primcli 1.4.0 → 1.6.0

package/dist/oclif/index.js

@@ -7,6 +7,8 @@ import process$1 from "node:process";
 import { createInterface } from "node:readline/promises";
 import { hostname } from "node:os";
 import { spawn } from "node:child_process";
+import { X402Error, createX402Client } from "@primitivedotdev/sdk/x402";
+import { privateKeyToAccount } from "viem/accounts";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -28,21 +30,25 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	cliLogout: () => cliLogout,
 	createAgentAccount: () => createAgentAccount,
 	createAgentClaimLink: () => createAgentClaimLink,
+	createChallenge: () => createChallenge,
 	createEndpoint: () => createEndpoint,
 	createFilter: () => createFilter,
 	createFunction: () => createFunction,
 	createFunctionSecret: () => createFunctionSecret,
+	createOrgSecret: () => createOrgSecret,
 	deleteDomain: () => deleteDomain,
 	deleteEmail: () => deleteEmail,
 	deleteEndpoint: () => deleteEndpoint,
 	deleteFilter: () => deleteFilter,
 	deleteFunction: () => deleteFunction,
 	deleteFunctionSecret: () => deleteFunctionSecret,
+	deleteOrgSecret: () => deleteOrgSecret,
 	discardEmailContent: () => discardEmailContent,
 	downloadAttachments: () => downloadAttachments,
 	downloadDomainZoneFile: () => downloadDomainZoneFile,
 	downloadRawEmail: () => downloadRawEmail,
 	getAccount: () => getAccount,
+	getChallenge: () => getChallenge,
 	getConversation: () => getConversation,
 	getEmail: () => getEmail,
 	getFunction: () => getFunction,
@@ -52,9 +58,11 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getOrgRoutingTopology: () => getOrgRoutingTopology,
 	getSendPermissions: () => getSendPermissions,
 	getSentEmail: () => getSentEmail,
+	getSpendPolicy: () => getSpendPolicy,
 	getStorageStats: () => getStorageStats,
 	getThread: () => getThread,
 	getWebhookSecret: () => getWebhookSecret,
+	listDeclinedPayments: () => listDeclinedPayments,
 	listDeliveries: () => listDeliveries,
 	listDomains: () => listDomains,
 	listEmails: () => listEmails,
@@ -63,8 +71,12 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	listFunctionLogs: () => listFunctionLogs,
 	listFunctionSecrets: () => listFunctionSecrets,
 	listFunctions: () => listFunctions,
+	listOrgSecrets: () => listOrgSecrets,
+	listPayoutAddresses: () => listPayoutAddresses,
 	listSentEmails: () => listSentEmails,
+	payChallenge: () => payChallenge,
 	pollCliLogin: () => pollCliLogin,
+	registerPayoutAddress: () => registerPayoutAddress,
 	replayDelivery: () => replayDelivery,
 	replayEmailWebhooks: () => replayEmailWebhooks,
 	replyToEmail: () => replyToEmail,
@@ -76,6 +88,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	sendEmail: () => sendEmail,
 	setFunctionRoute: () => setFunctionRoute,
 	setFunctionSecret: () => setFunctionSecret,
+	setOrgSecret: () => setOrgSecret,
 	startAgentClaim: () => startAgentClaim,
 	startAgentSignup: () => startAgentSignup,
 	startCliLogin: () => startCliLogin,
@@ -88,6 +101,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	updateEndpoint: () => updateEndpoint,
 	updateFilter: () => updateFilter,
 	updateFunction: () => updateFunction,
+	updateSpendPolicy: () => updateSpendPolicy,
 	verifyAgentClaim: () => verifyAgentClaim,
 	verifyAgentSignup: () => verifyAgentSignup,
 	verifyCliSignup: () => verifyCliSignup,
@@ -1517,6 +1531,85 @@ const setFunctionSecret = (options) => (options.client ?? client).put({
 	}
 });
 /**
+* List org-level (global) secrets
+*
+* Returns metadata for every org-level secret. Org secrets apply
+* to every function in the org and are read as `env.<KEY>` in
+* handlers. **Values are never returned.** Secret writes are
+* write-only. A function-level secret of the same name overrides
+* the org-level value for that function.
+*
+*/
+const listOrgSecrets = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/org/secrets",
+	...options
+});
+/**
+* Create or update an org secret
+*
+* Idempotent insert-or-update keyed on `(org_id, key)`. Returns
+* 201 the first time the key is set, 200 on subsequent updates.
+* Values are encrypted at rest. A changed value lands in a
+* function only on that function's next deploy.
+*
+* Keys must match `^[A-Z_][A-Z0-9_]*$` (uppercase letters,
+* digits, underscores; first character is a letter or
+* underscore). Values are at most 4096 UTF-8 bytes. System-
+* managed keys are reserved and rejected.
+*
+*/
+const createOrgSecret = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/org/secrets",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete an org secret
+*
+* Removes the org secret. Functions keep the previous value until
+* each is redeployed. Returns 404 if the key did not exist.
+*
+*/
+const deleteOrgSecret = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/org/secrets/{key}",
+	...options
+});
+/**
+* Set an org secret by key
+*
+* Path-keyed companion to `POST /org/secrets`. Idempotent:
+* returns 201 the first time the key is set, 200 on subsequent
+* updates. Same validation and write-only guarantees as POST.
+*
+*/
+const setOrgSecret = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/org/secrets/{key}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
 * List a function's execution logs
 *
 * Returns the most recent `function_logs` rows for the function,
@@ -1538,6 +1631,165 @@ const listFunctionLogs = (options) => (options.client ?? client).get({
 	url: "/functions/{id}/logs",
 	...options
 });
+/**
+* List payout addresses
+*
+* List your org's registered payout addresses, newest first.
+*/
+const listPayoutAddresses = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/payout-addresses",
+	...options
+});
+/**
+* Register a payout address
+*
+* Register (or update) the default payout address your org receives x402
+* payments at, for a given network. You prove control of the address with
+* an org-bound `personal_sign` signature over the message produced by the
+* SDK helper `buildPayoutRegistrationMessage`. The org id is taken from your
+* authenticated key, never the body, so a captured signature can't register
+* an address under another org. Exactly one default address exists per
+* (org, network); registering again replaces it. A payee MUST register a
+* payout address before calling `createChallenge`, because the challenge's
+* `pay_to` is resolved from this directory.
+*
+*/
+const registerPayoutAddress = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/payout-addresses",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Create a payment challenge
+*
+* Create an x402 payment challenge (the payee side of a payment). The
+* `pay_to` address is resolved server-side from your registered default
+* payout address for the network, never from the request. The response
+* carries the `nonce_binding` and `payment_requirements` the payer needs to
+* sign; hand the whole challenge object to the payer (for example in an
+* email reply). Amounts are in token base units (USDC has 6 decimals, so
+* `"10000"` is 0.01 USDC).
+*
+*/
+const createChallenge = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/challenges",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get a payment challenge
+*
+* Fetch a challenge you created, to poll its `status` and settlement
+* receipt (`settle_tx`). Scoped to the challenger org that created it.
+*
+*/
+const getChallenge = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/challenges/{id}",
+	...options
+});
+/**
+* Pay a payment challenge
+*
+* Settle a challenge addressed to your org as payer. The request body
+* carries a signed x402 `PaymentPayload`: an EIP-3009
+* `transferWithAuthorization` signed locally with your own key, whose nonce
+* is bound to the challenge via the SDK's `deriveEip3009Nonce`. The platform
+* verifies every signed field against its own record of the challenge,
+* applies your spend policy, and settles on-chain through a facilitator.
+* Settlement is non-custodial; Primitive never holds funds. Idempotent:
+* paying an already-settled challenge returns the original receipt. Most
+* callers use the SDK `pay()` helper rather than building the payload by
+* hand.
+*
+*/
+const payChallenge = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/challenges/{id}/pay",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get your spend policy
+*
+* Read your org's outbound spend policy: the kill-switch, per-payment and
+* per-day caps, and the payee allowlist. Returns the defaults (no limits,
+* not paused) when no policy has been set.
+*
+*/
+const getSpendPolicy = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/spend-policy",
+	...options
+});
+/**
+* Update your spend policy
+*
+* Update your org's spend policy. Applied as a merge: only the fields you
+* include change, and omitted fields keep their current value, so a partial
+* update can't silently reset the kill-switch. Send an explicit `null` to
+* clear a cap. Caps are in token base units.
+*
+*/
+const updateSpendPolicy = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/spend-policy",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List declined payments
+*
+* The 50 most recent payments your org's spend policy declined, newest
+* first. Use this to see why an outbound payment was refused (a cap, the
+* payee allowlist, or the kill-switch) instead of only reading the
+* dashboard.
