primcli 1.26.0 → 1.29.0

package/dist/oclif/index.js

@@ -1,4 +1,4 @@
-import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient, N as createConfig, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-BKso8oJu.js";
+import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, M as createClient$1, N as createConfig$1, O as loadActiveChatState, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as PrimitiveApiClient, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-BKso8oJu.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
 import { chmodSync, closeSync, constants, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
@@ -27,7 +27,7 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region ../packages/api-core/src/api/client.gen.ts
-const client = createClient(createConfig({ baseUrl: "https://api.primitive.dev/v1" }));
+const client = createClient$1(createConfig$1({ baseUrl: "https://api.primitive.dev/v1" }));
 //#endregion
 //#region ../packages/api-core/src/api/sdk.gen.ts
 var sdk_gen_exports = /* @__PURE__ */ __exportAll({
@@ -36,7 +36,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	cancelSentEmail: () => cancelSentEmail,
 	checkDomainDns: () => checkDomainDns,
 	cliLogout: () => cliLogout,
-	completeWebhookEvent: () => completeWebhookEvent,
+	completeWebhookEvent: () => completeWebhookEvent$1,
 	createAgentAccount: () => createAgentAccount,
 	createAgentClaimLink: () => createAgentClaimLink,
 	createChallenge: () => createChallenge,
@@ -75,6 +75,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getAgent: () => getAgent,
 	getChallenge: () => getChallenge,
 	getConversation: () => getConversation,
+	getCreditBalance: () => getCreditBalance,
 	getEmail: () => getEmail,
 	getFunction: () => getFunction,
 	getFunctionRouting: () => getFunctionRouting,
@@ -117,7 +118,8 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	payChallenge: () => payChallenge,
 	pollCliLogin: () => pollCliLogin,
 	publishAgent: () => publishAgent,
-	pullWebhookEvent: () => pullWebhookEvent,
+	pullWebhookEvent: () => pullWebhookEvent$1,
+	redeemCreditCode: () => redeemCreditCode,
 	registerPayoutAddress: () => registerPayoutAddress,
 	removeAgentConnection: () => removeAgentConnection,
 	reorderRoutes: () => reorderRoutes,
@@ -493,6 +495,55 @@ const rotateWebhookSecret = (options) => (options?.client ?? client).post({
 	...options
 });
 /**
+* Redeem a credit code
+*
+* Redeem a credit code for the authenticated organization. The credit is
+* added to the organization prepaid credit and shows in
+* `GET /credits/balance` under `prepaid_credit`.
+*
+* Redeeming requires an organization owner or admin. An API key redeems
+* with the authority of the user who created it, based on that user's
+* current role; a key without that authority gets the same
+* `credit_code_invalid` refusal as an unknown code.
+*
+* The `Idempotency-Key` header is required. Retrying with the same key
+* and code returns the original grant with `replayed: true` and grants
+* nothing new; the same key with a different code is refused with
+* `idempotency_key_reused`. Every refusal carries a human-readable
+* `error.message` that can be shown to the user as is.
+*
+*/
+const redeemCreditCode = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/credits/redeem",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get credit balance
+*
+* Read the organization credit position. `prepaid_credit` is the prepaid
+* usage credit (paid top-ups, redeemed credit codes and granted credit)
+* that can still pay for usage. `budget` is the active agent spending
+* budget an operator funded for top-ups, or null when there is none.
+* Amounts are strings of integer micros (1 USD = 1000000 micros).
+*
+*/
+const getCreditBalance = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/credits/balance",
+	...options
+});
+/**
 * List all domains
 *
 * Returns all verified and unverified domains for your organization,
@@ -969,7 +1020,7 @@ const listEndpoints = (options) => (options?.client ?? client).get({
 * accepts the signature.
 *
 *
-* For local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.
+* For local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types within their credential scope. Connected-agent credentials automatically create private subscriptions restricted to inbound email for their assigned address. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.
 */
 const createEndpoint = (options) => (options.client ?? client).post({
 	security: [{
@@ -1025,7 +1076,7 @@ const updateEndpoint = (options) => (options.client ?? client).patch({
 *
 * Wait up to 30 seconds for one existing event. The body string preserves the exact webhook serialization; headers and canonical occurrence/type metadata travel alongside it. A fixed lease protects the attempt while a short handler accepts input. Retry may redeliver an occurrence: deduplicate event_id. Empty delivery means no offer now, not proof all input was delivered; inspect backlog and persistent gap_count/last_gap_reason. Queue retention is 24 hours and does not extend source-content retention. Disconnecting preserves pending work. Same named destination shares consumption; different destinations get independent copies.
 */
-const pullWebhookEvent = (options) => (options.client ?? client).post({
+const pullWebhookEvent$1 = (options) => (options.client ?? client).post({
 	security: [{
 		scheme: "bearer",
 		type: "http"
@@ -1042,7 +1093,7 @@ const pullWebhookEvent = (options) => (options.client ?? client).post({
 *
 * Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
 */
-const completeWebhookEvent = (options) => (options.client ?? client).post({
+const completeWebhookEvent$1 = (options) => (options.client ?? client).post({
 	security: [{
 		scheme: "bearer",
 		type: "http"
@@ -2783,6 +2834,10 @@ const openapiDocument = {
 			"name": "Account",
 			"description": "Manage your account settings, storage, and webhook secret"
 		},
+		{
+			"name": "Credits",
+			"description": "Redeem credit codes and read the organization credit balance"
+		},
 		{
 			"name": "Domains",
 			"description": "Claim, verify, and manage email domains"
@@ -3387,6 +3442,129 @@ const openapiDocument = {
 				"429": { "$ref": "#/components/responses/RateLimited" }
 			}
 		} },
+		"/credits/redeem": { "post": {
+			"operationId": "redeemCreditCode",
+			"summary": "Redeem a credit code",
+			"description": "Redeem a credit code for the authenticated organization. The credit is\nadded to the organization prepaid credit and shows in\n`GET /credits/balance` under `prepaid_credit`.\n\nRedeeming requires an organization owner or admin. An API key redeems\nwith the authority of the user who created it, based on that user's\ncurrent role; a key without that authority gets the same\n`credit_code_invalid` refusal as an unknown code.\n\nThe `Idempotency-Key` header is required. Retrying with the same key\nand code returns the original grant with `replayed: true` and grants\nnothing new; the same key with a different code is refused with\n`idempotency_key_reused`. Every refusal carries a human-readable\n`error.message` that can be shown to the user as is.\n",
+			"tags": ["Credits"],
+			"parameters": [{
+				"name": "Idempotency-Key",
+				"in": "header",
+				"required": true,
+				"description": "Required client-supplied key: 1 to 200 printable ASCII\ncharacters, without spaces. Use a new key for each code you\nredeem and reuse it only to retry the same request.\n",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 200,
+					"pattern": "^[\\x21-\\x7E]{1,200}$"
+				}
+			}],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/RedeemCreditCodeInput" },
+					"example": { "code": "LAUNCH50" }
+				} }
+			},
+			"responses": {
+				"200": {
+					"description": "The code was redeemed, or this request replayed an earlier\nredemption with the same Idempotency-Key.\n",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/CreditRedemption" } }
+					}] } } }
+				},
+				"400": {
+					"description": "`idempotency_key_required` means the Idempotency-Key header is\nmissing. `validation_error` means the header is empty, longer than\n200 characters or not printable non-space ASCII, or the body is\ninvalid.\n",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "idempotency_key_required",
+								"message": "an Idempotency-Key header is required"
+							}
+						}
+					} }
+				},
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"409": {
+					"description": "The organization or user already redeemed this code, or already\nredeemed another code in the same exclusive group (a set of codes\nof which each organization or user may redeem only one).\n`error.code` is `credit_code_already_redeemed`.\n",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "credit_code_already_redeemed",
+								"message": "Your organization has already redeemed this promotion."
+							}
+						}
+					} }
+				},
+				"422": {
+					"description": "The code cannot be redeemed. `credit_code_invalid` covers unknown,\nexpired and exhausted codes and callers without authority to\nredeem; `credit_code_not_eligible` means the organization does not\nmeet the promotion terms; `credit_code_balance_cap` means the\norganization already holds the most promotional credit it can;\n`idempotency_key_reused` means this Idempotency-Key already\nredeemed a different code.\n",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "credit_code_invalid",
+								"message": "That code isn't valid or is no longer available."
+							}
+						}
+					} }
+				},
+				"429": {
+					"description": "Too many requests or redemption attempts. `error.code` is\n`rate_limited`. Wait for `Retry-After` when present. Like other\nrate-limited responses, it also carries the `ratelimit-limit`,\n`ratelimit-remaining`, `ratelimit-reset` and `ratelimit-policy`\nquota headers when the limiter reports them.\n",
+					"headers": { "Retry-After": {
+						"schema": { "type": "integer" },
+						"description": "Seconds to wait before retrying"
+					} },
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limited",
+								"message": "Rate limit exceeded. Try again shortly."
+							}
+						}
+					} }
+				},
+				"503": {
+					"description": "The code could not be redeemed right now. Retry later with the\nsame Idempotency-Key. `error.code` is `service_unavailable`.\n",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "service_unavailable",
+								"message": "We couldn't redeem that code right now. Try again in a few minutes."
+							}
+						}
+					} }
+				}
+			}
+		} },
+		"/credits/balance": { "get": {
+			"operationId": "getCreditBalance",
+			"summary": "Get credit balance",
+			"description": "Read the organization credit position. `prepaid_credit` is the prepaid\nusage credit (paid top-ups, redeemed credit codes and granted credit)\nthat can still pay for usage. `budget` is the active agent spending\nbudget an operator funded for top-ups, or null when there is none.\nAmounts are strings of integer micros (1 USD = 1000000 micros).\n",
+			"tags": ["Credits"],
+			"responses": {
+				"200": {
+					"description": "The organization credit balance.",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/CreditBalance" } }
+					}] } } }
+				},
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
 		"/domains": {
 			"get": {
 				"operationId": "listDomains",
@@ -4221,7 +4399,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEndpoint",
 				"summary": "Create a webhook endpoint",
-				"description": "Creates a new webhook endpoint. If a deactivated endpoint\nwith the same URL and domain exists, it is reactivated\ninstead. Subject to plan limits on the number of active\nendpoints.\n\n**Signing is account-scoped, not per-endpoint.** This call\ndoes not return any signing material; every endpoint on the\naccount uses the same webhook secret, fetched via\n`GET /account/webhook-secret`. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.",
+				"description": "Creates a new webhook endpoint. If a deactivated endpoint\nwith the same URL and domain exists, it is reactivated\ninstead. Subject to plan limits on the number of active\nendpoints.\n\n**Signing is account-scoped, not per-endpoint.** This call\ndoes not return any signing material; every endpoint on the\naccount uses the same webhook secret, fetched via\n`GET /account/webhook-secret`. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types within their credential scope. Connected-agent credentials automatically create private subscriptions restricted to inbound email for their assigned address. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.",
 				"tags": ["Endpoints"],
 				"requestBody": {
 					"required": true,
@@ -5110,6 +5288,22 @@ const openapiDocument = {
 						"format": "date-time"
 					},
 					"description": "Inclusive upper bound on `created_at`."
+				},
+				{
+					"name": "q",
+					"in": "query",
+					"schema": { "type": "string" },
+					"description": "Literal case-insensitive substring filter over the\nsubject, the retained plain-text body, the sender, and\nthe To, CC and BCC recipients of each send. Matched\nverbatim: `%`, `_` and `\\` are ordinary characters and\ndo not act as wildcards, so a search for `10%` finds the\nliteral string `10%` rather than everything beginning\n`10`.\n\nLeading and trailing whitespace is trimmed, and the\nresult must be 3 to 500 UTF-16 code units. The\nthree-character minimum is the search index's: a shorter\npattern cannot be answered from the index and would scan\nthe whole mailbox, so it is rejected rather than served\nas a request that times out.\n\nThose bounds are deliberately NOT declared as\n`minLength`/`maxLength`. Both count Unicode code points\non the value as sent, while the server trims first and\ncounts UTF-16 code units, and the two disagree in both\ndirections: two astral characters are 2 code points but\n4 code units, so a declared minimum would reject a query\nthe server accepts, and `\"<499 chars> \"` is 500 code\npoints before trimming and 499 after, so a declared\nmaximum would reject another. Declaring a bound the\nserver does not enforce is worse than declaring none,\nbecause the client refuses locally and the caller never\nlearns why. The server validates; a violation is a `400`.\n\nRecipients are matched one address at a time rather than\nagainst the serialized recipient list, so a query\ncontaining a quote, comma or bracket matches only where\nthat character occurs inside an address. Bodies are\nsearched only where the plain-text body was retained;\nHTML-only bodies are not searched.\n\nNot served by every deployment. Where sent-mail search\nis not enabled the endpoint answers `503` with code\n`sent_mail_search_unavailable`, which callers should\ntreat as a capability answer and fall back on rather\nthan as an outage.\n"
+				},
+				{
+					"name": "from",
+					"in": "query",
+					"schema": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 320
+					},
+					"description": "Exact case-insensitive sender mailbox filter. Returns\nonly sends whose from address equals this value; it is\nnot a substring match, so a partial mailbox matches\nnothing. Use `q` to search sender text loosely.\nCombines with every other filter, and unlike `q` it is\nserved by every deployment.\n"
 				}
 			],
 			"responses": {
@@ -5124,7 +5318,20 @@ const openapiDocument = {
 					}] } } }
 				},
 				"400": { "$ref": "#/components/responses/ValidationError" },
-				"401": { "$ref": "#/components/responses/Unauthorized" }
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"503": {
+					"description": "Sent-mail text search is not enabled in this deployment,\nso `q` cannot be served. A capability answer, not an\noutage: it will not clear on retry, and the same request\nwithout `q` succeeds. Fall back to whatever local\nmatching the caller has. Distinguished from the generic\n503 by its `sent_mail_search_unavailable` code.\n",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "sent_mail_search_unavailable",
+								"message": "Sent-mail text search (`q`) is not enabled in this environment."
