(opts.apiKey),
-			"content-type": "application/octet-stream"
-		},
-		body: bytes
-	}, `chunk ${d.index} upload`);
-	if (!res.ok) throw new Error(`chunk ${d.index} upload failed: HTTP ${res.status} ${await res.text()}`);
-	await res.text();
-}
-async function finalize(opts, root) {
-	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/finalize`, {
-		method: "POST",
-		headers: authHeaders(opts.apiKey)
-	}, "finalize");
-	if (!res.ok) throw new Error(`finalize failed: HTTP ${res.status} ${await res.text()}`);
-	await res.text();
-}
-async function fetchManifest(opts, root) {
-	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/manifest`, { headers: authHeaders(opts.apiKey) }, "get manifest");
-	if (!res.ok) throw new Error(`get manifest failed: HTTP ${res.status} ${await res.text()}`);
-	return (await res.json()).data.manifest;
-}
-async function getChunkBytes(opts, root, d) {
-	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, { headers: authHeaders(opts.apiKey) }, `get chunk ${d.index}`);
-	if (!res.ok) throw new Error(`get chunk ${d.index} failed: HTTP ${res.status}`);
-	return new Uint8Array(await res.arrayBuffer());
-}
-async function readWindow(fh, position, length) {
-	const buf = Buffer.allocUnsafe(length);
-	let read = 0;
-	while (read < length) {
-		const { bytesRead } = await fh.read(buf, read, length - read, position + read);
-		if (bytesRead === 0) break;
-		read += bytesRead;
-	}
-	return read === length ? buf : buf.subarray(0, read);
-}
-async function mapLimit(items, limit, fn) {
-	let next = 0;
-	let firstError;
-	const worker = async () => {
-		while (next < items.length && firstError === void 0) {
-			const i = next++;
-			try {
-				await fn(items[i], i);
-			} catch (err) {
-				if (firstError === void 0) firstError = err;
-				return;
-			}
-		}
-	};
-	await Promise.all(Array.from({ length: Math.min(limit, items.length || 1) }, () => worker()));
-	if (firstError !== void 0) throw firstError;
-}
-/**
-* Stream a file up as a Primitive Payload. Two passes over the file (encrypt to
-* build the manifest, then encrypt again to upload) keep memory bounded to a few
-* chunks — the whole object is never resident. Returns the content address
-* (merkleRoot) and the hex CEK needed to download it.
-*/
-async function pushFile(filePath, opts) {
-	const { open, stat } = await loadNodeFsPromises("pushFile");
-	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
-	const concurrency = opts.concurrency ?? 3;
-	const { size } = await stat(filePath);
-	const cek = randomBytes(CEK_BYTES);
-	const objectId = randomBytes(OBJECT_ID_BYTES);
-	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
-	const fh = await open(filePath, "r");
-	try {
-		const descriptors = [];
-		for (let index = 0; index < chunkCount; index++) {
-			const position = index * chunkSize;
-			const length = Math.min(chunkSize, size - position);
-			const plaintext = await readWindow(fh, position, length);
-			const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
-			descriptors.push({
-				index,
-				ciphertextHash: await contentHashHex(ciphertext),
-				plaintextSize: length,
-				ciphertextSize: ciphertext.length
-			});
-			opts.onProgress?.("encrypt", index + 1, chunkCount);
-		}
-		const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
-		await initiate(opts, {
-			version: MANIFEST_VERSION,
-			objectId: toHex(objectId),
-			chunkSize,
-			totalPlaintextSize: size,
-			chunkCount,
-			chunks: descriptors,
-			merkleRoot: root
-		});
-		let uploaded = 0;
-		await mapLimit(descriptors, concurrency, async (d) => {
-			const plaintext = await readWindow(fh, d.index * chunkSize, d.plaintextSize);
-			await putChunk(opts, root, d, await encryptChunk(cek, objectId, d.index, plaintext));
-			opts.onProgress?.("upload", ++uploaded, chunkCount);
-		});
-		await finalize(opts, root);
-		return {
-			merkleRoot: root,
-			cek: toHex(cek),
-			chunkCount,
-			totalBytes: size
-		};
-	} finally {
-		await fh.close();
-	}
-}
-/**
-* Stream a Primitive Payload down to a file, verifying and decrypting one chunk
-* at a time (bounded memory). Every chunk is content-address-checked before
-* decryption, so a corrupt or substituted chunk throws.
-*/
-async function pullFile(root, outPath, opts) {
-	const { createWriteStream } = await loadNodeFs("pullFile");
-	const { rm } = await loadNodeFsPromises("pullFile");
-	const manifest = await fetchManifest(opts, root);
-	const computedRoot = await merkleRoot(manifest.chunks.map((c) => c.ciphertextHash));
-	if (computedRoot !== root) throw new Error(`manifest does not match the requested content address (got ${computedRoot})`);
-	const cek = fromHex(opts.cek);
-	const objectId = fromHex(manifest.objectId);
-	const out = createWriteStream(outPath);
-	let onWriteError = () => {};
-	const writeErrored = new Promise((_, reject) => {
-		onWriteError = reject;
-	});
-	writeErrored.catch(() => {});
-	out.on("error", (err) => onWriteError(err));
-	try {
-		let done = 0;
-		for (const d of manifest.chunks) {
-			const ciphertext = await getChunkBytes(opts, root, d);
-			if (await contentHashHex(ciphertext) !== d.ciphertextHash) throw new Error(`chunk ${d.index} failed integrity check`);
-			const plaintext = await decryptChunk(cek, objectId, d.index, ciphertext);
-			if (!out.write(plaintext)) await Promise.race([new Promise((resolve) => out.once("drain", resolve)), writeErrored]);
-			opts.onProgress?.("download", ++done, manifest.chunkCount);
-		}
-		await Promise.race([new Promise((resolve) => out.end(resolve)), writeErrored]);
-	} catch (err) {
-		out.destroy();
-		await rm(outPath, { force: true });
-		throw err;
-	}
-	return manifest;
-}
-//#endregion
 //#region src/oclif/commands/payloads.ts
 const DEFAULT_API_BASE_URL = "https://api.primitive.dev";
 const authFlags = {
@@ -39189,7 +40318,7 @@ var PaymentsRegisterPayoutAddressCommand = class PaymentsRegisterPayoutAddressCo
 			configDir: this.config.configDir
 		});
 		await runWithTiming(flags.time, async () => {
-			const account = await getAccount({
+			const account = await getAccount$1({
 				client: apiClient.client,
 				responseStyle: "fields"
 			});
@@ -41382,7 +42511,7 @@ var WhoamiCommand = class WhoamiCommand extends Command {
 				apiBaseUrl: flags["api-base-url"],
 				configDir: this.config.configDir
 			});
-			const result = await getAccount({
+			const result = await getAccount$1({
 				client: apiClient.client,
 				responseStyle: "fields"
 			});