+*
+*/
+const listDeclinedPayments = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/declined-payments",
+	...options
+});
 //#endregion
 //#region ../packages/api-core/src/openapi/openapi.generated.ts
 /**
@@ -1614,6 +1866,10 @@ const openapiDocument = {
 			"name": "Filters",
 			"description": "Manage whitelist and blocklist filter rules"
 		},
+		{
+			"name": "Payments",
+			"description": "Collect and pay stablecoin (USDC) payments with x402. Settlement is\nnon-custodial: funds move directly from payer to payee on-chain via an\nEIP-3009 authorization the payer signs with their own key, and Primitive\nnever holds funds. The payee registers a payout address and creates a\nchallenge; the payer signs and settles it under a configurable spend\npolicy (kill-switch, per-payment and per-day caps, payee allowlist).\n"
+		},
 		{
 			"name": "Webhook Deliveries",
 			"description": "View and replay webhook delivery attempts"
@@ -3709,6 +3965,111 @@ const openapiDocument = {
 				}
 			}
 		},
+		"/org/secrets": {
+			"get": {
+				"operationId": "listOrgSecrets",
+				"summary": "List org-level (global) secrets",
+				"description": "Returns metadata for every org-level secret. Org secrets apply\nto every function in the org and are read as `env.<KEY>` in\nhandlers. **Values are never returned.** Secret writes are\nwrite-only. A function-level secret of the same name overrides\nthe org-level value for that function.\n",
+				"tags": ["Functions"],
+				"responses": {
+					"200": {
+						"description": "List of org secrets (metadata only, no values)",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "object",
+								"properties": { "items": {
+									"type": "array",
+									"items": { "$ref": "#/components/schemas/OrgSecretListItem" }
+								} },
+								"required": ["items"]
+							} }
+						}] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" }
+				}
+			},
+			"post": {
+				"operationId": "createOrgSecret",
+				"summary": "Create or update an org secret",
+				"description": "Idempotent insert-or-update keyed on `(org_id, key)`. Returns\n201 the first time the key is set, 200 on subsequent updates.\nValues are encrypted at rest. A changed value lands in a\nfunction only on that function's next deploy.\n\nKeys must match `^[A-Z_][A-Z0-9_]*$` (uppercase letters,\ndigits, underscores; first character is a letter or\nunderscore). Values are at most 4096 UTF-8 bytes. System-\nmanaged keys are reserved and rejected.\n",
+				"tags": ["Functions"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateOrgSecretInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Secret updated",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/OrgSecretWriteResult" } }
+						}] } } }
+					},
+					"201": {
+						"description": "Secret created",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/OrgSecretWriteResult" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" }
+				}
+			}
+		},
+		"/org/secrets/{key}": {
+			"parameters": [{
+				"name": "key",
+				"in": "path",
+				"required": true,
+				"description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+				"schema": {
+					"type": "string",
+					"pattern": "^[A-Z_][A-Z0-9_]*$"
+				}
+			}],
+			"put": {
+				"operationId": "setOrgSecret",
+				"summary": "Set an org secret by key",
+				"description": "Path-keyed companion to `POST /org/secrets`. Idempotent:\nreturns 201 the first time the key is set, 200 on subsequent\nupdates. Same validation and write-only guarantees as POST.\n",
+				"tags": ["Functions"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetOrgSecretInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Secret updated",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/OrgSecretWriteResult" } }
+						}] } } }
+					},
+					"201": {
+						"description": "Secret created",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/OrgSecretWriteResult" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" }
+				}
+			},
+			"delete": {
+				"operationId": "deleteOrgSecret",
+				"summary": "Delete an org secret",
+				"description": "Removes the org secret. Functions keep the previous value until\neach is redeployed. Returns 404 if the key did not exist.\n",
+				"tags": ["Functions"],
+				"responses": {
+					"204": { "description": "Secret deleted" },
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"404": { "$ref": "#/components/responses/NotFound" }
+				}
+			}
+		},
 		"/functions/{id}/logs": {
 			"parameters": [{ "$ref": "#/components/parameters/ResourceId" }],
 			"get": {
@@ -3761,30 +4122,222 @@ const openapiDocument = {
 					"404": { "$ref": "#/components/responses/NotFound" }
 				}
 			}
-		}
-	},
-	"components": {
-		"securitySchemes": {
-			"BearerAuth": {
-				"type": "http",
-				"scheme": "bearer",
-				"description": "API key with `prim_` prefix: `Authorization: Bearer prim_<key>`"
-			},
-			"DownloadToken": {
-				"type": "apiKey",
-				"in": "query",
-				"name": "token",
-				"description": "Signed download token provided in webhook payloads"
-			}
 		},
-		"parameters": {
-			"ResourceId": {
-				"name": "id",
-				"in": "path",
-				"required": true,
-				"schema": {
-					"type": "string",
-					"format": "uuid"
+		"/x402/payout-addresses": {
+			"post": {
+				"operationId": "registerPayoutAddress",
+				"summary": "Register a payout address",
+				"description": "Register (or update) the default payout address your org receives x402\npayments at, for a given network. You prove control of the address with\nan org-bound `personal_sign` signature over the message produced by the\nSDK helper `buildPayoutRegistrationMessage`. The org id is taken from your\nauthenticated key, never the body, so a captured signature can't register\nan address under another org. Exactly one default address exists per\n(org, network); registering again replaces it. A payee MUST register a\npayout address before calling `createChallenge`, because the challenge's\n`pay_to` is resolved from this directory.\n",
+				"tags": ["Payments"],
+				"security": [{ "BearerAuth": [] }],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterPayoutAddressInput" } } }
+				},
+				"responses": {
+					"201": {
+						"description": "Payout address registered (or updated) and set as default",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/X402PayoutAddress" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"422": { "$ref": "#/components/responses/UnprocessableEntity" },
+					"429": { "$ref": "#/components/responses/RateLimited" }
+				}
+			},
+			"get": {
+				"operationId": "listPayoutAddresses",
+				"summary": "List payout addresses",
+				"description": "List your org's registered payout addresses, newest first.",
+				"tags": ["Payments"],
+				"security": [{ "BearerAuth": [] }],
+				"responses": {
+					"200": {
+						"description": "Your registered payout addresses",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "array",
+								"items": { "$ref": "#/components/schemas/X402PayoutAddress" }
+							} }
+						}] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"429": { "$ref": "#/components/responses/RateLimited" }
+				}
+			}
+		},
+		"/x402/challenges": { "post": {
+			"operationId": "createChallenge",
+			"summary": "Create a payment challenge",
+			"description": "Create an x402 payment challenge (the payee side of a payment). The\n`pay_to` address is resolved server-side from your registered default\npayout address for the network, never from the request. The response\ncarries the `nonce_binding` and `payment_requirements` the payer needs to\nsign; hand the whole challenge object to the payer (for example in an\nemail reply). Amounts are in token base units (USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC).\n",
+			"tags": ["Payments"],
+			"security": [{ "BearerAuth": [] }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateChallengeInput" } } }
+			},
+			"responses": {
+				"201": {
+					"description": "Challenge created",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/X402Challenge" } }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"422": { "$ref": "#/components/responses/UnprocessableEntity" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
+		"/x402/challenges/{id}": { "get": {
+			"operationId": "getChallenge",
+			"summary": "Get a payment challenge",
+			"description": "Fetch a challenge you created, to poll its `status` and settlement\nreceipt (`settle_tx`). Scoped to the challenger org that created it.\n",
+			"tags": ["Payments"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{ "$ref": "#/components/parameters/ResourceId" }],
+			"responses": {
+				"200": {
+					"description": "The challenge",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/X402Challenge" } }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"404": { "$ref": "#/components/responses/NotFound" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
+		"/x402/challenges/{id}/pay": { "post": {
+			"operationId": "payChallenge",
+			"summary": "Pay a payment challenge",
+			"description": "Settle a challenge addressed to your org as payer. The request body\ncarries a signed x402 `PaymentPayload`: an EIP-3009\n`transferWithAuthorization` signed locally with your own key, whose nonce\nis bound to the challenge via the SDK's `deriveEip3009Nonce`. The platform\nverifies every signed field against its own record of the challenge,\napplies your spend policy, and settles on-chain through a facilitator.\nSettlement is non-custodial; Primitive never holds funds. Idempotent:\npaying an already-settled challenge returns the original receipt. Most\ncallers use the SDK `pay()` helper rather than building the payload by\nhand.\n",
+			"tags": ["Payments"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{ "$ref": "#/components/parameters/ResourceId" }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/PayChallengeInput" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Challenge settled (or already settled)",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/X402Receipt" } }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"404": { "$ref": "#/components/responses/NotFound" },
+				"409": { "$ref": "#/components/responses/Conflict" },
+				"422": { "$ref": "#/components/responses/UnprocessableEntity" },
+				"429": { "$ref": "#/components/responses/RateLimited" },
+				"502": { "$ref": "#/components/responses/BadGateway" }
+			}
+		} },
+		"/x402/spend-policy": {
+			"get": {
+				"operationId": "getSpendPolicy",
+				"summary": "Get your spend policy",