+							}
+						}
+					} }
+				}
 			}
 		} },
 		"/sent-emails/{id}": {
@@ -8046,7 +8253,15 @@ const openapiDocument = {
 									"event_content_unavailable",
 									"event_preparation_failed",
 									"subscription_unavailable",
-									"stale_delivery"
+									"stale_delivery",
+									"idempotency_key_required",
+									"idempotency_key_reused",
+									"credit_code_invalid",
+									"credit_code_already_redeemed",
+									"credit_code_not_eligible",
+									"credit_code_balance_cap",
+									"rate_limited",
+									"service_unavailable"
 								]
 							},
 							"message": { "type": "string" },
@@ -9012,6 +9227,148 @@ const openapiDocument = {
 				} },
 				"required": ["secret"]
 			},
+			"RedeemCreditCodeInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"required": ["code"],
+				"properties": { "code": {
+					"type": "string",
+					"pattern": "^\\s*\\S(?:[\\s\\S]{0,254}\\S)?\\s*$",
+					"description": "The credit code to redeem. Surrounding whitespace is ignored; the\nrest must be 1 to 256 characters.\n"
+				} }
+			},
+			"CreditRedemption": {
+				"type": "object",
+				"additionalProperties": false,
+				"required": [
+					"redemption_id",
+					"amount_micros",
+					"currency",
+					"granted_at",
+					"expires_at",
+					"label",
+					"replayed",
+					"message"
+				],
+				"properties": {
+					"redemption_id": {
+						"type": "string",
+						"description": "Identifier of the redemption."
+					},
+					"amount_micros": {
+						"type": "string",
+						"pattern": "^[0-9]+$",
+						"description": "Credit granted, in micros of `currency` (1 USD = 1000000 micros)."
+					},
+					"currency": {
+						"type": "string",
+						"description": "Currency of the granted credit, for example `usd`."
+					},
+					"granted_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "When the credit was granted."
+					},
+					"expires_at": {
+						"type": ["string", "null"],
+						"format": "date-time",
+						"description": "When the granted credit expires, or null when it does not expire."
+					},
+					"label": {
+						"type": ["string", "null"],
+						"description": "Customer-facing label of the promotion, when it has one."
+					},
+					"replayed": {
+						"type": "boolean",
+						"description": "True when this Idempotency-Key already redeemed this code and the\noriginal grant is returned. No second grant is made.\n"
+					},
+					"message": {
+						"type": "string",
+						"description": "Human-readable summary of the grant, suitable to show as is."
+					}
+				}
+			},
+			"CreditBalance": {
+				"type": "object",
+				"required": ["budget"],
+				"properties": {
+					"budget": {
+						"description": "The active agent spending budget an operator funded for top-ups,\nor null when there is none.\n",
+						"type": ["object", "null"],
+						"additionalProperties": false,
+						"required": [
+							"currency",
+							"max_amount_micros",
+							"spent_micros",
+							"remaining_micros",
+							"per_topup_cap_micros",
+							"expires_at",
+							"status"
+						],
+						"properties": {
+							"currency": {
+								"type": "string",
+								"description": "Currency of the budget, for example `usd`."
+							},
+							"max_amount_micros": {
+								"type": "string",
+								"pattern": "^[0-9]+$",
+								"description": "Total allowance the operator funded, in micros."
+							},
+							"spent_micros": {
+								"type": "string",
+								"pattern": "^[0-9]+$",
+								"description": "How much of the allowance has been drawn down, in micros."
+							},
+							"remaining_micros": {
+								"type": "string",
+								"pattern": "^[0-9]+$",
+								"description": "`max_amount_micros - spent_micros`, floored at zero."
+							},
+							"per_topup_cap_micros": {
+								"type": ["string", "null"],
+								"pattern": "^[0-9]+$",
+								"description": "Largest single top-up allowed, in micros, or null for no per-top-up cap."
+							},
+							"expires_at": {
+								"type": ["string", "null"],
+								"format": "date-time",
+								"description": "When the allowance expires, or null for no expiry."
+							},
+							"status": {
+								"type": "string",
+								"description": "Budget status. An active budget reads `active`."
+							}
+						}
+					},
+					"prepaid_credit": {
+						"description": "Prepaid usage credit (top-ups, redeemed credit codes and granted\ncredit) that can still pay for usage, or null when there is none.\nOmitted when an exact figure cannot be given right now; the budget\nis still returned.\n",
+						"type": ["object", "null"],
+						"additionalProperties": false,
+						"required": [
+							"currency",
+							"remaining_micros",
+							"next_expires_at"
+						],
+						"properties": {
+							"currency": {
+								"type": "string",
+								"description": "Currency of the credit, which is the organization billing currency."
+							},
+							"remaining_micros": {
+								"type": "string",
+								"pattern": "^[0-9]+$",
+								"description": "What the credit can still pay for, in micros."
+							},
+							"next_expires_at": {
+								"type": ["string", "null"],
+								"format": "date-time",
+								"description": "Earliest expiry among credits with a balance, or null when none of them expires."
+							}
+						}
+					}
+				}
+			},
 			"InboxStatus": {
 				"type": "object",
 				"additionalProperties": false,
@@ -11376,14 +11733,16 @@ const openapiDocument = {
 				"oneOf": [
 					{ "$ref": "#/components/schemas/CompleteWebhookHttpInput" },
 					{ "$ref": "#/components/schemas/CompleteWebhookExecInput" },
-					{ "$ref": "#/components/schemas/CompleteWebhookStdoutInput" }
+					{ "$ref": "#/components/schemas/CompleteWebhookStdoutInput" },
+					{ "$ref": "#/components/schemas/CompleteWebhookSdkInput" }
 				],
 				"discriminator": {
 					"propertyName": "mode",
 					"mapping": {
 						"http": "#/components/schemas/CompleteWebhookHttpInput",
 						"exec": "#/components/schemas/CompleteWebhookExecInput",
-						"stdout": "#/components/schemas/CompleteWebhookStdoutInput"
+						"stdout": "#/components/schemas/CompleteWebhookStdoutInput",
+						"sdk": "#/components/schemas/CompleteWebhookSdkInput"
 					}
 				}
 			},
@@ -11537,6 +11896,49 @@ const openapiDocument = {
 				],
 				"additionalProperties": false
 			},
+			"CompleteWebhookSdkInput": {
+				"type": "object",
+				"properties": {
+					"queue_id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"delivery_id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"lease_token": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"duration_ms": {
+						"type": "integer",
+						"minimum": 0,
+						"maximum": 3e4
+					},
+					"mode": {
+						"type": "string",
+						"enum": ["sdk"]
+					},
+					"accepted": { "type": "boolean" },
+					"transport_error": {
+						"type": "string",
+						"enum": ["timeout", "io"]
+					}
+				},
+				"required": [
+					"queue_id",
+					"delivery_id",
+					"lease_token",
+					"duration_ms",
+					"mode",
+					"accepted"
+				],
+				"additionalProperties": false
+			},
 			"CompleteWebhookResponse": {
 				"type": "object",
 				"properties": {
@@ -11570,6 +11972,35 @@ const openapiDocument = {
 			"Endpoint": {
 				"type": "object",
 				"properties": {
+					"recipient": {
+						"type": ["string", "null"],
+						"description": "Server-enforced recipient for an address-scoped pull subscription; null for account-wide receiving."
+					},
+					"receiver_capabilities": {
+						"type": "object",
+						"properties": {
+							"completion_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"http",
+										"exec",
+										"stdout",
+										"sdk"
+									]
+								}
+							},
+							"stream_protocols": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": ["primitive.events.v1"]
+								}
+							}
+						},
+						"required": ["completion_modes", "stream_protocols"]
+					},
 					"id": {
 						"type": "string",
 						"format": "uuid"
@@ -15380,6 +15811,181 @@ const operationManifest = [
 		"tag": "CLI",
 		"tagCommand": "cli"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-credit-balance",
+		"description": "Read the organization credit position. `prepaid_credit` is the prepaid\nusage credit (paid top-ups, redeemed credit codes and granted credit)\nthat can still pay for usage. `budget` is the active agent spending\nbudget an operator funded for top-ups, or null when there is none.\nAmounts are strings of integer micros (1 USD = 1000000 micros).\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getCreditBalance",
+		"path": "/credits/balance",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"required": ["budget"],
+			"properties": {
+				"budget": {
+					"description": "The active agent spending budget an operator funded for top-ups,\nor null when there is none.\n",
+					"type": ["object", "null"],
+					"additionalProperties": false,
+					"required": [
+						"currency",
+						"max_amount_micros",
+						"spent_micros",
+						"remaining_micros",
+						"per_topup_cap_micros",
+						"expires_at",
+						"status"
+					],
+					"properties": {
+						"currency": {
+							"type": "string",
+							"description": "Currency of the budget, for example `usd`."
+						},
+						"max_amount_micros": {
+							"type": "string",
+							"pattern": "^[0-9]+$",
+							"description": "Total allowance the operator funded, in micros."
+						},
+						"spent_micros": {
+							"type": "string",
+							"pattern": "^[0-9]+$",
+							"description": "How much of the allowance has been drawn down, in micros."
+						},
+						"remaining_micros": {
+							"type": "string",
+							"pattern": "^[0-9]+$",
+							"description": "`max_amount_micros - spent_micros`, floored at zero."
+						},
+						"per_topup_cap_micros": {
+							"type": ["string", "null"],
+							"pattern": "^[0-9]+$",
+							"description": "Largest single top-up allowed, in micros, or null for no per-top-up cap."
+						},
+						"expires_at": {
+							"type": ["string", "null"],
+							"format": "date-time",
+							"description": "When the allowance expires, or null for no expiry."
+						},
+						"status": {
+							"type": "string",
+							"description": "Budget status. An active budget reads `active`."
+						}
+					}
+				},
+				"prepaid_credit": {
+					"description": "Prepaid usage credit (top-ups, redeemed credit codes and granted\ncredit) that can still pay for usage, or null when there is none.\nOmitted when an exact figure cannot be given right now; the budget\nis still returned.\n",
+					"type": ["object", "null"],
+					"additionalProperties": false,
+					"required": [
+						"currency",
+						"remaining_micros",
+						"next_expires_at"
+					],
+					"properties": {
+						"currency": {
+							"type": "string",
+							"description": "Currency of the credit, which is the organization billing currency."
+						},
+						"remaining_micros": {
+							"type": "string",
+							"pattern": "^[0-9]+$",
+							"description": "What the credit can still pay for, in micros."
+						},
+						"next_expires_at": {
+							"type": ["string", "null"],
+							"format": "date-time",
+							"description": "Earliest expiry among credits with a balance, or null when none of them expires."
+						}
+					}
+				}
+			}
+		},
+		"sdkName": "getCreditBalance",
+		"summary": "Get credit balance",
+		"tag": "Credits",
+		"tagCommand": "credits"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "redeem-credit-code",
+		"description": "Redeem a credit code for the authenticated organization. The credit is\nadded to the organization prepaid credit and shows in\n`GET /credits/balance` under `prepaid_credit`.\n\nRedeeming requires an organization owner or admin. An API key redeems\nwith the authority of the user who created it, based on that user's\ncurrent role; a key without that authority gets the same\n`credit_code_invalid` refusal as an unknown code.\n\nThe `Idempotency-Key` header is required. Retrying with the same key\nand code returns the original grant with `replayed: true` and grants\nnothing new; the same key with a different code is refused with\n`idempotency_key_reused`. Every refusal carries a human-readable\n`error.message` that can be shown to the user as is.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "redeemCreditCode",
+		"path": "/credits/redeem",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["code"],
+			"properties": { "code": {
+				"type": "string",
+				"pattern": "^\\s*\\S(?:[\\s\\S]{0,254}\\S)?\\s*$",
+				"description": "The credit code to redeem. Surrounding whitespace is ignored; the\nrest must be 1 to 256 characters.\n"
+			} }
+		},
+		"responseSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"redemption_id",
+				"amount_micros",
+				"currency",
+				"granted_at",
+				"expires_at",
+				"label",
+				"replayed",
+				"message"
+			],
+			"properties": {
+				"redemption_id": {
+					"type": "string",
+					"description": "Identifier of the redemption."
+				},
+				"amount_micros": {
+					"type": "string",
+					"pattern": "^[0-9]+$",
+					"description": "Credit granted, in micros of `currency` (1 USD = 1000000 micros)."
+				},
+				"currency": {
+					"type": "string",
+					"description": "Currency of the granted credit, for example `usd`."
+				},
+				"granted_at": {
+					"type": "string",
+					"format": "date-time",
+					"description": "When the credit was granted."
+				},
+				"expires_at": {
+					"type": ["string", "null"],
+					"format": "date-time",
+					"description": "When the granted credit expires, or null when it does not expire."
+				},
+				"label": {
+					"type": ["string", "null"],
+					"description": "Customer-facing label of the promotion, when it has one."
+				},
+				"replayed": {
+					"type": "boolean",
+					"description": "True when this Idempotency-Key already redeemed this code and the\noriginal grant is returned. No second grant is made.\n"
+				},
+				"message": {
+					"type": "string",
+					"description": "Human-readable summary of the grant, suitable to show as is."