+				"description": "Read your org's outbound spend policy: the kill-switch, per-payment and\nper-day caps, and the payee allowlist. Returns the defaults (no limits,\nnot paused) when no policy has been set.\n",
+				"tags": ["Payments"],
+				"security": [{ "BearerAuth": [] }],
+				"responses": {
+					"200": {
+						"description": "The spend policy",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/X402SpendPolicy" } }
+						}] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"429": { "$ref": "#/components/responses/RateLimited" }
+				}
+			},
+			"put": {
+				"operationId": "updateSpendPolicy",
+				"summary": "Update your spend policy",
+				"description": "Update your org's spend policy. Applied as a merge: only the fields you\ninclude change, and omitted fields keep their current value, so a partial\nupdate can't silently reset the kill-switch. Send an explicit `null` to\nclear a cap. Caps are in token base units.\n",
+				"tags": ["Payments"],
+				"security": [{ "BearerAuth": [] }],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateSpendPolicyInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "The updated spend policy",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/X402SpendPolicy" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"429": { "$ref": "#/components/responses/RateLimited" }
+				}
+			}
+		},
+		"/x402/declined-payments": { "get": {
+			"operationId": "listDeclinedPayments",
+			"summary": "List declined payments",
+			"description": "The 50 most recent payments your org's spend policy declined, newest\nfirst. Use this to see why an outbound payment was refused (a cap, the\npayee allowlist, or the kill-switch) instead of only reading the\ndashboard.\n",
+			"tags": ["Payments"],
+			"security": [{ "BearerAuth": [] }],
+			"responses": {
+				"200": {
+					"description": "Recently declined payments",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": {
+							"type": "array",
+							"items": { "$ref": "#/components/schemas/X402DeclinedPayment" }
+						} }
+					}] } } }
+				},
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} }
+	},
+	"components": {
+		"securitySchemes": {
+			"BearerAuth": {
+				"type": "http",
+				"scheme": "bearer",
+				"description": "API key with `prim_` prefix: `Authorization: Bearer prim_<key>`"
+			},
+			"DownloadToken": {
+				"type": "apiKey",
+				"in": "query",
+				"name": "token",
+				"description": "Signed download token provided in webhook payloads"
+			}
+		},
+		"parameters": {
+			"ResourceId": {
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"schema": {
+					"type": "string",
+					"format": "uuid"
 				},
 				"description": "Resource UUID"
 			},
@@ -3928,6 +4481,32 @@ const openapiDocument = {
 					}
 				} }
 			},
+			"Conflict": {
+				"description": "The request conflicts with the current state of the resource",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+					"example": {
+						"success": false,
+						"error": {
+							"code": "conflict",
+							"message": "settlement already in progress"
+						}
+					}
+				} }
+			},
+			"UnprocessableEntity": {
+				"description": "The request was well-formed but could not be processed. For Payments\nthis covers a missing payout address, a failed payment verification, a\nspend-policy decline, or an expired challenge; `error.code` distinguishes\nthem.\n",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+					"example": {
+						"success": false,
+						"error": {
+							"code": "payment_declined",
+							"message": "payment exceeds the per-payment cap"
+						}
+					}
+				} }
+			},
 			"Deleted": {
 				"description": "Resource deleted",
 				"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
@@ -3944,60 +4523,500 @@ const openapiDocument = {
 			}
 		},
 		"schemas": {
-			"SuccessEnvelope": {
+			"RegisterPayoutAddressInput": {
 				"type": "object",
-				"properties": { "success": {
-					"type": "boolean",
-					"const": true
-				} },
-				"required": ["success", "data"]
+				"additionalProperties": false,
+				"properties": {
+					"address": {
+						"type": "string",
+						"pattern": "^0x[0-9a-fA-F]{40}$",
+						"description": "The payout address (your signer's own EVM address), 0x-prefixed."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"],
+						"description": "The chain the address receives on."
+					},
+					"signature": {
+						"type": "string",
+						"pattern": "^0x[0-9a-fA-F]+$",
+						"description": "A `personal_sign` signature over the org-bound message produced by\nthe SDK helper `buildPayoutRegistrationMessage`. Recovered and\nchecked against `address`; the org id is bound into the signed bytes.\n"
+					},
+					"issued_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "ISO-8601 timestamp embedded in the signed message. Must be within a\nshort freshness window (about 10 minutes) of server time.\n"
+					},
+					"label": {
+						"type": "string",
+						"maxLength": 80,
+						"description": "Optional human-readable label."
+					}
+				},
+				"required": [
+					"address",
+					"network",
+					"signature",
+					"issued_at"
+				]
 			},
-			"ListEnvelope": {
+			"X402PayoutAddress": {
 				"type": "object",
 				"properties": {
-					"success": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"address": {
+						"type": "string",
+						"description": "The checksummed payout address."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"label": { "type": ["string", "null"] },
+					"is_default": {
 						"type": "boolean",
-						"const": true
+						"description": "Exactly one address per (org, network) is the default."
 					},
-					"meta": { "$ref": "#/components/schemas/PaginationMeta" }
+					"verified_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "When ownership of the address was last proven."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
 				},
 				"required": [
-					"success",
-					"data",
-					"meta"
+					"id",
+					"address",
+					"network",
+					"label",
+					"is_default",
+					"verified_at"
 				]
 			},
-			"PaginationMeta": {
+			"CreateChallengeInput": {
 				"type": "object",
+				"additionalProperties": false,
 				"properties": {
-					"total": {
-						"type": "integer",
-						"description": "Total number of matching records"
+					"amount": {
+						"type": "string",
+						"pattern": "^[1-9][0-9]{0,38}$",
+						"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
 					},
-					"limit": {
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"payer_org": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The org id allowed to pay this challenge (on-net binding). Optional.\n"
+					},
+					"expires_in": {
 						"type": "integer",
-						"description": "Page size used for this request"
+						"minimum": 60,
+						"maximum": 86400,
+						"description": "Seconds until the challenge expires. Defaults to 3600."
 					},
-					"cursor": {
-						"type": ["string", "null"],
-						"description": "Cursor for the next page, or null if no more results"
+					"resource": {
+						"type": "string",
+						"format": "uri",
+						"maxLength": 2048,
+						"description": "Optional URL identifying what is being paid for. Defaults to a\nsynthetic `x402:challenge:<id>` identifier.\n"
+					},
+					"description": {
+						"type": "string",
+						"maxLength": 512,
+						"description": "Optional human-readable description of the payment."
+					}
+				},
+				"required": ["amount", "network"]
+			},
+			"X402NonceBinding": {
+				"type": "object",
+				"description": "The interaction binding the payer hashes into the EIP-3009 nonce\n(`deriveEip3009Nonce`). Pinning the nonce to this binding is what lets an\nx402 payment ride asynchronous transports safely: a replayed challenge\ncan't redirect funds and a signed payment can't settle twice.\n",
+				"properties": {
+					"interaction_id": {
+						"type": "string",
+						"description": "Interaction id, including its `@domain` part."
+					},
+					"challenge_step_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"challenge_nonce": {
+						"type": "string",
+						"pattern": "^[0-9a-f]{64}$",
+						"description": "32 random bytes as 64 lowercase hex chars."
 					}
 				},
 				"required": [
-					"total",
-					"limit",
-					"cursor"
+					"interaction_id",
+					"challenge_step_id",
+					"challenge_nonce"
 				]
 			},
-			"ErrorResponse": {
+			"X402PaymentRequirements": {
 				"type": "object",
+				"description": "The x402 `PaymentRequirements` the payer signs over. Field names are\nx402's native camelCase, preserved byte-for-byte.\n",
 				"properties": {
-					"success": {
-						"type": "boolean",
-						"const": false
+					"scheme": {
+						"type": "string",
+						"description": "The x402 settlement scheme. Always `exact` for v1.",
+						"example": "exact"
 					},
-					"error": {
-						"type": "object",
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"maxAmountRequired": {
+						"type": "string",
+						"description": "Amount in token base units."
+					},
+					"payTo": {
+						"type": "string",
+						"description": "The payee's resolved payout address (checksummed)."
+					},
+					"asset": {
+						"type": "string",
+						"description": "The token contract address (checksummed). USDC."
+					},
+					"resource": { "type": "string" },
+					"description": { "type": "string" },
+					"maxTimeoutSeconds": { "type": "integer" },
+					"extra": {
+						"type": "object",
+						"description": "The token's load-bearing EIP-712 domain params. `name` differs by\nchain (Base mainnet USDC is `USD Coin`, Base Sepolia is `USDC`); a\nwrong value produces a signature the verifier rejects.\n",
+						"properties": {
+							"name": { "type": "string" },
+							"version": { "type": "string" }
+						},
+						"required": ["name", "version"]
+					}
+				},
+				"required": [
+					"scheme",
+					"network",
+					"maxAmountRequired",
+					"payTo",
+					"asset",
+					"extra"
+				]
+			},
+			"X402Challenge": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"status": {
+						"type": "string",
+						"enum": [
+							"pending",
+							"settling",
+							"settled",
+							"failed",
+							"expired"
+						]
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"asset": {
+						"type": "string",
+						"description": "Token contract address (checksummed)."
+					},
+					"amount": {
+						"type": "string",
+						"description": "Amount in token base units."
+					},
+					"pay_to": {
+						"type": "string",
+						"description": "The payee's resolved payout address (checksummed)."
+					},
+					"payer_org": {
+						"type": ["string", "null"],
+						"description": "The org id bound as payer, if one was set at creation."