+				}
+			}
+		},
+		"sdkName": "redeemCreditCode",
+		"summary": "Redeem a credit code",
+		"tag": "Credits",
+		"tagCommand": "credits"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
@@ -17879,6 +18485,49 @@ const operationManifest = [
 						"write_succeeded"
 					],
 					"additionalProperties": false
+				},
+				{
+					"type": "object",
+					"properties": {
+						"queue_id": {
+							"type": "string",
+							"format": "uuid",
+							"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+						},
+						"delivery_id": {
+							"type": "string",
+							"format": "uuid",
+							"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+						},
+						"lease_token": {
+							"type": "string",
+							"format": "uuid",
+							"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+						},
+						"duration_ms": {
+							"type": "integer",
+							"minimum": 0,
+							"maximum": 3e4
+						},
+						"mode": {
+							"type": "string",
+							"enum": ["sdk"]
+						},
+						"accepted": { "type": "boolean" },
+						"transport_error": {
+							"type": "string",
+							"enum": ["timeout", "io"]
+						}
+					},
+					"required": [
+						"queue_id",
+						"delivery_id",
+						"lease_token",
+						"duration_ms",
+						"mode",
+						"accepted"
+					],
+					"additionalProperties": false
 				}
 			],
 			"discriminator": {
@@ -17886,7 +18535,8 @@ const operationManifest = [
 				"mapping": {
 					"http": "#/components/schemas/CompleteWebhookHttpInput",
 					"exec": "#/components/schemas/CompleteWebhookExecInput",
-					"stdout": "#/components/schemas/CompleteWebhookStdoutInput"
+					"stdout": "#/components/schemas/CompleteWebhookStdoutInput",
+					"sdk": "#/components/schemas/CompleteWebhookSdkInput"
 				}
 			}
 		},
@@ -17929,7 +18579,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-endpoint",
-		"description": "Creates a new webhook endpoint. If a deactivated endpoint\nwith the same URL and domain exists, it is reactivated\ninstead. Subject to plan limits on the number of active\nendpoints.\n\n**Signing is account-scoped, not per-endpoint.** This call\ndoes not return any signing material; every endpoint on the\naccount uses the same webhook secret, fetched via\n`GET /account/webhook-secret`. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.",
+		"description": "Creates a new webhook endpoint. If a deactivated endpoint\nwith the same URL and domain exists, it is reactivated\ninstead. Subject to plan limits on the number of active\nendpoints.\n\n**Signing is account-scoped, not per-endpoint.** This call\ndoes not return any signing material; every endpoint on the\naccount uses the same webhook secret, fetched via\n`GET /account/webhook-secret`. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types within their credential scope. Connected-agent credentials automatically create private subscriptions restricted to inbound email for their assigned address. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEndpoint",
@@ -17997,6 +18647,35 @@ const operationManifest = [
 		"responseSchema": {
 			"type": "object",
 			"properties": {
+				"recipient": {
+					"type": ["string", "null"],
+					"description": "Server-enforced recipient for an address-scoped pull subscription; null for account-wide receiving."
+				},
+				"receiver_capabilities": {
+					"type": "object",
+					"properties": {
+						"completion_modes": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"enum": [
+									"http",
+									"exec",
+									"stdout",
+									"sdk"
+								]
+							}
+						},
+						"stream_protocols": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"enum": ["primitive.events.v1"]
+							}
+						}
+					},
+					"required": ["completion_modes", "stream_protocols"]
+				},
 				"id": {
 					"type": "string",
 					"format": "uuid"
@@ -18148,6 +18827,35 @@ const operationManifest = [
 			"items": {
 				"type": "object",
 				"properties": {
+					"recipient": {
+						"type": ["string", "null"],
+						"description": "Server-enforced recipient for an address-scoped pull subscription; null for account-wide receiving."
+					},
+					"receiver_capabilities": {
+						"type": "object",
+						"properties": {
+							"completion_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"http",
+										"exec",
+										"stdout",
+										"sdk"
+									]
+								}
+							},
+							"stream_protocols": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": ["primitive.events.v1"]
+								}
+							}
+						},
+						"required": ["completion_modes", "stream_protocols"]
+					},
 					"id": {
 						"type": "string",
 						"format": "uuid"
@@ -18589,6 +19297,35 @@ const operationManifest = [
 		"responseSchema": {
 			"type": "object",
 			"properties": {
+				"recipient": {
+					"type": ["string", "null"],
+					"description": "Server-enforced recipient for an address-scoped pull subscription; null for account-wide receiving."
+				},
+				"receiver_capabilities": {
+					"type": "object",
+					"properties": {
+						"completion_modes": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"enum": [
+									"http",
+									"exec",
+									"stdout",
+									"sdk"
+								]
+							}
+						},
+						"stream_protocols": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"enum": ["primitive.events.v1"]
+							}
+						}
+					},
+					"required": ["completion_modes", "stream_protocols"]
+				},
 				"id": {
 					"type": "string",
 					"format": "uuid"
@@ -24914,6 +25651,20 @@ const operationManifest = [
 				"name": "date_to",
 				"required": false,
 				"type": "string"
+			},
+			{
+				"description": "Literal case-insensitive substring filter over the\nsubject, the retained plain-text body, the sender, and\nthe To, CC and BCC recipients of each send. Matched\nverbatim: `%`, `_` and `\\` are ordinary characters and\ndo not act as wildcards, so a search for `10%` finds the\nliteral string `10%` rather than everything beginning\n`10`.\n\nLeading and trailing whitespace is trimmed, and the\nresult must be 3 to 500 UTF-16 code units. The\nthree-character minimum is the search index's: a shorter\npattern cannot be answered from the index and would scan\nthe whole mailbox, so it is rejected rather than served\nas a request that times out.\n\nThose bounds are deliberately NOT declared as\n`minLength`/`maxLength`. Both count Unicode code points\non the value as sent, while the server trims first and\ncounts UTF-16 code units, and the two disagree in both\ndirections: two astral characters are 2 code points but\n4 code units, so a declared minimum would reject a query\nthe server accepts, and `\"<499 chars> \"` is 500 code\npoints before trimming and 499 after, so a declared\nmaximum would reject another. Declaring a bound the\nserver does not enforce is worse than declaring none,\nbecause the client refuses locally and the caller never\nlearns why. The server validates; a violation is a `400`.\n\nRecipients are matched one address at a time rather than\nagainst the serialized recipient list, so a query\ncontaining a quote, comma or bracket matches only where\nthat character occurs inside an address. Bodies are\nsearched only where the plain-text body was retained;\nHTML-only bodies are not searched.\n\nNot served by every deployment. Where sent-mail search\nis not enabled the endpoint answers `503` with code\n`sent_mail_search_unavailable`, which callers should\ntreat as a capability answer and fall back on rather\nthan as an outage.\n",
+				"enum": null,
+				"name": "q",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "Exact case-insensitive sender mailbox filter. Returns\nonly sends whose from address equals this value; it is\nnot a substring match, so a partial mailbox matches\nnothing. Use `q` to search sender text loosely.\nCombines with every other filter, and unlike `q` it is\nserved by every deployment.\n",
+				"enum": null,
+				"name": "from",
+				"required": false,
+				"type": "string"
 			}
 		],
 		"requestSchema": null,
@@ -27601,7 +28352,7 @@ function isMemoryJsonValue(value, seen = /* @__PURE__ */ new Set()) {
 const API_HEADERS_ENV = "PRIMITIVE_API_HEADERS";
 const OAUTH_REFRESH_SKEW_MS = 60 * 1e3;
 const SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE = "Saved Primitive CLI OAuth session expired or was revoked. Run `primitive signin` to authenticate again.";
-function mergeHeaders(...headers) {
+function mergeHeaders$1(...headers) {
 	const merged = {};
 	for (const headerSet of headers) {
 		if (!headerSet) continue;
@@ -27639,7 +28390,7 @@ function resolveCliApiRequestConfig(params) {
 		apiBaseUrl,
 		baseUrlOverridden: apiBaseUrl !== void 0,
 		environmentName: currentEnvironment?.name ?? null,
-		headers: mergeHeaders(currentEnvironment?.config.headers, cliApiHeadersFromEnv(params.env)),
+		headers: mergeHeaders$1(currentEnvironment?.config.headers, cliApiHeadersFromEnv(params.env)),
 		resolvedApiBaseUrl: normalizeApiBaseUrl(apiBaseUrl)
 	};
 }
@@ -30189,6 +30940,240 @@ var ConfigCommand = class extends ConfigListCommand {
 	static description = "Manage local Primitive CLI request environments for API endpoint overrides and request headers.";
 };
 //#endregion
+//#region src/oclif/commands/credits.ts
+const API_KEY_FLAG$1 = Flags.string({
+	description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+	env: "PRIMITIVE_API_KEY"
+});
+const API_BASE_URL_FLAG$1 = Flags.string({
+	description: API_BASE_URL_FLAG_DESCRIPTION,
+	env: "PRIMITIVE_API_BASE_URL",
+	hidden: true
+});
+const MICROS_PER_UNIT = 1000000n;
+/**
+* Format an integer micros string as a currency amount. USD renders as
+* `$12.50`; other currencies as `12.50 EUR`. Two decimals are always shown,
+* and up to six when the amount has sub-cent precision. Input that is not a
+* non-negative integer string is returned unchanged with the currency code.
+*/
+function formatMicros(micros, currency) {
+	const code = currency.toUpperCase();
+	if (!/^[0-9]+$/.test(micros)) return `${micros} micros ${code}`.trim();
+	const value = BigInt(micros);
+	const whole = value / MICROS_PER_UNIT;
+	const fraction = (value % MICROS_PER_UNIT).toString().padStart(6, "0").replace(/0+$/, "").padEnd(2, "0");
+	const amount = `${whole.toLocaleString("en-US")}.${fraction}`;
+	return code === "USD" ? `$${amount}` : `${amount} ${code}`;
+}
+function formatExpiry(value) {
+	if (!value) return "never";
+	const date = new Date(value);
+	if (Number.isNaN(date.getTime())) return value;
+	return date.toISOString().slice(0, 10);
+}
+function formatRedemptionSummary(redemption) {
+	const lines = [redemption.replayed ? `Already redeemed with this idempotency key: ${formatMicros(redemption.amount_micros, redemption.currency)} in credit. No new credit was added.` : `Redeemed ${formatMicros(redemption.amount_micros, redemption.currency)} in credit.`, `Expires: ${formatExpiry(redemption.expires_at)}`];
+	if (redemption.label?.trim()) lines.push(`Promotion: ${redemption.label}`);
+	lines.push(`Redemption id: ${redemption.redemption_id}`);
+	return lines.join("\n");
+}
+function formatBalanceSummary(balance) {
+	const lines = [];
+	const prepaid = balance.prepaid_credit;
+	if (prepaid === void 0) lines.push("Prepaid credit: not available right now, try again shortly");
+	else if (prepaid === null) lines.push("Prepaid credit: none");
+	else {
+		const expiry = prepaid.next_expires_at ? `next expiry ${formatExpiry(prepaid.next_expires_at)}` : "no expiry";
+		lines.push(`Prepaid credit: ${formatMicros(prepaid.remaining_micros, prepaid.currency)} (${expiry})`);
+	}
+	const budget = balance.budget;
+	if (!budget) lines.push("Spending budget: none");
+	else {
+		const details = [`status ${budget.status}`];
+		if (budget.per_topup_cap_micros) details.push(`per top-up cap ${formatMicros(budget.per_topup_cap_micros, budget.currency)}`);
+		details.push(`expires ${formatExpiry(budget.expires_at)}`);
+		lines.push(`Spending budget: ${formatMicros(budget.remaining_micros, budget.currency)} of ${formatMicros(budget.max_amount_micros, budget.currency)} remaining (${details.join(", ")})`);
+	}
+	return lines.join("\n");
+}
+/**
+* Lines printed after a failed redemption so the user can retry without risk
+* of a second grant: reusing the same key and code returns the original grant
+* if the first attempt did land. No shell command is printed, since quoting
+* differs between shells.
+*/
+function formatRetryHint(idempotencyKey) {
+	return [`Idempotency-Key: ${idempotencyKey}`, `To retry this redemption safely, run the same command again with --idempotency-key ${idempotencyKey}.`].join("\n");
+}
+/**
+* Print a failed request. A server refusal (an error envelope with a
+* message) prints the message as the primary line, since the redeem route
+* writes it to be shown to the user; anything else falls back to the shared
+* error renderer. Always sets a non-zero exit code.
+*/
+function reportCreditsError(error, context, options) {
+	const payload = extractErrorPayload(error);
+	const body = payload;
+	if (!options.json && body && typeof body === "object" && typeof body.message === "string" && typeof body.code === "string" && body.code !== "unauthorized") {
+		process.stderr.write(`${options.prefix}: ${body.message}\n`);
+		process.stderr.write(`Error code: ${body.code}\n`);
+	} else writeErrorWithHints(payload);
+	surfaceUnauthorizedHint({
+		...context,
+		payload
+	});
+	process.exitCode = 1;
+}
+var CreditsRedeemCommand = class CreditsRedeemCommand extends Command {
+	static description = `Redeem a credit code for your organization.
+
+  Prints the credit added and when it expires. On a refusal (an invalid,
+  already redeemed or ineligible code, for example) the server's message is
+  printed and the command exits non-zero.
+
+  Redeeming needs an organization owner or admin. With an API key, the key's
+  creator must currently be an owner or admin.
+
+  The request carries an Idempotency-Key. One is generated for each run; pass
+  --idempotency-key to retry the same redemption safely, for example after a
+  network error. Retrying with the same key and code returns the original
+  grant and adds no second credit. On any failure the key in use is printed to
+  stderr so the same command can be rerun with --idempotency-key.`;
+	static summary = "Redeem a credit code";
+	static examples = [
+		"<%= config.bin %> credits redeem LAUNCH50",
+		"<%= config.bin %> credits redeem LAUNCH50 --idempotency-key redeem-launch50-1",
+		"<%= config.bin %> credits redeem LAUNCH50 --json"
+	];
+	static args = { code: Args.string({
+		description: "The credit code to redeem.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$1,
+		"idempotency-key": Flags.string({ description: "Idempotency key for the request, at most 200 characters. Defaults to a new random key per run; reuse a key only to retry the same code." }),
+		json: Flags.boolean({ description: "Print the full redemption JSON on success, or the error JSON on failure." }),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { args, flags } = await this.parse(CreditsRedeemCommand);
+		const code = args.code.trim();
+		if (!code) {
+			process.stderr.write("The credit code must not be empty.\n");
+			process.exitCode = 1;
+			return;
+		}
+		const idempotencyKey = flags["idempotency-key"]?.trim() || `cli-redeem-${randomUUID()}`;
+		if (idempotencyKey.length > 200) {
+			process.stderr.write("--idempotency-key must be at most 200 characters.\n");
+			process.exitCode = 1;
+			return;
+		}
+		if (!/^[\x21-\x7E]+$/.test(idempotencyKey)) {
+			process.stderr.write("--idempotency-key must contain only printable ASCII characters, without spaces.\n");
+			process.exitCode = 1;
+			return;
+		}
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		const writeRetryHint = () => process.stderr.write(`${formatRetryHint(idempotencyKey)}\n`);
+		await runWithTiming(flags.time, async () => {
+			let result;
+			try {
+				result = await redeemCreditCode({
+					client: apiClient.client,
+					body: { code },
+					headers: { "Idempotency-Key": idempotencyKey },
+					responseStyle: "fields"
+				});
+			} catch (error) {
+				writeRetryHint();
+				throw error;
+			}
+			if (result.error) {
+				reportCreditsError(result.error, {
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir
+				}, {
+					json: Boolean(flags.json),
+					prefix: `Could not redeem ${code}`
+				});
+				writeRetryHint();
+				return;
+			}
+			const redemption = result.data?.data;
+			if (!redemption) {
+				process.stderr.write("Server returned an empty redemption body.\n");
+				writeRetryHint();
+				process.exitCode = 1;
+				return;
+			}
+			if (flags.json) {
+				this.log(JSON.stringify(redemption, null, 2));
+				return;
+			}
+			this.log(formatRedemptionSummary(redemption));
+		});
+	}
+};
+var CreditsBalanceCommand = class CreditsBalanceCommand extends Command {
+	static description = `Show your organization's credit balance.
+
+  Prints the prepaid credit (top-ups, redeemed credit codes and granted
+  credit) that can still pay for usage, and the agent spending budget when an
+  operator has funded one. Pass --json for the raw response.`;
+	static summary = "Show the credit balance";
+	static examples = ["<%= config.bin %> credits balance", "<%= config.bin %> credits balance --json"];
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$1,
+		json: Flags.boolean({ description: "Print the full balance JSON response." }),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(CreditsBalanceCommand);
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const result = await getCreditBalance({
+				client: apiClient.client,
+				responseStyle: "fields"
+			});
+			if (result.error) {
+				reportCreditsError(result.error, {
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir
+				}, {
+					json: Boolean(flags.json),
+					prefix: "Could not read the balance"
+				});
+				return;
+			}
+			const balance = result.data?.data;
+			if (!balance) {
+				process.stderr.write("Server returned an empty balance body.\n");
+				process.exitCode = 1;
+				return;
+			}
+			if (flags.json) {
+				this.log(JSON.stringify(balance, null, 2));
+				return;
+			}
+			this.log(formatBalanceSummary(balance));
+		});
+	}
+};
+//#endregion
 //#region src/oclif/commands/doctor.ts
 const MIN_NODE_MAJOR = 22;
 function renderRow({ label, outcome }) {
@@ -32071,8 +33056,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.26.0";
-const CLI_VERSION_RANGE = "^1.26.0";
+const SDK_VERSION_RANGE = "^1.29.0";
+const CLI_VERSION_RANGE = "^1.29.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -34106,6 +35091,11 @@ const FORWARDED_HEADERS = new Set([
 	"x-primitive-email-id",
 	"x-primitive-endpoint-id"
 ]);
+function normalizeForwardTarget(target) {
+	if (/^\d+$/.test(target)) return `http://localhost:${target}`;
+	if (/^(localhost|127\.0\.0\.1|\[::1\])(?::|\/|$)/.test(target)) return `http://${target}`;
+	return target;
+}
 function validateListenHandlerOptions(options) {
 	if (options.exec !== void 0 && process.platform === "win32") throw new Error("--exec requires a POSIX shell and process groups. On Windows, use --forward-to with a local HTTP handler.");
 	if (options.exec !== void 0 && options.forwardTo !== void 0) throw new Error("Choose either --exec or --forward-to.");
@@ -34113,7 +35103,7 @@ function validateListenHandlerOptions(options) {
 	if (options.forwardTo !== void 0) {
 		let url;
 		try {
-			url = new URL(options.forwardTo);
+			url = new URL(normalizeForwardTarget(options.forwardTo));
 		} catch {
 			throw new Error("--forward-to requires an HTTP or HTTPS URL.");
 		}
@@ -34258,7 +35248,7 @@ var ForwardFailure = class extends Error {
 };
 async function forward(target, delivery, signal) {
 	signal.throwIfAborted();
-	const url = new URL(target);
+	const url = new URL(normalizeForwardTarget(target));
 	const body = Buffer.from(delivery.body, "utf8");
 	const headers = {};
 	for (const [name, value] of Object.entries(delivery.headers)) if (FORWARDED_HEADERS.has(name.toLowerCase())) headers[name.toLowerCase()] = value;
@@ -34398,6 +35388,1152 @@ function createListenHandler(options = {}) {
 	};
 }
 //#endregion
+//#region ../sdk-node/dist/payloads-BMngnJlE.js
+/**
+* Load a Node builtin at call time. Exported for direct testing of the
+* unavailable-module error path; production code goes through the typed
+* wrappers below.
+*/
+async function loadBuiltin(specifier, operation) {
+	let builtin;
+	if (typeof process !== "undefined" && typeof process.getBuiltinModule === "function") try {
+		builtin = process.getBuiltinModule(specifier);
+	} catch {
+		builtin = void 0;
+	}
+	if (builtin !== void 0 && builtin !== null) return builtin;
+	try {
+		return await import(specifier);
+	} catch (cause) {
+		throw new Error(`${operation} requires file system access, which this runtime does not provide. Pass in-memory bytes instead of a file path when running outside Node.js.`, { cause });
+	}
+}
+/** `node:fs`, loaded lazily so Workers-style bundles never see the import. */
+function loadNodeFs(operation) {
+	return loadBuiltin("node:fs", operation);
+}
+/** `node:fs/promises`, loaded lazily for the same reason as {@link loadNodeFs}. */
+function loadNodeFsPromises(operation) {
+	return loadBuiltin("node:fs/promises", operation);
+}
+const CHUNK_SIZE = 64 * 1024 * 1024;
+const MANIFEST_VERSION = 1;
+const CHUNK_KDF_INFO = "payloads-chunk";
+const OBJECT_ID_BYTES = 16;
+const CEK_BYTES = 32;
+function subtle() {
+	return globalThis.crypto.subtle;
+}
+const textEncoder = new TextEncoder();
+function randomBytes(length) {
+	const out = new Uint8Array(length);
+	globalThis.crypto.getRandomValues(out);
+	return out;
+}
+function toHex(bytes) {
+	let out = "";
+	for (const b of bytes) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+function fromHex(hex) {
+	if (hex.length % 2 !== 0) throw new Error("invalid hex: odd length");
+	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("invalid hex: non-hex character");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+	return out;
+}
+async function contentHash(bytes) {
+	return new Uint8Array(await subtle().digest("SHA-256", bytes));
+}
+async function contentHashHex(bytes) {
+	return toHex(await contentHash(bytes));
+}
+/** Binary Merkle root over ordered hex leaf hashes (odd node promoted). */
+async function merkleRoot(leafHashesHex) {
+	if (leafHashesHex.length === 0) return contentHashHex(new Uint8Array(0));
+	let level = leafHashesHex.map(fromHex);
+	while (level.length > 1) {
+		const next = [];
+		for (let i = 0; i < level.length; i += 2) {
+			const left = level[i];
+			const right = i + 1 < level.length ? level[i + 1] : level[i];
+			const combined = new Uint8Array(left.length + right.length);
+			combined.set(left, 0);
+			combined.set(right, left.length);
+			next.push(await contentHash(combined));
+		}
+		level = next;
+	}
+	return toHex(level[0]);
+}
+async function deriveChunkKey(cek, index) {
+	const baseKey = await subtle().importKey("raw", cek, "HKDF", false, ["deriveKey"]);
+	const info = textEncoder.encode(`${CHUNK_KDF_INFO}:${index}`);
+	return subtle().deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(32),
+		info
+	}, baseKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+function chunkNonce(index) {
+	const nonce = new Uint8Array(12);
+	new DataView(nonce.buffer).setUint32(8, index >>> 0, false);
+	return nonce;
+}
+function chunkAad(objectId, index) {
+	const aad = new Uint8Array(objectId.length + 4);
+	aad.set(objectId, 0);
+	new DataView(aad.buffer).setUint32(objectId.length, index >>> 0, false);
+	return aad;
+}
+async function encryptChunk(cek, objectId, index, plaintext) {
+	const key = await deriveChunkKey(cek, index);
+	const ct = await subtle().encrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, plaintext);
+	return new Uint8Array(ct);
+}
+async function decryptChunk(cek, objectId, index, ciphertext) {
+	const key = await deriveChunkKey(cek, index);
+	const pt = await subtle().decrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, ciphertext);
+	return new Uint8Array(pt);
+}
+function authHeaders(apiKey) {
+	return { authorization: `Bearer ${apiKey}` };
+}
+function apiRoot(baseUrl) {
+	let end = baseUrl.length;
+	while (end > 0 && baseUrl.charCodeAt(end - 1) === 47) end--;
+	return `${baseUrl.slice(0, end)}/v1/payloads`;
+}
+const DEFAULT_MAX_RETRIES = 6;
+const RETRYABLE_STATUS = new Set([
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+function sleep$1(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* fetch with exponential backoff on transient failures. Request bodies here are
+* in-memory buffers/strings (never streams), so a retry can safely resend them.
+*/
+async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES) {
+	for (let attempt = 0;; attempt++) {
+		let res;
+		let networkError;
+		try {
+			res = await fetch(url, init);
+		} catch (err) {
+			networkError = err;
+		}
+		if (res && !RETRYABLE_STATUS.has(res.status)) return res;
+		if (attempt >= maxRetries) {
+			if (res) return res;
+			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
+		}
+		if (res) await res.text().catch(() => {});
+		await sleep$1(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
+	}
+}
+async function initiate(opts, manifest) {
+	const res = await retryingFetch(apiRoot(opts.baseUrl), {
+		method: "POST",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({ manifest })
+	}, "initiate");
+	if (!res.ok) throw new Error(`initiate failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function putChunk(opts, root, d, bytes) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, {
+		method: "PUT",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/octet-stream"
+		},
+		body: bytes
+	}, `chunk ${d.index} upload`);
+	if (!res.ok) throw new Error(`chunk ${d.index} upload failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function finalize(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/finalize`, {
+		method: "POST",
+		headers: authHeaders(opts.apiKey)
+	}, "finalize");
+	if (!res.ok) throw new Error(`finalize failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function fetchManifest(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/manifest`, { headers: authHeaders(opts.apiKey) }, "get manifest");
+	if (!res.ok) throw new Error(`get manifest failed: HTTP ${res.status} ${await res.text()}`);
+	return (await res.json()).data.manifest;
+}
+async function getChunkBytes(opts, root, d) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, { headers: authHeaders(opts.apiKey) }, `get chunk ${d.index}`);
+	if (!res.ok) throw new Error(`get chunk ${d.index} failed: HTTP ${res.status}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+async function readWindow(fh, position, length) {
+	const buf = Buffer.allocUnsafe(length);
+	let read = 0;
+	while (read < length) {
+		const { bytesRead } = await fh.read(buf, read, length - read, position + read);
+		if (bytesRead === 0) break;
+		read += bytesRead;
+	}
+	return read === length ? buf : buf.subarray(0, read);
+}
+async function mapLimit(items, limit, fn) {
+	let next = 0;
+	let firstError;
+	const worker = async () => {
+		while (next < items.length && firstError === void 0) {
+			const i = next++;
+			try {
+				await fn(items[i], i);
+			} catch (err) {
+				if (firstError === void 0) firstError = err;
+				return;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length || 1) }, () => worker()));
+	if (firstError !== void 0) throw firstError;
+}
+/**
+* Stream a file up as a Primitive Payload. Two passes over the file (encrypt to
+* build the manifest, then encrypt again to upload) keep memory bounded to a few
+* chunks — the whole object is never resident. Returns the content address
+* (merkleRoot) and the hex CEK needed to download it.