+					},
+					"resource": { "type": ["string", "null"] },
+					"description": { "type": ["string", "null"] },
+					"nonce_binding": { "$ref": "#/components/schemas/X402NonceBinding" },
+					"settle_tx": {
+						"type": ["string", "null"],
+						"description": "On-chain settlement transaction hash once settled."
+					},
+					"settled_at": {
+						"type": ["string", "null"],
+						"format": "date-time"
+					},
+					"failure_reason": { "type": ["string", "null"] },
+					"expires_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"payment_requirements": {
+						"description": "Present on the create response. Hand the whole challenge (including\nthis) to the payer; `getChallenge` omits it (it is for status polling\nby the challenger).\n",
+						"allOf": [{ "$ref": "#/components/schemas/X402PaymentRequirements" }]
+					}
+				},
+				"required": [
+					"id",
+					"status",
+					"network",
+					"asset",
+					"amount",
+					"pay_to",
+					"nonce_binding",
+					"expires_at"
+				]
+			},
+			"X402PaymentPayload": {
+				"type": "object",
+				"description": "A signed x402 v1 `PaymentPayload`. The SDK `pay()` helper builds this;\ncallers rarely construct it by hand. Field names are x402-native.\n",
+				"properties": {
+					"x402Version": {
+						"type": "integer",
+						"const": 1
+					},
+					"scheme": {
+						"type": "string",
+						"const": "exact"
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"payload": {
+						"type": "object",
+						"properties": {
+							"signature": {
+								"type": "string",
+								"pattern": "^0x[0-9a-fA-F]+$",
+								"description": "The EIP-712 signature over the authorization."
+							},
+							"authorization": {
+								"type": "object",
+								"description": "The EIP-3009 `transferWithAuthorization` fields, as strings.",
+								"properties": {
+									"from": { "type": "string" },
+									"to": { "type": "string" },
+									"value": { "type": "string" },
+									"validAfter": { "type": "string" },
+									"validBefore": { "type": "string" },
+									"nonce": { "type": "string" }
+								},
+								"required": [
+									"from",
+									"to",
+									"value",
+									"validAfter",
+									"validBefore",
+									"nonce"
+								]
+							}
+						},
+						"required": ["signature", "authorization"]
+					}
+				},
+				"required": [
+					"x402Version",
+					"scheme",
+					"network",
+					"payload"
+				]
+			},
+			"PayChallengeInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": { "payment": { "$ref": "#/components/schemas/X402PaymentPayload" } },
+				"required": ["payment"]
+			},
+			"X402Receipt": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"status": {
+						"type": "string",
+						"enum": ["settled"]
+					},
+					"settle_tx": {
+						"type": ["string", "null"],
+						"description": "On-chain settlement transaction hash."
+					}
+				},
+				"required": [
+					"id",
+					"status",
+					"settle_tx"
+				]
+			},
+			"X402SpendPolicy": {
+				"type": "object",
+				"description": "The payer's outbound spend policy. Returned with defaults (not paused,\nno caps, any on-net payee) when none is set.\n",
+				"properties": {
+					"paused": {
+						"type": "boolean",
+						"description": "Kill-switch. When true, all outbound payments are refused."
+					},
+					"max_per_payment": {
+						"type": ["string", "null"],
+						"description": "Per-payment cap in token base units, or null for no cap."
+					},
+					"max_per_day": {
+						"type": ["string", "null"],
+						"description": "Rolling-day cap in token base units, or null for no cap."
+					},
+					"allowlist": {
+						"type": ["array", "null"],
+						"items": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"description": "Allowed payee org ids. `null` allows any on-net payee; `[]` denies\nall.\n"
+					}
+				},
+				"required": [
+					"paused",
+					"max_per_payment",
+					"max_per_day",
+					"allowlist"
+				]
+			},
+			"UpdateSpendPolicyInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "Merge update: only the fields you include change; omit a field to keep\nits current value; send `null` to clear a cap.\n",
+				"properties": {
+					"paused": { "type": "boolean" },
+					"max_per_payment": {
+						"type": ["string", "null"],
+						"pattern": "^[1-9][0-9]{0,38}$"
+					},
+					"max_per_day": {
+						"type": ["string", "null"],
+						"pattern": "^[1-9][0-9]{0,38}$"
+					},
+					"allowlist": {
+						"type": ["array", "null"],
+						"maxItems": 1e3,
+						"items": {
+							"type": "string",
+							"format": "uuid"
+						}
+					}
+				}
+			},
+			"X402DeclinedPayment": {
+				"type": "object",
+				"description": "A payment the org's spend policy refused.",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"challenge_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The challenge that was declined, if still present."
+					},
+					"counterparty_org": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The payee (challenger) org, when known."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"amount": {
+						"type": "string",
+						"description": "Amount in token base units."
+					},
+					"reason": {
+						"type": "string",
+						"description": "Why the payment was declined (cap, allowlist, paused)."
+					},
+					"declined_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"network",
+					"amount",
+					"reason",
+					"declined_at"
+				]
+			},
+			"SuccessEnvelope": {
+				"type": "object",
+				"properties": { "success": {
+					"type": "boolean",
+					"const": true
+				} },
+				"required": ["success", "data"]
+			},
+			"ListEnvelope": {
+				"type": "object",
+				"properties": {
+					"success": {
+						"type": "boolean",
+						"const": true
+					},
+					"meta": { "$ref": "#/components/schemas/PaginationMeta" }
+				},
+				"required": [
+					"success",
+					"data",
+					"meta"
+				]
+			},
+			"PaginationMeta": {
+				"type": "object",
+				"properties": {
+					"total": {
+						"type": "integer",
+						"description": "Total number of matching records"
+					},
+					"limit": {
+						"type": "integer",
+						"description": "Page size used for this request"
+					},
+					"cursor": {
+						"type": ["string", "null"],
+						"description": "Cursor for the next page, or null if no more results"
+					}
+				},
+				"required": [
+					"total",
+					"limit",
+					"cursor"
+				]
+			},
+			"ErrorResponse": {
+				"type": "object",
+				"properties": {
+					"success": {
+						"type": "boolean",
+						"const": false
+					},
+					"error": {
+						"type": "object",
 						"properties": {
 							"code": {
 								"type": "string",
@@ -4033,7 +5052,14 @@ const openapiDocument = {
 									"email_delivery_failed",
 									"clerk_signup_failed",
 									"no_orgs_for_user",
-									"org_not_accessible"
+									"org_not_accessible",
+									"feature_disabled",
+									"no_payout_address",
+									"ownership_proof_failed",
+									"payment_verification_failed",
+									"payment_declined",
+									"challenge_expired",
+									"settlement_failed"
 								]
 							},
 							"message": { "type": "string" },
@@ -7920,31 +8946,106 @@ const openapiDocument = {
 					"updated_at",
 					"created"
 				]
-			}
-		}
-	}
-};
-//#endregion
-//#region ../packages/api-core/src/openapi/operations.generated.ts
-const operationManifest = [
-	{
-		"binaryResponse": false,
-		"bodyRequired": false,
-		"command": "get-account",
-		"description": null,
-		"hasJsonBody": false,
-		"method": "GET",
-		"operationId": "getAccount",
-		"path": "/account",
-		"pathParams": [],
-		"queryParams": [],
-		"requestSchema": null,
-		"responseSchema": {
-			"type": "object",
-			"properties": {
-				"id": {
-					"type": "string",
-					"format": "uuid"
+			},
+			"OrgSecretListItem": {
+				"type": "object",
+				"description": "One row from GET /org/secrets. Org secrets are always user-set\n(there are no managed org secrets), so `created_at` /\n`updated_at` are always present.\n",
+				"properties": {
+					"key": { "type": "string" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"key",
+					"created_at",
+					"updated_at"
+				]
+			},
+			"CreateOrgSecretInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "Body for POST /org/secrets.",
+				"properties": {
+					"key": {
+						"type": "string",
+						"pattern": "^[A-Z_][A-Z0-9_]*$",
+						"description": "Uppercase letters, digits, and underscores. Must start with\na letter or underscore. System-managed keys are reserved.\n"
+					},
+					"value": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 4096,
+						"description": "Secret value, up to 4096 UTF-8 bytes. Encrypted at rest.\nNever returned by any read endpoint.\n"
+					}
+				},
+				"required": ["key", "value"]
+			},
+			"SetOrgSecretInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "Body for PUT /org/secrets/{key}. Key comes from the path.",
+				"properties": { "value": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 4096
+				} },
+				"required": ["value"]
+			},
+			"OrgSecretWriteResult": {
+				"type": "object",
+				"description": "Returned by POST and PUT org secret routes.",
+				"properties": {
+					"key": { "type": "string" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"created": {
+						"type": "boolean",
+						"description": "True if this call inserted a new row, false if it updated an existing one."