+*/
+async function pushFile(filePath, opts) {
+	const { open, stat } = await loadNodeFsPromises("pushFile");
+	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
+	const concurrency = opts.concurrency ?? 3;
+	const { size } = await stat(filePath);
+	const cek = randomBytes(CEK_BYTES);
+	const objectId = randomBytes(OBJECT_ID_BYTES);
+	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
+	const fh = await open(filePath, "r");
+	try {
+		const descriptors = [];
+		for (let index = 0; index < chunkCount; index++) {
+			const position = index * chunkSize;
+			const length = Math.min(chunkSize, size - position);
+			const plaintext = await readWindow(fh, position, length);
+			const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
+			descriptors.push({
+				index,
+				ciphertextHash: await contentHashHex(ciphertext),
+				plaintextSize: length,
+				ciphertextSize: ciphertext.length
+			});
+			opts.onProgress?.("encrypt", index + 1, chunkCount);
+		}
+		const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
+		await initiate(opts, {
+			version: MANIFEST_VERSION,
+			objectId: toHex(objectId),
+			chunkSize,
+			totalPlaintextSize: size,
+			chunkCount,
+			chunks: descriptors,
+			merkleRoot: root
+		});
+		let uploaded = 0;
+		await mapLimit(descriptors, concurrency, async (d) => {
+			const plaintext = await readWindow(fh, d.index * chunkSize, d.plaintextSize);
+			await putChunk(opts, root, d, await encryptChunk(cek, objectId, d.index, plaintext));
+			opts.onProgress?.("upload", ++uploaded, chunkCount);
+		});
+		await finalize(opts, root);
+		return {
+			merkleRoot: root,
+			cek: toHex(cek),
+			chunkCount,
+			totalBytes: size
+		};
+	} finally {
+		await fh.close();
+	}
+}
+/**
+* Stream a Primitive Payload down to a file, verifying and decrypting one chunk
+* at a time (bounded memory). Every chunk is content-address-checked before
+* decryption, so a corrupt or substituted chunk throws.
+*/
+async function pullFile(root, outPath, opts) {
+	const { createWriteStream } = await loadNodeFs("pullFile");
+	const { rm } = await loadNodeFsPromises("pullFile");
+	const manifest = await fetchManifest(opts, root);
+	const computedRoot = await merkleRoot(manifest.chunks.map((c) => c.ciphertextHash));
+	if (computedRoot !== root) throw new Error(`manifest does not match the requested content address (got ${computedRoot})`);
+	const cek = fromHex(opts.cek);
+	const objectId = fromHex(manifest.objectId);
+	const out = createWriteStream(outPath);
+	let onWriteError = () => {};
+	const writeErrored = new Promise((_, reject) => {
+		onWriteError = reject;
+	});
+	writeErrored.catch(() => {});
+	out.on("error", (err) => onWriteError(err));
+	try {
+		let done = 0;
+		for (const d of manifest.chunks) {
+			const ciphertext = await getChunkBytes(opts, root, d);
+			if (await contentHashHex(ciphertext) !== d.ciphertextHash) throw new Error(`chunk ${d.index} failed integrity check`);
+			const plaintext = await decryptChunk(cek, objectId, d.index, ciphertext);
+			if (!out.write(plaintext)) await Promise.race([new Promise((resolve) => out.once("drain", resolve)), writeErrored]);
+			opts.onProgress?.("download", ++done, manifest.chunkCount);
+		}
+		await Promise.race([new Promise((resolve) => out.end(resolve)), writeErrored]);
+	} catch (err) {
+		out.destroy();
+		await rm(outPath, { force: true });
+		throw err;
+	}
+	return manifest;
+}
+//#endregion
+//#region ../sdk-node/dist/api-27BvnkVA.js
+const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
+function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
+	let lastEventId;
+	const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const createStream = async function* () {
+		let retryDelay = sseDefaultRetryDelay ?? 3e3;
+		let attempt = 0;
+		const signal = options.signal ?? new AbortController().signal;
+		while (true) {
+			if (signal.aborted) break;
+			attempt++;
+			const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+			if (lastEventId !== void 0) headers.set("Last-Event-ID", lastEventId);
+			try {
+				const requestInit = {
+					redirect: "follow",
+					...options,
+					body: options.serializedBody,
+					headers,
+					signal
+				};
+				let request = new Request(url, requestInit);
+				if (onRequest) request = await onRequest(url, requestInit);
+				const response = await (options.fetch ?? globalThis.fetch)(request);
+				if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+				if (!response.body) throw new Error("No body in SSE response");
+				const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+				let buffer = "";
+				const abortHandler = () => {
+					try {
+						reader.cancel();
+					} catch {}
+				};
+				signal.addEventListener("abort", abortHandler);
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						buffer += value;
+						buffer = buffer.replace(/\r\n?/g, "\n");
+						const chunks = buffer.split("\n\n");
+						buffer = chunks.pop() ?? "";
+						for (const chunk of chunks) {
+							const lines = chunk.split("\n");
+							const dataLines = [];
+							let eventName;
+							for (const line of lines) if (line.startsWith("data:")) dataLines.push(line.replace(/^data:\s*/, ""));
+							else if (line.startsWith("event:")) eventName = line.replace(/^event:\s*/, "");
+							else if (line.startsWith("id:")) lastEventId = line.replace(/^id:\s*/, "");
+							else if (line.startsWith("retry:")) {
+								const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+								if (!Number.isNaN(parsed)) retryDelay = parsed;
+							}
+							let data;
+							let parsedJson = false;
+							if (dataLines.length) {
+								const rawData = dataLines.join("\n");
+								try {
+									data = JSON.parse(rawData);
+									parsedJson = true;
+								} catch {
+									data = rawData;
+								}
+							}
+							if (parsedJson) {
+								if (responseValidator) await responseValidator(data);
+								if (responseTransformer) data = await responseTransformer(data);
+							}
+							onSseEvent?.({
+								data,
+								event: eventName,
+								id: lastEventId,
+								retry: retryDelay
+							});
+							if (dataLines.length) yield data;
+						}
+					}
+				} finally {
+					signal.removeEventListener("abort", abortHandler);
+					reader.releaseLock();
+				}
+				break;
+			} catch (error) {
+				onSseError?.(error);
+				if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) break;
+				await sleep(Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4));
+			}
+		}
+	};
+	return { stream: createStream() };
+}
+const separatorArrayExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const separatorArrayNoExplode = (style) => {
+	switch (style) {
+		case "form": return ",";
+		case "pipeDelimited": return "|";
+		case "spaceDelimited": return "%20";
+		default: return ",";
+	}
+};
+const separatorObjectExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const serializeArrayParam = ({ allowReserved, explode, name, style, value }) => {
+	if (!explode) {
+		const joinedValues = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+		switch (style) {
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			case "simple": return joinedValues;
+			default: return `${name}=${joinedValues}`;
+		}
+	}
+	const separator = separatorArrayExplode(style);
+	const joinedValues = value.map((v) => {
+		if (style === "label" || style === "simple") return allowReserved ? v : encodeURIComponent(v);
+		return serializePrimitiveParam({
+			allowReserved,
+			name,
+			value: v
+		});
+	}).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+const serializePrimitiveParam = ({ allowReserved, name, value }) => {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+const serializeObjectParam = ({ allowReserved, explode, name, style, value, valueOnly }) => {
+	if (value instanceof Date) return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+	if (style !== "deepObject" && !explode) {
+		let values = [];
+		Object.entries(value).forEach(([key, v]) => {
+			values = [
+				...values,
+				key,
+				allowReserved ? v : encodeURIComponent(v)
+			];
+		});
+		const joinedValues = values.join(",");
+		switch (style) {
+			case "form": return `${name}=${joinedValues}`;
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			default: return joinedValues;
+		}
+	}
+	const separator = separatorObjectExplode(style);
+	const joinedValues = Object.entries(value).map(([key, v]) => serializePrimitiveParam({
+		allowReserved,
+		name: style === "deepObject" ? `${name}[${key}]` : key,
+		value: v
+	})).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+const PATH_PARAM_RE = /\{[^{}]+\}/g;
+const defaultPathSerializer = ({ path, url: _url }) => {
+	let url = _url;
+	const matches = _url.match(PATH_PARAM_RE);
+	if (matches) for (const match of matches) {
+		let explode = false;
+		let name = match.substring(1, match.length - 1);
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			name = name.substring(1);
+			style = "label";
+		} else if (name.startsWith(";")) {
+			name = name.substring(1);
+			style = "matrix";
+		}
+		const value = path[name];
+		if (value === void 0 || value === null) continue;
+		if (Array.isArray(value)) {
+			url = url.replace(match, serializeArrayParam({
+				explode,
+				name,
+				style,
+				value
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			url = url.replace(match, serializeObjectParam({
+				explode,
+				name,
+				style,
+				value,
+				valueOnly: true
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			url = url.replace(match, `;${serializePrimitiveParam({
+				name,
+				value
+			})}`);
+			continue;
+		}
+		const replaceValue = encodeURIComponent(style === "label" ? `.${value}` : value);
+		url = url.replace(match, replaceValue);
+	}
+	return url;
+};
+const getUrl = ({ baseUrl, path, query, querySerializer, url: _url }) => {
+	const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+	let url = (baseUrl ?? "") + pathUrl;
+	if (path) url = defaultPathSerializer({
+		path,
+		url
+	});
+	let search = query ? querySerializer(query) : "";
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) url += `?${search}`;
+	return url;
+};
+function getValidRequestBody(options) {
+	const hasBody = options.body !== void 0;
+	if (hasBody && options.bodySerializer) {
+		if ("serializedBody" in options) return options.serializedBody !== void 0 && options.serializedBody !== "" ? options.serializedBody : null;
+		return options.body !== "" ? options.body : null;
+	}
+	if (hasBody) return options.body;
+}
+const getAuthToken = async (auth, callback) => {
+	const token = typeof callback === "function" ? await callback(auth) : callback;
+	if (!token) return;
+	if (auth.scheme === "bearer") return `Bearer ${token}`;
+	if (auth.scheme === "basic") return `Basic ${btoa(token)}`;
+	return token;
+};
+const createQuerySerializer = ({ parameters = {}, ...args } = {}) => {
+	const querySerializer = (queryParams) => {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			const options = parameters[name] || args;
+			if (Array.isArray(value)) {
+				const serializedArray = serializeArrayParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "form",
+					value,
+					...options.array
+				});
+				if (serializedArray) search.push(serializedArray);
+			} else if (typeof value === "object") {
+				const serializedObject = serializeObjectParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "deepObject",
+					value,
+					...options.object
+				});
+				if (serializedObject) search.push(serializedObject);
+			} else {
+				const serializedPrimitive = serializePrimitiveParam({
+					allowReserved: options.allowReserved,
+					name,
+					value
+				});
+				if (serializedPrimitive) search.push(serializedPrimitive);
+			}
+		}
+		return search.join("&");
+	};
+	return querySerializer;
+};
+/**
+* Infers parseAs value from provided Content-Type header.