+					}
+				},
+				"required": [
+					"key",
+					"created_at",
+					"updated_at",
+					"created"
+				]
+			}
+		}
+	}
+};
+//#endregion
+//#region ../packages/api-core/src/openapi/operations.generated.ts
+const operationManifest = [
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-account",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getAccount",
+		"path": "/account",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
 				},
 				"email": { "type": "string" },
 				"plan": { "type": "string" },
@@ -11624,6 +12725,66 @@ const operationManifest = [
 		"tag": "Functions",
 		"tagCommand": "functions"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "create-org-secret",
+		"description": "Idempotent insert-or-update keyed on `(org_id, key)`. Returns\n201 the first time the key is set, 200 on subsequent updates.\nValues are encrypted at rest. A changed value lands in a\nfunction only on that function's next deploy.\n\nKeys must match `^[A-Z_][A-Z0-9_]*$` (uppercase letters,\ndigits, underscores; first character is a letter or\nunderscore). Values are at most 4096 UTF-8 bytes. System-\nmanaged keys are reserved and rejected.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createOrgSecret",
+		"path": "/org/secrets",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Body for POST /org/secrets.",
+			"properties": {
+				"key": {
+					"type": "string",
+					"pattern": "^[A-Z_][A-Z0-9_]*$",
+					"description": "Uppercase letters, digits, and underscores. Must start with\na letter or underscore. System-managed keys are reserved.\n"
+				},
+				"value": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 4096,
+					"description": "Secret value, up to 4096 UTF-8 bytes. Encrypted at rest.\nNever returned by any read endpoint.\n"
+				}
+			},
+			"required": ["key", "value"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "Returned by POST and PUT org secret routes.",
+			"properties": {
+				"key": { "type": "string" },
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"updated_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"created": {
+					"type": "boolean",
+					"description": "True if this call inserted a new row, false if it updated an existing one."
+				}
+			},
+			"required": [
+				"key",
+				"created_at",
+				"updated_at",
+				"created"
+			]
+		},
+		"sdkName": "createOrgSecret",
+		"summary": "Create or update an org secret",
+		"tag": "Functions",
+		"tagCommand": "functions"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -11678,6 +12839,30 @@ const operationManifest = [
 		"tag": "Functions",
 		"tagCommand": "functions"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "delete-org-secret",
+		"description": "Removes the org secret. Functions keep the previous value until\neach is redeployed. Returns 404 if the key did not exist.\n",
+		"hasJsonBody": false,
+		"method": "DELETE",
+		"operationId": "deleteOrgSecret",
+		"path": "/org/secrets/{key}",
+		"pathParams": [{
+			"description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+			"enum": null,
+			"name": "key",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": null,
+		"sdkName": "deleteOrgSecret",
+		"summary": "Delete an org secret",
+		"tag": "Functions",
+		"tagCommand": "functions"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -12558,6 +13743,50 @@ const operationManifest = [
 		"tag": "Functions",
 		"tagCommand": "functions"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-org-secrets",
+		"description": "Returns metadata for every org-level secret. Org secrets apply\nto every function in the org and are read as `env.<KEY>` in\nhandlers. **Values are never returned.** Secret writes are\nwrite-only. A function-level secret of the same name overrides\nthe org-level value for that function.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listOrgSecrets",
+		"path": "/org/secrets",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": { "items": {
+				"type": "array",
+				"items": {
+					"type": "object",
+					"description": "One row from GET /org/secrets. Org secrets are always user-set\n(there are no managed org secrets), so `created_at` /\n`updated_at` are always present.\n",
+					"properties": {
+						"key": { "type": "string" },
+						"created_at": {
+							"type": "string",
+							"format": "date-time"
+						},
+						"updated_at": {
+							"type": "string",
+							"format": "date-time"
+						}
+					},
+					"required": [
+						"key",
+						"created_at",
+						"updated_at"
+					]
+				}
+			} },
+			"required": ["items"]
+		},
+		"sdkName": "listOrgSecrets",
+		"summary": "List org-level (global) secrets",
+		"tag": "Functions",
+		"tagCommand": "functions"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
@@ -12746,6 +13975,64 @@ const operationManifest = [
 		"tag": "Functions",
 		"tagCommand": "functions"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "set-org-secret",
+		"description": "Path-keyed companion to `POST /org/secrets`. Idempotent:\nreturns 201 the first time the key is set, 200 on subsequent\nupdates. Same validation and write-only guarantees as POST.\n",
+		"hasJsonBody": true,
+		"method": "PUT",
+		"operationId": "setOrgSecret",
+		"path": "/org/secrets/{key}",
+		"pathParams": [{
+			"description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+			"enum": null,
+			"name": "key",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Body for PUT /org/secrets/{key}. Key comes from the path.",
+			"properties": { "value": {
+				"type": "string",
+				"minLength": 1,
+				"maxLength": 4096
+			} },
+			"required": ["value"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "Returned by POST and PUT org secret routes.",
+			"properties": {
+				"key": { "type": "string" },
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"updated_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"created": {
+					"type": "boolean",
+					"description": "True if this call inserted a new row, false if it updated an existing one."
+				}
+			},
+			"required": [
+				"key",
+				"created_at",
+				"updated_at",
+				"created"
+			]
+		},
+		"sdkName": "setOrgSecret",
+		"summary": "Set an org secret by key",
+		"tag": "Functions",
+		"tagCommand": "functions"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -13073,78 +14360,878 @@ const operationManifest = [
 						]
 					}
 				},
-				"endpoints": {
-					"type": "object",
-					"additionalProperties": false,
-					"properties": {
-						"total": { "type": "integer" },
-						"enabled": { "type": "integer" },
-						"disabled": { "type": "integer" },
-						"fallback_enabled": { "type": "integer" },
-						"domain_scoped_enabled": { "type": "integer" },
-						"http_enabled": { "type": "integer" },
-						"function_enabled": { "type": "integer" }
-					},
-					"required": [
-						"total",
-						"enabled",
-						"disabled",
-						"fallback_enabled",
-						"domain_scoped_enabled",
-						"http_enabled",
-						"function_enabled"
-					]
+				"endpoints": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": {
+						"total": { "type": "integer" },
+						"enabled": { "type": "integer" },
+						"disabled": { "type": "integer" },
+						"fallback_enabled": { "type": "integer" },
+						"domain_scoped_enabled": { "type": "integer" },
+						"http_enabled": { "type": "integer" },
+						"function_enabled": { "type": "integer" }
+					},
+					"required": [
+						"total",
+						"enabled",
+						"disabled",
+						"fallback_enabled",
+						"domain_scoped_enabled",
+						"http_enabled",
+						"function_enabled"
+					]
+				},
+				"functions": {
+					"type": "object",
+					"additionalProperties": false,
+					"properties": {
+						"total": { "type": "integer" },
+						"deployed": { "type": "integer" },
+						"pending": { "type": "integer" },
+						"failed": { "type": "integer" }
+					},
+					"required": [
+						"total",
+						"deployed",
+						"pending",
+						"failed"
+					]
+				},
+				"recent_emails": {
+					"type": "object",
+					"description": "Inbound email activity from the last 30 days.",
+					"additionalProperties": false,
+					"properties": {
+						"total": {
+							"type": "integer",
+							"description": "Number of inbound emails received in the last 30 days."
+						},
+						"latest_received_at": {
+							"type": ["string", "null"],
+							"format": "date-time",
+							"description": "Most recent inbound email received in the last 30 days."
+						}
+					},
+					"required": ["total", "latest_received_at"]
+				}
+			},
+			"required": [
+				"ready",
+				"receiving_ready",
+				"processing_ready",
+				"summary",
+				"next_actions",
+				"domains",
+				"endpoints",
+				"functions",
+				"recent_emails"
+			]
+		},
+		"sdkName": "getInboxStatus",
+		"summary": "Get inbound inbox readiness",
+		"tag": "Inbox",
+		"tagCommand": "inbox"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "create-challenge",
+		"description": "Create an x402 payment challenge (the payee side of a payment). The\n`pay_to` address is resolved server-side from your registered default\npayout address for the network, never from the request. The response\ncarries the `nonce_binding` and `payment_requirements` the payer needs to\nsign; hand the whole challenge object to the payer (for example in an\nemail reply). Amounts are in token base units (USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC).\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createChallenge",
+		"path": "/x402/challenges",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"amount": {
+					"type": "string",
+					"pattern": "^[1-9][0-9]{0,38}$",
+					"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"]
+				},
+				"payer_org": {
+					"type": "string",
+					"format": "uuid",
+					"description": "The org id allowed to pay this challenge (on-net binding). Optional.\n"
+				},
+				"expires_in": {
+					"type": "integer",
+					"minimum": 60,
+					"maximum": 86400,
+					"description": "Seconds until the challenge expires. Defaults to 3600."
+				},
+				"resource": {
+					"type": "string",
+					"format": "uri",
+					"maxLength": 2048,
+					"description": "Optional URL identifying what is being paid for. Defaults to a\nsynthetic `x402:challenge:<id>` identifier.\n"
+				},
+				"description": {
+					"type": "string",
+					"maxLength": 512,
+					"description": "Optional human-readable description of the payment."
+				}
+			},
+			"required": ["amount", "network"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"status": {
+					"type": "string",
+					"enum": [
+						"pending",
+						"settling",
+						"settled",
+						"failed",
+						"expired"
+					]
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"]
+				},
+				"asset": {
+					"type": "string",
+					"description": "Token contract address (checksummed)."
+				},
+				"amount": {
+					"type": "string",
+					"description": "Amount in token base units."
+				},
+				"pay_to": {
+					"type": "string",
+					"description": "The payee's resolved payout address (checksummed)."