+*/
+const getParseAs = (contentType) => {
+	if (!contentType) return "stream";
+	const cleanContent = contentType.split(";")[0]?.trim();
+	if (!cleanContent) return;
+	if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) return "json";
+	if (cleanContent === "multipart/form-data") return "formData";
+	if ([
+		"application/",
+		"audio/",
+		"image/",
+		"video/"
+	].some((type) => cleanContent.startsWith(type))) return "blob";
+	if (cleanContent.startsWith("text/")) return "text";
+};
+const checkForExistence = (options, name) => {
+	if (!name) return false;
+	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
+	return false;
+};
+async function setAuthParams(options) {
+	for (const auth of options.security ?? []) {
+		if (checkForExistence(options, auth.name)) continue;
+		const token = await getAuthToken(auth, options.auth);
+		if (!token) continue;
+		const name = auth.name ?? "Authorization";
+		switch (auth.in) {
+			case "query":
+				if (!options.query) options.query = {};
+				options.query[name] = token;
+				break;
+			case "cookie":
+				options.headers.append("Cookie", `${name}=${token}`);
+				break;
+			default:
+				options.headers.set(name, token);
+				break;
+		}
+	}
+}
+const buildUrl = (options) => getUrl({
+	baseUrl: options.baseUrl,
+	path: options.path,
+	query: options.query,
+	querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+	url: options.url
+});
+const mergeConfigs = (a, b) => {
+	const config = {
+		...a,
+		...b
+	};
+	if (config.baseUrl?.endsWith("/")) config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+	config.headers = mergeHeaders(a.headers, b.headers);
+	return config;
+};
+const headersEntries = (headers) => {
+	const entries = [];
+	headers.forEach((value, key) => {
+		entries.push([key, value]);
+	});
+	return entries;
+};
+const mergeHeaders = (...headers) => {
+	const mergedHeaders = new Headers();
+	for (const header of headers) {
+		if (!header) continue;
+		const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+		for (const [key, value] of iterator) if (value === null) mergedHeaders.delete(key);
+		else if (Array.isArray(value)) for (const v of value) mergedHeaders.append(key, v);
+		else if (value !== void 0) mergedHeaders.set(key, typeof value === "object" ? JSON.stringify(value) : value);
+	}
+	return mergedHeaders;
+};
+var Interceptors = class {
+	fns = [];
+	clear() {
+		this.fns = [];
+	}
+	eject(id) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) this.fns[index] = null;
+	}
+	exists(id) {
+		const index = this.getInterceptorIndex(id);
+		return Boolean(this.fns[index]);
+	}
+	getInterceptorIndex(id) {
+		if (typeof id === "number") return this.fns[id] ? id : -1;
+		return this.fns.indexOf(id);
+	}
+	update(id, fn) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) {
+			this.fns[index] = fn;
+			return id;
+		}
+		return false;
+	}
+	use(fn) {
+		this.fns.push(fn);
+		return this.fns.length - 1;
+	}
+};
+const createInterceptors = () => ({
+	error: new Interceptors(),
+	request: new Interceptors(),
+	response: new Interceptors()
+});
+const defaultQuerySerializer = createQuerySerializer({
+	allowReserved: false,
+	array: {
+		explode: true,
+		style: "form"
+	},
+	object: {
+		explode: true,
+		style: "deepObject"
+	}
+});
+const defaultHeaders = { "Content-Type": "application/json" };
+const createConfig = (override = {}) => ({
+	...jsonBodySerializer,
+	headers: defaultHeaders,
+	parseAs: "auto",
+	querySerializer: defaultQuerySerializer,
+	...override
+});
+const createClient = (config = {}) => {
+	let _config = mergeConfigs(createConfig(), config);
+	const getConfig = () => ({ ..._config });
+	const setConfig = (config) => {
+		_config = mergeConfigs(_config, config);
+		return getConfig();
+	};
+	const interceptors = createInterceptors();
+	const beforeRequest = async (options) => {
+		const opts = {
+			..._config,
+			...options,
+			fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+			headers: mergeHeaders(_config.headers, options.headers),
+			serializedBody: void 0
+		};
+		if (opts.security) await setAuthParams(opts);
+		if (opts.requestValidator) await opts.requestValidator(opts);
+		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
+		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
+		const resolvedOpts = opts;
+		return {
+			opts: resolvedOpts,
+			url: buildUrl(resolvedOpts)
+		};
+	};
+	const request = async (options) => {
+		const throwOnError = options.throwOnError ?? _config.throwOnError;
+		const responseStyle = options.responseStyle ?? _config.responseStyle;
+		let request;
+		let response;
+		try {
+			const { opts, url } = await beforeRequest(options);
+			const requestInit = {
+				redirect: "follow",
+				...opts,
+				body: getValidRequestBody(opts)
+			};
+			request = new Request(url, requestInit);
+			for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+			const _fetch = opts.fetch;
+			response = await _fetch(request);
+			for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+			const result = {
+				request,
+				response
+			};
+			if (response.ok) {
+				const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+				if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+					let emptyData;
+					switch (parseAs) {
+						case "arrayBuffer":
+						case "blob":
+						case "text":
+							emptyData = await response[parseAs]();
+							break;
+						case "formData":
+							emptyData = new FormData();
+							break;
+						case "stream":
+							emptyData = response.body;
+							break;
+						default:
+							emptyData = {};
+							break;
+					}
+					return opts.responseStyle === "data" ? emptyData : {
+						data: emptyData,
+						...result
+					};
+				}
+				let data;
+				switch (parseAs) {
+					case "arrayBuffer":
+					case "blob":
+					case "formData":
+					case "text":
+						data = await response[parseAs]();
+						break;
+					case "json": {
+						const text = await response.text();
+						data = text ? JSON.parse(text) : {};
+						break;
+					}
+					case "stream": return opts.responseStyle === "data" ? response.body : {
+						data: response.body,
+						...result
+					};
+				}
+				if (parseAs === "json") {
+					if (opts.responseValidator) await opts.responseValidator(data);
+					if (opts.responseTransformer) data = await opts.responseTransformer(data);
+				}
+				return opts.responseStyle === "data" ? data : {
+					data,
+					...result
+				};
+			}
+			const textError = await response.text();
+			let jsonError;
+			try {
+				jsonError = JSON.parse(textError);
+			} catch {}
+			throw jsonError ?? textError;
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(finalError, response, request, options);
+			finalError = finalError || {};
+			if (throwOnError) throw finalError;
+			return responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response
+			};
+		}
+	};
+	const makeMethodFn = (method) => (options) => request({
+		...options,
+		method
+	});
+	const makeSseFn = (method) => async (options) => {
+		const { opts, url } = await beforeRequest(options);
+		return createSseClient({
+			...opts,
+			body: opts.body,
+			method,
+			onRequest: async (url, init) => {
+				let request = new Request(url, init);
+				for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+				return request;
+			},
+			serializedBody: getValidRequestBody(opts),
+			url
+		});
+	};
+	const _buildUrl = (options) => buildUrl({
+		..._config,
+		...options
+	});
+	return {
+		buildUrl: _buildUrl,
+		connect: makeMethodFn("CONNECT"),
+		delete: makeMethodFn("DELETE"),
+		get: makeMethodFn("GET"),
+		getConfig,
+		head: makeMethodFn("HEAD"),
+		interceptors,
+		options: makeMethodFn("OPTIONS"),
+		patch: makeMethodFn("PATCH"),
+		post: makeMethodFn("POST"),
+		put: makeMethodFn("PUT"),
+		request,
+		setConfig,
+		sse: {
+			connect: makeSseFn("CONNECT"),
+			delete: makeSseFn("DELETE"),
+			get: makeSseFn("GET"),
+			head: makeSseFn("HEAD"),
+			options: makeSseFn("OPTIONS"),
+			patch: makeSseFn("PATCH"),
+			post: makeSseFn("POST"),
+			put: makeSseFn("PUT"),
+			trace: makeSseFn("TRACE")
+		},
+		trace: makeMethodFn("TRACE")
+	};
+};
+const client$1 = createClient(createConfig({ baseUrl: "https://api.primitive.dev/v1" }));
+/**
+* Receive a pending webhook event without a public endpoint
+*
+* Wait up to 30 seconds for one existing event. The body string preserves the exact webhook serialization; headers and canonical occurrence/type metadata travel alongside it. A fixed lease protects the attempt while a short handler accepts input. Retry may redeliver an occurrence: deduplicate event_id. Empty delivery means no offer now, not proof all input was delivered; inspect backlog and persistent gap_count/last_gap_reason. Queue retention is 24 hours and does not extend source-content retention. Disconnecting preserves pending work. Same named destination shares consumption; different destinations get independent copies.
+*/
+const pullWebhookEvent = (options) => (options.client ?? client$1).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/pull",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Report the outcome of a local webhook delivery attempt
+*
+* Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
+*/
+const completeWebhookEvent = (options) => (options.client ?? client$1).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/complete",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+var EventReceiverError = class extends Error {
+	constructor(message, code, status = 0, retryAfterMs = 0) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.retryAfterMs = retryAfterMs;
+		this.name = "EventReceiverError";
+	}
+};
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateOffer(value) {
+	if (!record(value) || !Number.isSafeInteger(value.backlog) || Number(value.backlog) < 0 || !Number.isSafeInteger(value.gap_count) || Number(value.gap_count) < 0 || value.last_gap_reason !== null && typeof value.last_gap_reason !== "string" || value.retention_seconds !== 86400 || value.handler_timeout_seconds !== 30) throw new EventReceiverError("Invalid event status response", "invalid_response");
+	const d = value.delivery;
+	if (d !== null && (!record(d) || ![
+		"queue_id",
+		"event_id",
+		"delivery_id",
+		"lease_token",
+		"event_type",
+		"body",
+		"lease_expires_at"
+	].every((key) => typeof d[key] === "string") || !Number.isFinite(Date.parse(String(d.lease_expires_at))) || !record(d.headers) || !Object.values(d.headers).every((header) => typeof header === "string"))) throw new EventReceiverError("Invalid event delivery response", "invalid_response");
+	return value;
+}
+function retryAfter(value) {
+	if (!value) return 0;
+	const ms = /^\d+(\.\d+)?$/.test(value) ? Number(value) * 1e3 : Date.parse(value) - Date.now();
+	return Number.isFinite(ms) ? Math.max(0, ms) : 0;
+}
+function unwrap(result) {
+	if (result.data !== void 0 && !result.error) return result.data;
+	const code = record(result.error) && record(result.error.error) && typeof result.error.error.code === "string" ? result.error.error.code : "request_failed";
+	throw new EventReceiverError(`Event request failed (${result.response?.status ?? 0}, ${code})`, code, result.response?.status ?? 0, retryAfter(result.response?.headers.get("retry-after") ?? null));
+}
+/** Shared by the SDK and CLI. Completion retries preserve the original evidence. */
+var EventConnection = class {
+	socket;
+	pending;
+	origin;
+	touch;
+	constructor(client, endpointId, options = {}) {
+		this.client = client;
+		this.endpointId = endpointId;
+		this.options = options;
+	}
+	close() {
+		const socket = this.socket;
+		this.socket = void 0;
+		this.pending?.reject(new EventReceiverError("Event connection closed", "disconnected"));
+		this.pending = void 0;
+		socket?.close();
+	}
+	async open(signal) {
+		if (this.options.transport === "poll" || this.socket?.readyState === 1) return;
+		const config = this.client.getConfig();
+		if (this.origin !== void 0 && this.origin !== config.baseUrl) throw new EventReceiverError("The API environment changed; restart the receiver", "identity_changed", 403);
+		this.origin = config.baseUrl;
+		const auth = typeof config.auth === "function" ? await config.auth({
+			type: "http",
+			scheme: "bearer"
+		}) : config.auth;
+		const authorization = new Headers(config.headers).get("authorization");
+		const token = typeof auth === "string" ? auth.replace(/^Bearer /i, "") : authorization?.replace(/^Bearer /i, "");
+		if (!token) throw new EventReceiverError("Event receiver requires bearer credentials", "unauthorized", 401);
+		const url = new URL(`${config.baseUrl?.replace(/\/+$/, "")}/endpoints/${encodeURIComponent(this.endpointId)}/stream`);
+		if (url.protocol !== "https:" && !(url.protocol === "http:" && [
+			"localhost",
+			"127.0.0.1",
+			"[::1]"
+		].includes(url.hostname))) throw new EventReceiverError("Event connections require HTTPS (except loopback development)", "unsupported");
+		url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+		const socket = (this.options.webSocketFactory ?? ((address, protocol) => new WebSocket(address, protocol)))(url.href, "primitive.events.v1");
+		this.socket = socket;
+		socket.addEventListener("message", (message) => {
+			if (this.socket !== socket) return;
+			let frame;
+			try {
+				frame = JSON.parse(String(message.data));
+			} catch {
+				this.fail(new EventReceiverError("Invalid event frame", "invalid_response"));
+				return;
+			}
+			this.touch?.();
+			if (!record(frame)) {
+				this.fail(new EventReceiverError("Invalid event frame", "invalid_response"));
+				return;
+			}
+			if (frame.type === "ping") {
+				socket.send(JSON.stringify({ type: "pong" }));
+				return;
+			}
+			if (frame.type === "status") {
+				try {
+					this.options.onStatus?.(validateOffer(frame.data));
+				} catch (error) {
+					this.fail(error);
+				}
+				return;
+			}
+			if (frame.type === "error") {
+				this.fail(new EventReceiverError("Event stream request failed", typeof frame.code === "string" ? frame.code : "request_failed", typeof frame.status === "number" ? frame.status : 0, retryAfter(typeof frame.retry_after === "string" ? frame.retry_after : null)));
+				return;
+			}
+			this.pending?.resolve(frame);
+		});
+		socket.addEventListener("close", () => {
+			if (this.socket === socket) this.fail(new EventReceiverError("Event stream disconnected", "disconnected"));
+		});
+		socket.addEventListener("error", () => {
+			if (this.socket === socket) this.fail(new EventReceiverError("Event stream connection failed", "disconnected"));
+		});
+		const ready = await this.exchange(signal, void 0, () => {
+			socket.addEventListener("open", () => socket.send(JSON.stringify({
+				type: "authenticate",
+				token
+			})), { once: true });
+		}, 15e3);
+		if (!record(ready) || ready.type !== "ready" || ready.protocol !== "primitive.events.v1") {
+			this.close();
+			throw new EventReceiverError("Unsupported event stream protocol", "unsupported");
+		}
+	}
+	fail(error) {
+		this.pending?.reject(error);
+		this.pending = void 0;
+		this.close();
+	}
+	async exchange(signal, frame, start, timeoutMs = 6e4) {
+		signal.throwIfAborted();
+		if (this.pending) throw new EventReceiverError("Concurrent event operation", "busy", 409);