+				},
+				"payer_org": {
+					"type": ["string", "null"],
+					"description": "The org id bound as payer, if one was set at creation."
+				},
+				"resource": { "type": ["string", "null"] },
+				"description": { "type": ["string", "null"] },
+				"nonce_binding": {
+					"type": "object",
+					"description": "The interaction binding the payer hashes into the EIP-3009 nonce\n(`deriveEip3009Nonce`). Pinning the nonce to this binding is what lets an\nx402 payment ride asynchronous transports safely: a replayed challenge\ncan't redirect funds and a signed payment can't settle twice.\n",
+					"properties": {
+						"interaction_id": {
+							"type": "string",
+							"description": "Interaction id, including its `@domain` part."
+						},
+						"challenge_step_id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"challenge_nonce": {
+							"type": "string",
+							"pattern": "^[0-9a-f]{64}$",
+							"description": "32 random bytes as 64 lowercase hex chars."
+						}
+					},
+					"required": [
+						"interaction_id",
+						"challenge_step_id",
+						"challenge_nonce"
+					]
+				},
+				"settle_tx": {
+					"type": ["string", "null"],
+					"description": "On-chain settlement transaction hash once settled."
+				},
+				"settled_at": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				},
+				"failure_reason": { "type": ["string", "null"] },
+				"expires_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"payment_requirements": {
+					"description": "Present on the create response. Hand the whole challenge (including\nthis) to the payer; `getChallenge` omits it (it is for status polling\nby the challenger).\n",
+					"allOf": [{
+						"type": "object",
+						"description": "The x402 `PaymentRequirements` the payer signs over. Field names are\nx402's native camelCase, preserved byte-for-byte.\n",
+						"properties": {
+							"scheme": {
+								"type": "string",
+								"description": "The x402 settlement scheme. Always `exact` for v1.",
+								"example": "exact"
+							},
+							"network": {
+								"type": "string",
+								"enum": ["base", "base-sepolia"]
+							},
+							"maxAmountRequired": {
+								"type": "string",
+								"description": "Amount in token base units."
+							},
+							"payTo": {
+								"type": "string",
+								"description": "The payee's resolved payout address (checksummed)."
+							},
+							"asset": {
+								"type": "string",
+								"description": "The token contract address (checksummed). USDC."
+							},
+							"resource": { "type": "string" },
+							"description": { "type": "string" },
+							"maxTimeoutSeconds": { "type": "integer" },
+							"extra": {
+								"type": "object",
+								"description": "The token's load-bearing EIP-712 domain params. `name` differs by\nchain (Base mainnet USDC is `USD Coin`, Base Sepolia is `USDC`); a\nwrong value produces a signature the verifier rejects.\n",
+								"properties": {
+									"name": { "type": "string" },
+									"version": { "type": "string" }
+								},
+								"required": ["name", "version"]
+							}
+						},
+						"required": [
+							"scheme",
+							"network",
+							"maxAmountRequired",
+							"payTo",
+							"asset",
+							"extra"
+						]
+					}]
+				}
+			},
+			"required": [
+				"id",
+				"status",
+				"network",
+				"asset",
+				"amount",
+				"pay_to",
+				"nonce_binding",
+				"expires_at"
+			]
+		},
+		"sdkName": "createChallenge",
+		"summary": "Create a payment challenge",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-challenge",
+		"description": "Fetch a challenge you created, to poll its `status` and settlement\nreceipt (`settle_tx`). Scoped to the challenger org that created it.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getChallenge",
+		"path": "/x402/challenges/{id}",
+		"pathParams": [{
+			"description": "Resource UUID",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"status": {
+					"type": "string",
+					"enum": [
+						"pending",
+						"settling",
+						"settled",
+						"failed",
+						"expired"
+					]
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"]
+				},
+				"asset": {
+					"type": "string",
+					"description": "Token contract address (checksummed)."
+				},
+				"amount": {
+					"type": "string",
+					"description": "Amount in token base units."
+				},
+				"pay_to": {
+					"type": "string",
+					"description": "The payee's resolved payout address (checksummed)."
+				},
+				"payer_org": {
+					"type": ["string", "null"],
+					"description": "The org id bound as payer, if one was set at creation."
+				},
+				"resource": { "type": ["string", "null"] },
+				"description": { "type": ["string", "null"] },
+				"nonce_binding": {
+					"type": "object",
+					"description": "The interaction binding the payer hashes into the EIP-3009 nonce\n(`deriveEip3009Nonce`). Pinning the nonce to this binding is what lets an\nx402 payment ride asynchronous transports safely: a replayed challenge\ncan't redirect funds and a signed payment can't settle twice.\n",
+					"properties": {
+						"interaction_id": {
+							"type": "string",
+							"description": "Interaction id, including its `@domain` part."
+						},
+						"challenge_step_id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"challenge_nonce": {
+							"type": "string",
+							"pattern": "^[0-9a-f]{64}$",
+							"description": "32 random bytes as 64 lowercase hex chars."
+						}
+					},
+					"required": [
+						"interaction_id",
+						"challenge_step_id",
+						"challenge_nonce"
+					]
+				},
+				"settle_tx": {
+					"type": ["string", "null"],
+					"description": "On-chain settlement transaction hash once settled."
+				},
+				"settled_at": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				},
+				"failure_reason": { "type": ["string", "null"] },
+				"expires_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"payment_requirements": {
+					"description": "Present on the create response. Hand the whole challenge (including\nthis) to the payer; `getChallenge` omits it (it is for status polling\nby the challenger).\n",
+					"allOf": [{
+						"type": "object",
+						"description": "The x402 `PaymentRequirements` the payer signs over. Field names are\nx402's native camelCase, preserved byte-for-byte.\n",
+						"properties": {
+							"scheme": {
+								"type": "string",
+								"description": "The x402 settlement scheme. Always `exact` for v1.",
+								"example": "exact"
+							},
+							"network": {
+								"type": "string",
+								"enum": ["base", "base-sepolia"]
+							},
+							"maxAmountRequired": {
+								"type": "string",
+								"description": "Amount in token base units."
+							},
+							"payTo": {
+								"type": "string",
+								"description": "The payee's resolved payout address (checksummed)."
+							},
+							"asset": {
+								"type": "string",
+								"description": "The token contract address (checksummed). USDC."
+							},
+							"resource": { "type": "string" },
+							"description": { "type": "string" },
+							"maxTimeoutSeconds": { "type": "integer" },
+							"extra": {
+								"type": "object",
+								"description": "The token's load-bearing EIP-712 domain params. `name` differs by\nchain (Base mainnet USDC is `USD Coin`, Base Sepolia is `USDC`); a\nwrong value produces a signature the verifier rejects.\n",
+								"properties": {
+									"name": { "type": "string" },
+									"version": { "type": "string" }
+								},
+								"required": ["name", "version"]
+							}
+						},
+						"required": [
+							"scheme",
+							"network",
+							"maxAmountRequired",
+							"payTo",
+							"asset",
+							"extra"
+						]
+					}]
+				}
+			},
+			"required": [
+				"id",
+				"status",
+				"network",
+				"asset",
+				"amount",
+				"pay_to",
+				"nonce_binding",
+				"expires_at"
+			]
+		},
+		"sdkName": "getChallenge",
+		"summary": "Get a payment challenge",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-spend-policy",
+		"description": "Read your org's outbound spend policy: the kill-switch, per-payment and\nper-day caps, and the payee allowlist. Returns the defaults (no limits,\nnot paused) when no policy has been set.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getSpendPolicy",
+		"path": "/x402/spend-policy",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"description": "The payer's outbound spend policy. Returned with defaults (not paused,\nno caps, any on-net payee) when none is set.\n",
+			"properties": {
+				"paused": {
+					"type": "boolean",
+					"description": "Kill-switch. When true, all outbound payments are refused."
+				},
+				"max_per_payment": {
+					"type": ["string", "null"],
+					"description": "Per-payment cap in token base units, or null for no cap."
+				},
+				"max_per_day": {
+					"type": ["string", "null"],
+					"description": "Rolling-day cap in token base units, or null for no cap."
+				},
+				"allowlist": {
+					"type": ["array", "null"],
+					"items": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"description": "Allowed payee org ids. `null` allows any on-net payee; `[]` denies\nall.\n"
+				}
+			},
+			"required": [
+				"paused",
+				"max_per_payment",
+				"max_per_day",
+				"allowlist"
+			]
+		},
+		"sdkName": "getSpendPolicy",
+		"summary": "Get your spend policy",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-declined-payments",
+		"description": "The 50 most recent payments your org's spend policy declined, newest\nfirst. Use this to see why an outbound payment was refused (a cap, the\npayee allowlist, or the kill-switch) instead of only reading the\ndashboard.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listDeclinedPayments",
+		"path": "/x402/declined-payments",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"description": "A payment the org's spend policy refused.",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"challenge_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The challenge that was declined, if still present."
+					},
+					"counterparty_org": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The payee (challenger) org, when known."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"amount": {
+						"type": "string",
+						"description": "Amount in token base units."
+					},
+					"reason": {
+						"type": "string",
+						"description": "Why the payment was declined (cap, allowlist, paused)."