+		let cleanup = () => {};
+		try {
+			return await new Promise((resolve, reject) => {
+				const abort = () => {
+					reject(signal.reason);
+					this.close();
+				};
+				let timer;
+				this.touch = () => {
+					clearTimeout(timer);
+					timer = setTimeout(() => this.fail(new EventReceiverError("Event stream timed out", "disconnected")), timeoutMs);
+				};
+				this.touch();
+				cleanup = () => {
+					this.touch = void 0;
+					clearTimeout(timer);
+					signal.removeEventListener("abort", abort);
+					this.pending = void 0;
+				};
+				this.pending = {
+					resolve,
+					reject
+				};
+				signal.addEventListener("abort", abort, { once: true });
+				if (frame) this.socket?.send(JSON.stringify(frame));
+				start?.();
+			});
+		} finally {
+			cleanup();
+		}
+	}
+	async receive(signal) {
+		if (this.options.transport === "poll") return validateOffer(unwrap(await pullWebhookEvent({
+			client: this.client,
+			path: { id: this.endpointId },
+			body: { wait_seconds: 25 },
+			responseStyle: "fields",
+			throwOnError: false,
+			signal: AbortSignal.any([signal, AbortSignal.timeout(45e3)])
+		})).data);
+		await this.open(signal);
+		const frame = await this.exchange(signal, { type: "receive" }, void 0, 9e4);
+		if (!record(frame) || frame.type !== "event") throw new EventReceiverError("Invalid event frame", "invalid_response");
+		return validateOffer(frame.data);
+	}
+	async complete(body, signal) {
+		let receipt;
+		if (this.options.transport === "poll") receipt = unwrap(await completeWebhookEvent({
+			client: this.client,
+			path: { id: this.endpointId },
+			body,
+			responseStyle: "fields",
+			throwOnError: false,
+			signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
+		})).data;
+		else {
+			await this.open(signal);
+			const frame = await this.exchange(signal, {
+				type: "complete",
+				body
+			}, void 0, 15e3);
+			if (!record(frame) || frame.type !== "receipt") throw new EventReceiverError("Invalid event receipt", "invalid_response");
+			receipt = frame.data;
+		}
+		if (!record(receipt) || !["completed", "already_completed"].includes(String(receipt.result))) throw new EventReceiverError("Invalid event receipt", "invalid_response");
+	}
+};
+//#endregion
 //#region src/oclif/listen-state.ts
 var ListenStateError = class extends Error {};
 function normalizeListenOrigin(value) {
@@ -34621,7 +36757,7 @@ function resolveListenSubscription(configDir, identity, explicit) {
 var ListenError = class extends Error {};
 var RequestFailure = class extends ListenError {
 	constructor(status, code, retryAfter) {
-		super(status === 401 || status === 403 ? "Listener authorization failed. Run primitive signin or check your API key and account permissions." : status === 409 && code === "subscription_conflict" ? "This subscription has different event filters. Omit --events to resume it, or use primitive listen --subscription new-subscription (add your --events selection)." : `Listener API request failed (HTTP ${status || "transport"}, ${code}).`);
+		super(code === "agent_connection_scope_forbidden" ? "This operation is outside the connected address grant. Use inbound email events and this credential’s own subscription." : status === 401 || status === 403 ? "Listener authorization failed. Run primitive signin or check your API key and account permissions." : status === 409 && code === "subscription_conflict" ? "This subscription has different event filters. Omit --events to resume it, or use primitive listen --subscription new-subscription (add your --events selection)." : `Listener API request failed (HTTP ${status || "transport"}, ${code}).`);
 		this.status = status;
 		this.code = code;
 		this.retryAfter = retryAfter;
@@ -34681,8 +36817,10 @@ async function runListen(options) {
 	let accountId;
 	let verifiedKey;
 	let verified = false;
+	let connectedCredential = false;
 	let confirmed = 0;
 	let release;
+	let stream;
 	async function retry(operation) {
 		for (let attempt = 0;; attempt++) {
 			signal.throwIfAborted();
@@ -34693,9 +36831,14 @@ async function runListen(options) {
 				error = failure(result, now());
 			} catch (caught) {
 				if (signal.aborted) throw signal.reason;
-				if (caught instanceof ListenError) throw caught;
-				if (caught instanceof SyntaxError) throw new ListenError("The API returned malformed JSON.");
-				error = new RequestFailure(0, "transport", 0);
+				if (caught instanceof EventReceiverError) {
+					if (["invalid_response", "unsupported"].includes(caught.code)) throw new ListenError(caught.message);
+					error = new RequestFailure(caught.status, caught.code, caught.retryAfterMs);
+				} else {
+					if (caught instanceof ListenError) throw caught;
+					if (caught instanceof SyntaxError) throw new ListenError("The API returned malformed JSON.");
+					error = new RequestFailure(0, "transport", 0);
+				}
 			}
 			if (![
 				0,
@@ -34719,7 +36862,7 @@ async function runListen(options) {
 					signal: AbortSignal.any([
 						signal,
 						...init?.signal ? [init.signal] : [],
-						AbortSignal.timeout(3e4)
+						AbortSignal.timeout(45e3)
 					])
 				})
 			});
@@ -34730,6 +36873,15 @@ async function runListen(options) {
 		if (origin !== void 0 && origin !== base) throw new ListenError("The API environment changed while listening. Restart the listener.");
 		origin = base;
 		if (!verified || auth.auth.apiKey !== verifiedKey) {
+			if (auth.auth.apiKey?.startsWith("pconn_")) {
+				connectedCredential = true;
+				const identity = `connection:${scryptSync(auth.auth.apiKey, "primitive-listener-identity-v1", 32).toString("hex")}`;
+				if (accountId !== void 0 && accountId !== identity) throw new ListenError("The connected credential changed while listening. Restart the listener.");
+				accountId = identity;
+				verifiedKey = auth.auth.apiKey;
+				verified = true;
+				return auth.apiClient.client;
+			}
 			const account = await retry(() => getAccount({
 				client: auth.apiClient.client,
 				responseStyle: "fields",
@@ -34766,20 +36918,35 @@ async function runListen(options) {
 		});
 		const endpoint = registered.data;
 		if (registered.success !== true || !endpoint || typeof endpoint.id !== "string" || endpoint.kind !== "pull" || endpoint.enabled === false) throw new ListenError("The API did not return an enabled pull subscription.");
+		const streamClient = await freshClient();
+		if (options.transport !== "poll") {
+			if (!endpoint.receiver_capabilities?.stream_protocols.includes("primitive.events.v1")) throw new ListenError("This API does not support WebSocket events. Use --transport poll explicitly for an older API.");
+			if (!endpoint.receiver_capabilities.completion_modes.includes(options.mode ?? "stdout")) throw new ListenError("This API does not support the selected listener handler mode.");
+			stream = new EventConnection(streamClient, endpoint.id);
+		}
 		const selected = endpoint.rules?.event_types;
-		const selection = Array.isArray(selected) && selected.every((value) => typeof value === "string" && /^[a-zA-Z0-9_.-]+$/.test(value)) ? selected.join(", ") : "all events";
+		const selection = Array.isArray(selected) && selected.every((value) => typeof value === "string" && /^[a-zA-Z0-9_.-]+$/.test(value)) ? selected.join(", ") : endpoint.recipient ? `inbound email for ${JSON.stringify(endpoint.recipient)}` : "all events";
 		stderr.write(`Listening on subscription ${subscription.name} (${endpoint.id}); ${resumed ? "resumed" : "created"}, mode ${options.mode ?? "stdout"}, selection: ${selection}. Retention: 24 hours; handler limit: 30 seconds. Pending count follows the first poll. Ctrl-C disconnects; delete with primitive endpoints delete --id ${endpoint.id}.\n`);
 		let lastGap = -1;
 		let lastBacklog = -1;
 		while (!signal.aborted && (options.number === void 0 || confirmed < options.number)) {
 			const pollStarted = now();
-			const result = await retry(async () => pullWebhookEvent({
-				client: await freshClient(),
-				path: { id: endpoint.id },
-				body: { wait_seconds: 25 },
-				responseStyle: "fields",
-				signal: AbortSignal.any([signal, AbortSignal.timeout(4e4)])
-			}));
+			const result = await retry(async () => {
+				if (stream) {
+					streamClient.setConfig((await freshClient()).getConfig());
+					return { data: {
+						success: true,
+						data: await stream.receive(signal)
+					} };
+				}
+				return pullWebhookEvent$1({
+					client: await freshClient(),
+					path: { id: endpoint.id },
+					body: { wait_seconds: 25 },
+					responseStyle: "fields",
+					signal: AbortSignal.any([signal, AbortSignal.timeout(45e3)])
+				});
+			});
 			if (result.success !== true || !result.data || !Number.isSafeInteger(result.data.gap_count) || result.data.gap_count < 0 || result.data.last_gap_reason !== null && typeof result.data.last_gap_reason !== "string" || !Number.isSafeInteger(result.data.backlog) || result.data.backlog < 0 || result.data.handler_timeout_seconds !== 30 || result.data.retention_seconds !== 86400) throw new ListenError("The API returned an invalid pull response.");
 			const data = result.data;
 			const gapReasons = {
@@ -34821,14 +36988,25 @@ async function runListen(options) {
 				delivery_id: delivery.delivery_id,
 				lease_token: delivery.lease_token
 			};
+			if ((connectedCredential || endpoint.recipient) && completion.mode === "http") completion.confirmed = false;
 			try {
-				const receipt = await retry(async () => completeWebhookEvent({
-					client: await freshClient(),
-					path: { id: endpoint.id },
-					body: completion,
-					responseStyle: "fields",
-					signal: AbortSignal.any([signal, AbortSignal.timeout(3e4)])
-				}));
+				const receipt = await retry(async () => {
+					if (stream) {
+						streamClient.setConfig((await freshClient()).getConfig());
+						await stream.complete(completion, signal);
+						return { data: {
+							success: true,
+							data: { result: "completed" }
+						} };
+					}
+					return completeWebhookEvent$1({
+						client: await freshClient(),
+						path: { id: endpoint.id },
+						body: completion,
+						responseStyle: "fields",
+						signal: AbortSignal.any([signal, AbortSignal.timeout(3e4)])
+					});
+				});
 				if (receipt.success !== true || !["completed", "already_completed"].includes(receipt.data?.result)) throw new ListenError("The API returned an invalid completion receipt.");
 				if (handled.succeeded) confirmed++;
 				else stderr.write("Handler reported failure; the server will apply its retry policy.\n");
@@ -34840,6 +37018,7 @@ async function runListen(options) {
 	} catch (error) {
 		if (!signal.aborted) throw error;
 	} finally {
+		stream?.close();
 		release?.();
 	}
 	return confirmed;
@@ -34848,14 +37027,29 @@ async function runListen(options) {
 //#region src/oclif/commands/listen.ts
 var ListenCommand = class ListenCommand extends Command {
 	static summary = "Receive webhook events locally without a public endpoint";
-	static description = "Subscribe once and reconnect using the same durable server queue. Use a short --exec hook to durably accept an event, --forward-to for a local webhook, or newline-delimited JSON on stdout.";
+	static description = "Subscribe once and reconnect using the same durable server queue. Connected-agent credentials automatically receive only their assigned address. Use a short --exec hook to durably accept an event, --forward-to for a local webhook, or newline-delimited JSON on stdout.";
 	static examples = [
 		"<%= config.bin %> listen",
 		"<%= config.bin %> listen --subscription my-agent --exec \"python3 accept.py\"",
-		"<%= config.bin %> listen --forward-to http://127.0.0.1:3000/webhook"
+		"<%= config.bin %> listen --forward-to localhost:3000",
+		"<%= config.bin %> listen --once --timeout 60"
 	];
 	static flags = {
-		subscription: Flags.string({ description: "Stable subscription name. Defaults to a saved name for this account and API environment." }),
+		transport: Flags.string({
+			description: "Event transport; WebSocket is the default.",
+			options: ["websocket", "poll"],
+			default: "websocket"
+		}),
+		once: Flags.boolean({
+			description: "Exit after one successfully handled and confirmed event.",
+			exclusive: ["number"]
+		}),
+		timeout: Flags.integer({
+			description: "Stop after this many seconds; exit 2 if the requested count was not reached.",
+			min: 1,
+			max: 2147483
+		}),
+		subscription: Flags.string({ description: "Stable subscription name. Defaults to a saved name for this credential scope and API environment." }),
 		exec: Flags.string({
 			description: "Short POSIX shell command accepting each complete event on stdin.",
 			exclusive: ["forward-to"]
@@ -34888,17 +37082,23 @@ var ListenCommand = class ListenCommand extends Command {
 			forwardTo: flags["forward-to"]
 		});
 		const controller = new AbortController();
+		let timedOut = false;
+		const timer = flags.timeout === void 0 ? void 0 : setTimeout(() => {
+			timedOut = true;
+			controller.abort();
+		}, flags.timeout * 1e3);
 		const cancel = () => controller.abort();
 		process.on("SIGINT", cancel);
 		process.on("SIGTERM", cancel);
 		try {
 			await runListen({
+				transport: flags.transport === "poll" ? "poll" : "websocket",
 				configDir: this.config.configDir,
 				apiKey: flags["api-key"],
 				apiBaseUrl: flags["api-base-url"],
 				subscription: flags.subscription,
 				events: events === void 0 ? void 0 : [...new Set(events)],
-				number: flags.number,
+				number: flags.once ? 1 : flags.number,
 				mode: flags.exec ? "exec" : flags["forward-to"] ? "http" : "stdout",
 				handler,
 				signal: controller.signal
@@ -34906,10 +37106,11 @@ var ListenCommand = class ListenCommand extends Command {
 		} catch (error) {
 			throw new Errors.CLIError(error instanceof ListenError || error instanceof ListenStateError ? error.message : "The listener stopped because of a local state or connection error.");
 		} finally {
+			clearTimeout(timer);
 			process.removeListener("SIGINT", cancel);
 			process.removeListener("SIGTERM", cancel);
 		}
-		if (controller.signal.aborted) process.exitCode = 130;
+		if (controller.signal.aborted) process.exitCode = timedOut ? 2 : 130;
 	}
 };
 //#endregion
@@ -35172,7 +37373,7 @@ const MAX_CLI_LOGIN_POLL_INTERVAL_SECONDS = 60;
 function cliError$3(message) {
 	return new Errors.CLIError(message, { exit: 1 });
 }
-function sleep$1(ms) {
+function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function openBrowser(url) {
@@ -35337,7 +37538,7 @@ var LoginCommand$1 = class extends Command {
 		let interval = Math.min(Math.max(1, start.interval), MAX_CLI_LOGIN_POLL_INTERVAL_SECONDS);
 		let nextPollDelay = 1;
 		while (Date.now() < deadline) {
-			await sleep$1(nextPollDelay * 1e3);
+			await sleep(nextPollDelay * 1e3);
 			nextPollDelay = interval;
 			const polled = await pollCliLogin({
 				body: { device_code: start.device_code },
@@ -36967,331 +39168,6 @@ var OrgSecretsSetCommand = class OrgSecretsSetCommand extends Command {
 	}
 };
 //#endregion
-//#region ../sdk-node/dist/payloads-BfJAtqW9.js
-/**
-* Load a Node builtin at call time. Exported for direct testing of the
-* unavailable-module error path; production code goes through the typed
-* wrappers below.
-*/
-async function loadBuiltin(specifier, operation) {
-	let builtin;
-	if (typeof process !== "undefined" && typeof process.getBuiltinModule === "function") try {
-		builtin = process.getBuiltinModule(specifier);
-	} catch {
-		builtin = void 0;
-	}
-	if (builtin !== void 0 && builtin !== null) return builtin;
-	try {
-		return await import(specifier);
-	} catch (cause) {
-		throw new Error(`${operation} requires file system access, which this runtime does not provide. Pass in-memory bytes instead of a file path when running outside Node.js.`, { cause });
-	}
-}
-/** `node:fs`, loaded lazily so Workers-style bundles never see the import. */
-function loadNodeFs(operation) {
-	return loadBuiltin("node:fs", operation);
-}
-/** `node:fs/promises`, loaded lazily for the same reason as {@link loadNodeFs}. */
-function loadNodeFsPromises(operation) {
-	return loadBuiltin("node:fs/promises", operation);
-}
-const CHUNK_SIZE = 64 * 1024 * 1024;
-const MANIFEST_VERSION = 1;
-const CHUNK_KDF_INFO = "payloads-chunk";
-const OBJECT_ID_BYTES = 16;
-const CEK_BYTES = 32;
-function subtle() {
-	return globalThis.crypto.subtle;
-}
-const textEncoder = new TextEncoder();
-function randomBytes(length) {
-	const out = new Uint8Array(length);
-	globalThis.crypto.getRandomValues(out);
-	return out;
-}
-function toHex(bytes) {
-	let out = "";
-	for (const b of bytes) out += b.toString(16).padStart(2, "0");
-	return out;
-}
-function fromHex(hex) {
-	if (hex.length % 2 !== 0) throw new Error("invalid hex: odd length");
-	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("invalid hex: non-hex character");
-	const out = new Uint8Array(hex.length / 2);
-	for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-	return out;
-}
-async function contentHash(bytes) {
-	return new Uint8Array(await subtle().digest("SHA-256", bytes));
-}
-async function contentHashHex(bytes) {
-	return toHex(await contentHash(bytes));
-}
-/** Binary Merkle root over ordered hex leaf hashes (odd node promoted). */
-async function merkleRoot(leafHashesHex) {
-	if (leafHashesHex.length === 0) return contentHashHex(new Uint8Array(0));
-	let level = leafHashesHex.map(fromHex);
-	while (level.length > 1) {
-		const next = [];
-		for (let i = 0; i < level.length; i += 2) {
-			const left = level[i];
-			const right = i + 1 < level.length ? level[i + 1] : level[i];
-			const combined = new Uint8Array(left.length + right.length);
-			combined.set(left, 0);
-			combined.set(right, left.length);
-			next.push(await contentHash(combined));
-		}
-		level = next;
-	}
-	return toHex(level[0]);
-}
-async function deriveChunkKey(cek, index) {
-	const baseKey = await subtle().importKey("raw", cek, "HKDF", false, ["deriveKey"]);
-	const info = textEncoder.encode(`${CHUNK_KDF_INFO}:${index}`);
-	return subtle().deriveKey({
-		name: "HKDF",
-		hash: "SHA-256",
-		salt: new Uint8Array(32),
-		info
-	}, baseKey, {
-		name: "AES-GCM",
-		length: 256
-	}, false, ["encrypt", "decrypt"]);
-}
-function chunkNonce(index) {
-	const nonce = new Uint8Array(12);
-	new DataView(nonce.buffer).setUint32(8, index >>> 0, false);
-	return nonce;
-}
-function chunkAad(objectId, index) {
-	const aad = new Uint8Array(objectId.length + 4);
-	aad.set(objectId, 0);
-	new DataView(aad.buffer).setUint32(objectId.length, index >>> 0, false);
-	return aad;
-}
-async function encryptChunk(cek, objectId, index, plaintext) {
-	const key = await deriveChunkKey(cek, index);
-	const ct = await subtle().encrypt({
-		name: "AES-GCM",
-		iv: chunkNonce(index),
-		additionalData: chunkAad(objectId, index)
-	}, key, plaintext);
-	return new Uint8Array(ct);
-}
-async function decryptChunk(cek, objectId, index, ciphertext) {
-	const key = await deriveChunkKey(cek, index);
-	const pt = await subtle().decrypt({
-		name: "AES-GCM",
-		iv: chunkNonce(index),
-		additionalData: chunkAad(objectId, index)
-	}, key, ciphertext);
-	return new Uint8Array(pt);
-}
-function authHeaders(apiKey) {
-	return { authorization: `Bearer ${apiKey}` };
-}
-function apiRoot(baseUrl) {
-	let end = baseUrl.length;
-	while (end > 0 && baseUrl.charCodeAt(end - 1) === 47) end--;
-	return `${baseUrl.slice(0, end)}/v1/payloads`;
-}
-const DEFAULT_MAX_RETRIES = 6;
-const RETRYABLE_STATUS = new Set([
-	429,
-	500,
-	502,
-	503,
-	504
-]);
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/**
-* fetch with exponential backoff on transient failures. Request bodies here are
-* in-memory buffers/strings (never streams), so a retry can safely resend them.
-*/
-async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES) {
-	for (let attempt = 0;; attempt++) {
-		let res;
-		let networkError;
-		try {
-			res = await fetch(url, init);
-		} catch (err) {
-			networkError = err;
-		}
-		if (res && !RETRYABLE_STATUS.has(res.status)) return res;
-		if (attempt >= maxRetries) {
-			if (res) return res;
-			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
-		}
-		if (res) await res.text().catch(() => {});
-		await sleep(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
-	}
-}
-async function initiate(opts, manifest) {
-	const res = await retryingFetch(apiRoot(opts.baseUrl), {
-		method: "POST",
-		headers: {
-			...authHeaders(opts.apiKey),
-			"content-type": "application/json"
-		},
-		body: JSON.stringify({ manifest })
-	}, "initiate");
-	if (!res.ok) throw new Error(`initiate failed: HTTP ${res.status} ${await res.text()}`);
-	await res.text();
-}
-async function putChunk(opts, root, d, bytes) {
-	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, {
-		method: "PUT",
-		headers: {
-			...authHeaders(opts.apiKey),
-			"content-type": "application/octet-stream"
-		},
-		body: bytes
-	}, `chunk ${d.index} upload`);
-	if (!res.ok) throw new Error(`chunk ${d.index} upload failed: HTTP ${res.status} ${await res.text()}`);
-	await res.text();
-}
-async function finalize(opts, root) {
-	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/finalize`, {
-		method: "POST",
-		headers: authHeaders(opts.apiKey)
-	}, "finalize");
-	if (!res.ok) throw new Error(`finalize failed: HTTP ${res.status} ${await res.text()}`);
-	await res.text();
-}
-async function fetchManifest(opts, root) {
-	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/manifest`, { headers: authHeaders(opts.apiKey) }, "get manifest");
-	if (!res.ok) throw new Error(`get manifest failed: HTTP ${res.status} ${await res.text()}`);
-	return (await res.json()).data.manifest;
-}
-async function getChunkBytes(opts, root, d) {
-	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, { headers: authHeaders(opts.apiKey) }, `get chunk ${d.index}`);
-	if (!res.ok) throw new Error(`get chunk ${d.index} failed: HTTP ${res.status}`);
-	return new Uint8Array(await res.arrayBuffer());
-}
-async function readWindow(fh, position, length) {
-	const buf = Buffer.allocUnsafe(length);
-	let read = 0;
-	while (read < length) {
-		const { bytesRead } = await fh.read(buf, read, length - read, position + read);
-		if (bytesRead === 0) break;
-		read += bytesRead;
-	}
-	return read === length ? buf : buf.subarray(0, read);
-}
-async function mapLimit(items, limit, fn) {
-	let next = 0;
-	let firstError;
-	const worker = async () => {
-		while (next < items.length && firstError === void 0) {
-			const i = next++;
-			try {
-				await fn(items[i], i);
-			} catch (err) {
-				if (firstError === void 0) firstError = err;
-				return;
-			}
-		}
-	};
-	await Promise.all(Array.from({ length: Math.min(limit, items.length || 1) }, () => worker()));
-	if (firstError !== void 0) throw firstError;
-}
-/**
-* Stream a file up as a Primitive Payload. Two passes over the file (encrypt to
-* build the manifest, then encrypt again to upload) keep memory bounded to a few
-* chunks — the whole object is never resident. Returns the content address
-* (merkleRoot) and the hex CEK needed to download it.
-*/
-async function pushFile(filePath, opts) {
-	const { open, stat } = await loadNodeFsPromises("pushFile");
-	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
-	const concurrency = opts.concurrency ?? 3;
-	const { size } = await stat(filePath);
-	const cek = randomBytes(CEK_BYTES);
-	const objectId = randomBytes(OBJECT_ID_BYTES);
-	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
-	const fh = await open(filePath, "r");
-	try {
-		const descriptors = [];
-		for (let index = 0; index < chunkCount; index++) {
-			const position = index * chunkSize;
-			const length = Math.min(chunkSize, size - position);
-			const plaintext = await readWindow(fh, position, length);
-			const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
-			descriptors.push({
-				index,
-				ciphertextHash: await contentHashHex(ciphertext),
-				plaintextSize: length,
-				ciphertextSize: ciphertext.length
-			});
-			opts.onProgress?.("encrypt", index + 1, chunkCount);
-		}
-		const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
-		await initiate(opts, {
-			version: MANIFEST_VERSION,
-			objectId: toHex(objectId),
-			chunkSize,
-			totalPlaintextSize: size,
-			chunkCount,
-			chunks: descriptors,
-			merkleRoot: root
-		});
-		let uploaded = 0;
-		await mapLimit(descriptors, concurrency, async (d) => {
-			const plaintext = await readWindow(fh, d.index * chunkSize, d.plaintextSize);
-			await putChunk(opts, root, d, await encryptChunk(cek, objectId, d.index, plaintext));
-			opts.onProgress?.("upload", ++uploaded, chunkCount);
-		});
-		await finalize(opts, root);
-		return {
-			merkleRoot: root,
-			cek: toHex(cek),
-			chunkCount,
-			totalBytes: size
-		};
-	} finally {
-		await fh.close();
-	}
-}
-/**
-* Stream a Primitive Payload down to a file, verifying and decrypting one chunk
-* at a time (bounded memory). Every chunk is content-address-checked before
-* decryption, so a corrupt or substituted chunk throws.
-*/
-async function pullFile(root, outPath, opts) {
-	const { createWriteStream } = await loadNodeFs("pullFile");
-	const { rm } = await loadNodeFsPromises("pullFile");
-	const manifest = await fetchManifest(opts, root);
-	const computedRoot = await merkleRoot(manifest.chunks.map((c) => c.ciphertextHash));
-	if (computedRoot !== root) throw new Error(`manifest does not match the requested content address (got ${computedRoot})`);
-	const cek = fromHex(opts.cek);
-	const objectId = fromHex(manifest.objectId);
-	const out = createWriteStream(outPath);
-	let onWriteError = () => {};
-	const writeErrored = new Promise((_, reject) => {
-		onWriteError = reject;
-	});
-	writeErrored.catch(() => {});
-	out.on("error", (err) => onWriteError(err));
-	try {
-		let done = 0;
-		for (const d of manifest.chunks) {
-			const ciphertext = await getChunkBytes(opts, root, d);
-			if (await contentHashHex(ciphertext) !== d.ciphertextHash) throw new Error(`chunk ${d.index} failed integrity check`);
-			const plaintext = await decryptChunk(cek, objectId, d.index, ciphertext);
-			if (!out.write(plaintext)) await Promise.race([new Promise((resolve) => out.once("drain", resolve)), writeErrored]);
-			opts.onProgress?.("download", ++done, manifest.chunkCount);
-		}
-		await Promise.race([new Promise((resolve) => out.end(resolve)), writeErrored]);
-	} catch (err) {
-		out.destroy();
-		await rm(outPath, { force: true });
-		throw err;
-	}
-	return manifest;
-}
-//#endregion
 //#region src/oclif/commands/payloads.ts
 const DEFAULT_API_BASE_URL = "https://api.primitive.dev";
 const authFlags = {
@@ -41739,6 +43615,8 @@ const CANONICAL_OPERATION_ALIASES = {
 };
 const DESCRIBE_OPERATION_ALIASES = {
 	...CANONICAL_OPERATION_ALIASES,
+	"credits:balance": "credits:get-credit-balance",
+	"credits:redeem": "credits:redeem-credit-code",
 	"domains:zone-file": "domains:download-domain-zone-file",
 	"functions:logs": "functions:list-function-logs",
 	"memories:delete": "memories:delete-memory",
@@ -41756,7 +43634,8 @@ const OVERRIDDEN_OPERATION_IDS = new Set([
 	"inbox:get-inbox-status",
 	"search:semantic-search",
 	"payments:register-payout-address",
-	"payments:pay-challenge"
+	"payments:pay-challenge",
+	"credits:redeem-credit-code"
 ]);
 const generatedCommands = Object.fromEntries(operationManifest.filter((operation) => !OVERRIDDEN_OPERATION_IDS.has(operationId(operation))).map((operation) => [operationId(operation), createOperationCommand(operation)]));
 const COMMANDS = {
@@ -41837,6 +43716,9 @@ const COMMANDS = {
 	"memories:get": MemoriesGetCommand,
 	"memories:delete": MemoriesDeleteCommand,
 	"memories:search": MemoriesSearchCommand,
+	"credits:redeem": CreditsRedeemCommand,
+	"credits:redeem-credit-code": CreditsRedeemCommand,
+	"credits:balance": CreditsBalanceCommand,
 	...Object.fromEntries(Object.entries(CANONICAL_OPERATION_ALIASES).map(([alias, target]) => {
 		const command = generatedCommands[target];
 		if (!command) throw new Error(`Missing generated command target for alias ${alias}`);