+					},
+					"declined_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"network",
+					"amount",
+					"reason",
+					"declined_at"
+				]
+			}
+		},
+		"sdkName": "listDeclinedPayments",
+		"summary": "List declined payments",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-payout-addresses",
+		"description": "List your org's registered payout addresses, newest first.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listPayoutAddresses",
+		"path": "/x402/payout-addresses",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"address": {
+						"type": "string",
+						"description": "The checksummed payout address."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"label": { "type": ["string", "null"] },
+					"is_default": {
+						"type": "boolean",
+						"description": "Exactly one address per (org, network) is the default."
+					},
+					"verified_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "When ownership of the address was last proven."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"address",
+					"network",
+					"label",
+					"is_default",
+					"verified_at"
+				]
+			}
+		},
+		"sdkName": "listPayoutAddresses",
+		"summary": "List payout addresses",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "pay-challenge",
+		"description": "Settle a challenge addressed to your org as payer. The request body\ncarries a signed x402 `PaymentPayload`: an EIP-3009\n`transferWithAuthorization` signed locally with your own key, whose nonce\nis bound to the challenge via the SDK's `deriveEip3009Nonce`. The platform\nverifies every signed field against its own record of the challenge,\napplies your spend policy, and settles on-chain through a facilitator.\nSettlement is non-custodial; Primitive never holds funds. Idempotent:\npaying an already-settled challenge returns the original receipt. Most\ncallers use the SDK `pay()` helper rather than building the payload by\nhand.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "payChallenge",
+		"path": "/x402/challenges/{id}/pay",
+		"pathParams": [{
+			"description": "Resource UUID",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": { "payment": {
+				"type": "object",
+				"description": "A signed x402 v1 `PaymentPayload`. The SDK `pay()` helper builds this;\ncallers rarely construct it by hand. Field names are x402-native.\n",
+				"properties": {
+					"x402Version": {
+						"type": "integer",
+						"const": 1
+					},
+					"scheme": {
+						"type": "string",
+						"const": "exact"
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"payload": {
+						"type": "object",
+						"properties": {
+							"signature": {
+								"type": "string",
+								"pattern": "^0x[0-9a-fA-F]+$",
+								"description": "The EIP-712 signature over the authorization."
+							},
+							"authorization": {
+								"type": "object",
+								"description": "The EIP-3009 `transferWithAuthorization` fields, as strings.",
+								"properties": {
+									"from": { "type": "string" },
+									"to": { "type": "string" },
+									"value": { "type": "string" },
+									"validAfter": { "type": "string" },
+									"validBefore": { "type": "string" },
+									"nonce": { "type": "string" }
+								},
+								"required": [
+									"from",
+									"to",
+									"value",
+									"validAfter",
+									"validBefore",
+									"nonce"
+								]
+							}
+						},
+						"required": ["signature", "authorization"]
+					}
+				},
+				"required": [
+					"x402Version",
+					"scheme",
+					"network",
+					"payload"
+				]
+			} },
+			"required": ["payment"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"status": {
+					"type": "string",
+					"enum": ["settled"]
+				},
+				"settle_tx": {
+					"type": ["string", "null"],
+					"description": "On-chain settlement transaction hash."
+				}
+			},
+			"required": [
+				"id",
+				"status",
+				"settle_tx"
+			]
+		},
+		"sdkName": "payChallenge",
+		"summary": "Pay a payment challenge",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "register-payout-address",
+		"description": "Register (or update) the default payout address your org receives x402\npayments at, for a given network. You prove control of the address with\nan org-bound `personal_sign` signature over the message produced by the\nSDK helper `buildPayoutRegistrationMessage`. The org id is taken from your\nauthenticated key, never the body, so a captured signature can't register\nan address under another org. Exactly one default address exists per\n(org, network); registering again replaces it. A payee MUST register a\npayout address before calling `createChallenge`, because the challenge's\n`pay_to` is resolved from this directory.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "registerPayoutAddress",
+		"path": "/x402/payout-addresses",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"address": {
+					"type": "string",
+					"pattern": "^0x[0-9a-fA-F]{40}$",
+					"description": "The payout address (your signer's own EVM address), 0x-prefixed."
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"],
+					"description": "The chain the address receives on."
+				},
+				"signature": {
+					"type": "string",
+					"pattern": "^0x[0-9a-fA-F]+$",
+					"description": "A `personal_sign` signature over the org-bound message produced by\nthe SDK helper `buildPayoutRegistrationMessage`. Recovered and\nchecked against `address`; the org id is bound into the signed bytes.\n"
+				},
+				"issued_at": {
+					"type": "string",
+					"format": "date-time",
+					"description": "ISO-8601 timestamp embedded in the signed message. Must be within a\nshort freshness window (about 10 minutes) of server time.\n"
+				},
+				"label": {
+					"type": "string",
+					"maxLength": 80,
+					"description": "Optional human-readable label."
+				}
+			},
+			"required": [
+				"address",
+				"network",
+				"signature",
+				"issued_at"
+			]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"address": {
+					"type": "string",
+					"description": "The checksummed payout address."
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"]
+				},
+				"label": { "type": ["string", "null"] },
+				"is_default": {
+					"type": "boolean",
+					"description": "Exactly one address per (org, network) is the default."
+				},
+				"verified_at": {
+					"type": "string",
+					"format": "date-time",
+					"description": "When ownership of the address was last proven."
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
+			"required": [
+				"id",
+				"address",
+				"network",
+				"label",
+				"is_default",
+				"verified_at"
+			]
+		},
+		"sdkName": "registerPayoutAddress",
+		"summary": "Register a payout address",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-spend-policy",
+		"description": "Update your org's spend policy. Applied as a merge: only the fields you\ninclude change, and omitted fields keep their current value, so a partial\nupdate can't silently reset the kill-switch. Send an explicit `null` to\nclear a cap. Caps are in token base units.\n",
+		"hasJsonBody": true,
+		"method": "PUT",
+		"operationId": "updateSpendPolicy",
+		"path": "/x402/spend-policy",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Merge update: only the fields you include change; omit a field to keep\nits current value; send `null` to clear a cap.\n",
+			"properties": {
+				"paused": { "type": "boolean" },
+				"max_per_payment": {
+					"type": ["string", "null"],
+					"pattern": "^[1-9][0-9]{0,38}$"
+				},
+				"max_per_day": {
+					"type": ["string", "null"],
+					"pattern": "^[1-9][0-9]{0,38}$"
+				},
+				"allowlist": {
+					"type": ["array", "null"],
+					"maxItems": 1e3,
+					"items": {
+						"type": "string",
+						"format": "uuid"
+					}
+				}
+			}
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "The payer's outbound spend policy. Returned with defaults (not paused,\nno caps, any on-net payee) when none is set.\n",
+			"properties": {
+				"paused": {
+					"type": "boolean",
+					"description": "Kill-switch. When true, all outbound payments are refused."
+				},
+				"max_per_payment": {
+					"type": ["string", "null"],
+					"description": "Per-payment cap in token base units, or null for no cap."
 				},
-				"functions": {
-					"type": "object",
-					"additionalProperties": false,
-					"properties": {
-						"total": { "type": "integer" },
-						"deployed": { "type": "integer" },
-						"pending": { "type": "integer" },
-						"failed": { "type": "integer" }
-					},
-					"required": [
-						"total",
-						"deployed",
-						"pending",
-						"failed"
-					]
+				"max_per_day": {
+					"type": ["string", "null"],
+					"description": "Rolling-day cap in token base units, or null for no cap."
 				},
-				"recent_emails": {
-					"type": "object",
-					"description": "Inbound email activity from the last 30 days.",
-					"additionalProperties": false,
-					"properties": {
-						"total": {
-							"type": "integer",
-							"description": "Number of inbound emails received in the last 30 days."
-						},
-						"latest_received_at": {
-							"type": ["string", "null"],
-							"format": "date-time",
-							"description": "Most recent inbound email received in the last 30 days."
-						}
+				"allowlist": {
+					"type": ["array", "null"],
+					"items": {
+						"type": "string",
+						"format": "uuid"
 					},
-					"required": ["total", "latest_received_at"]
+					"description": "Allowed payee org ids. `null` allows any on-net payee; `[]` denies\nall.\n"
 				}
 			},
 			"required": [
-				"ready",
-				"receiving_ready",
-				"processing_ready",
-				"summary",
-				"next_actions",
-				"domains",
-				"endpoints",
-				"functions",
-				"recent_emails"
+				"paused",
+				"max_per_payment",
+				"max_per_day",
+				"allowlist"
 			]
 		},
-		"sdkName": "getInboxStatus",
-		"summary": "Get inbound inbox readiness",
-		"tag": "Inbox",
-		"tagCommand": "inbox"
+		"sdkName": "updateSpendPolicy",
+		"summary": "Update your spend policy",
+		"tag": "Payments",
+		"tagCommand": "payments"
 	},
 	{
 		"binaryResponse": false,
@@ -18933,8 +21020,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.4.0";
-const CLI_VERSION_RANGE = "^1.4.0";
+const SDK_VERSION_RANGE = "^1.6.0";
+const CLI_VERSION_RANGE = "^1.6.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -22324,6 +24411,392 @@ var OrgSecretsSetCommand = class OrgSecretsSetCommand extends Command {
 	}
 };
 //#endregion
+//#region src/oclif/commands/payments-shared.ts
+const PRIVATE_KEY_ENV = "PRIMITIVE_X402_PRIVATE_KEY";
+const PRIVATE_KEY_FLAG_DESCRIPTION = `Hex private key (0x-prefixed) of the wallet that signs. Prefer the ${PRIVATE_KEY_ENV} environment variable so the key is not exposed in shell history or the process list. The key is used locally to sign and never sent to Primitive.`;
+function x402BaseUrl(resolvedApiBaseUrl) {
+	return resolvedApiBaseUrl.replace(/\/v1\/?$/, "");
+}
+/**
+* Build the x402 signing client. Returns null (after writing a hint) when no
+* API key resolved, so a not-signed-in caller gets the same guidance as any
+* other command rather than an opaque "no API key" throw from the SDK.
+*/
+function buildX402Client(params) {
+	if (!params.apiKey) {
+		process.stderr.write("Not signed in. Set PRIMITIVE_API_KEY or run `primitive signin`, then retry.\n");
+		return null;
+	}
+	return createX402Client({
+		apiKey: params.apiKey,
+		baseUrl: x402BaseUrl(params.resolvedApiBaseUrl)
+	});
+}
+const USDC_DECIMALS = 6;
+/**
+* Convert a human USDC amount ("0.01") to token base units ("10000"). Returns
+* null for a non-positive, malformed, or over-precise value (more than 6
+* fractional digits), so the caller can show a clear error instead of sending
+* a wrong amount.
+*/
+function usdcToBaseUnits(human) {
+	const trimmed = human.trim();
+	if (!/^\d+(\.\d+)?$/.test(trimmed)) return null;
+	const [whole, frac = ""] = trimmed.split(".");
+	if (frac.length > USDC_DECIMALS) return null;
+	const padded = frac.padEnd(USDC_DECIMALS, "0");
+	const base = BigInt(whole) * 10n ** BigInt(USDC_DECIMALS) + BigInt(padded);
+	if (base <= 0n) return null;
+	return base.toString();
+}
+/** Format token base units ("10000") back to a human USDC string ("0.01"). */
+function formatUsdc(baseUnits) {
+	if (!/^\d+$/.test(baseUnits)) return baseUnits;
+	const padded = baseUnits.padStart(USDC_DECIMALS + 1, "0");
+	const whole = padded.slice(0, -USDC_DECIMALS);
+	const frac = padded.slice(-USDC_DECIMALS).replace(/0+$/, "");
+	return frac ? `${whole}.${frac}` : whole;
+}
+/** Block-explorer URL for a settlement tx, or null for an unknown network/tx. */
+function explorerTxUrl(network, tx) {
+	if (!/^0x[0-9a-fA-F]{64}$/.test(tx)) return null;
+	if (network === "base") return `https://basescan.org/tx/${tx}`;
+	if (network === "base-sepolia") return `https://sepolia.basescan.org/tx/${tx}`;
+	return null;
+}
+const X402_ERROR_HINTS = {
+	no_payout_address: "Register a payout address first: `primitive payments register-payout-address --network <network>`.",
+	feature_disabled: "x402 payments are not enabled for this organization yet.",
+	payment_declined: "Your spend policy declined this payment. Check it with `primitive payments get-spend-policy`; if it is paused, re-enable with `primitive payments update-spend-policy --paused false`.",
+	challenge_expired: "This challenge has expired. Ask the payee to create a new one (raise `--expires-in` when creating long-lived challenges).",
+	settlement_failed: "On-chain settlement failed. The most common cause is insufficient USDC in the paying wallet on this network. Fund the wallet and retry.",
+	payment_verification_failed: "The signed payment did not match the challenge. Make sure you are paying with the wallet and network the challenge was issued for.",
+	ownership_proof_failed: "The signature did not prove control of the address. Make sure the wallet key matches the address you are registering."
+};
+/** Turn a hex private key into a viem account (a valid X402Signer). */
+function signerFromPrivateKey(rawKey) {
+	const trimmed = rawKey.trim();
+	const hex = trimmed.startsWith("0x") ? trimmed : `0x${trimmed}`;
+	if (!/^0x[0-9a-fA-F]{64}$/.test(hex)) throw new X402Error(`private key must be 32 bytes of hex (64 hex chars, optionally 0x-prefixed); set ${PRIVATE_KEY_ENV} or pass --private-key`, 0);
+	return privateKeyToAccount(hex);
+}
+/**
+* Map an X402Error onto the CLI's standard stderr error + hint surface, so a
+* payments failure reads like every other command's failure. Returns nothing;
+* the caller sets the exit code.
+*/
+function reportX402Error(error, ctx) {
+	if (!(error instanceof X402Error)) {
+		process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+		return;
+	}
+	const body = error.body;
+	const payload = body && typeof body === "object" && "error" in body ? body : {
+		success: false,
+		error: {
+			code: error.status === 0 ? "client_error" : "request_failed",
+			message: error.message
+		}
+	};
+	writeErrorWithHints(payload);
+	const code = payload.error?.code;
+	if (code && code in X402_ERROR_HINTS) process.stderr.write(`${X402_ERROR_HINTS[code]}\n`);
+	surfaceUnauthorizedHint({
+		auth: ctx.auth,
+		baseUrlOverridden: ctx.baseUrlOverridden,
+		configDir: ctx.configDir,
+		payload
+	});
+}
+//#endregion
+//#region src/oclif/commands/payments-charge.ts
+var PaymentsChargeCommand = class PaymentsChargeCommand extends Command {
+	static description = `Request an x402 payment by creating a challenge (payee side).
+
+  Give the amount as human USDC with --amount-usdc (e.g. 0.01) or as token base
+  units with --amount (e.g. 10000). The challenge JSON is printed to stdout;
+  hand it to the payer (for example in an email reply) so they can pay it. The
+  payee must have a registered payout address first.`;
+	static summary = "Request an x402 payment (create a challenge)";
+	static examples = [
+		"<%= config.bin %> payments charge --amount-usdc 0.01",
+		"<%= config.bin %> payments charge --amount 10000 --network base",
+		"<%= config.bin %> payments charge --amount-usdc 1.50 > challenge.json"
+	];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		"amount-usdc": Flags.string({
+			description: "Amount to collect in USDC, e.g. 0.01. Converted to base units.",
+			exclusive: ["amount"]
+		}),
+		amount: Flags.string({
+			description: "Amount to collect in token base units, e.g. 10000 (0.01 USDC).",
+			exclusive: ["amount-usdc"]
+		}),
+		network: Flags.string({
+			description: "Chain to collect on.",
+			options: ["base", "base-sepolia"],
+			default: "base-sepolia"
+		}),
+		"payer-org": Flags.string({ description: "Restrict who can pay to this organization id (on-net binding)." }),
+		description: Flags.string({ description: "Human-readable description of what the payment is for." }),
+		resource: Flags.string({ description: "A URL identifying the thing being paid for." }),
+		"expires-in": Flags.integer({ description: "Seconds until the challenge expires (60-86400; default 3600)." }),
+		"idempotency-key": Flags.string({ description: "Retry-safe key: charging again with the same key returns the original challenge instead of a duplicate." }),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(PaymentsChargeCommand);
+		let amount;
+		if (flags["amount-usdc"] !== void 0) {
+			const base = usdcToBaseUnits(flags["amount-usdc"]);
+			if (!base) {
+				process.stderr.write(`Invalid --amount-usdc "${flags["amount-usdc"]}". Use a positive amount with at most 6 decimals, e.g. 0.01.\n`);
+				process.exitCode = 1;
+				return;
+			}
+			amount = base;
+		} else if (flags.amount !== void 0) amount = flags.amount;
+		else {
+			process.stderr.write("Provide --amount-usdc <usdc> (e.g. 0.01) or --amount <base-units> (e.g. 10000).\n");
+			process.exitCode = 1;
+			return;
+		}
+		const { auth, baseUrlOverridden, requestConfig } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const client = buildX402Client({
+				apiKey: auth.apiKey,
+				resolvedApiBaseUrl: requestConfig.resolvedApiBaseUrl
+			});
+			if (!client) {
+				process.exitCode = 1;
+				return;
+			}
+			try {
+				const challenge = await client.charge({
+					amount,
+					network: flags.network,
+					...flags["payer-org"] ? { payerOrg: flags["payer-org"] } : {},
+					...flags.description ? { description: flags.description } : {},
+					...flags.resource ? { resource: flags.resource } : {},
+					...flags["expires-in"] !== void 0 ? { expiresIn: flags["expires-in"] } : {},
+					...flags["idempotency-key"] ? { idempotencyKey: flags["idempotency-key"] } : {}
+				});
+				process.stderr.write(`Challenge ${challenge.id} for ${formatUsdc(challenge.amount)} USDC on ${challenge.network}. Hand the JSON below to the payer; they settle it with \`primitive payments pay\`.\n`);
+				this.log(JSON.stringify(challenge, null, 2));
+			} catch (error) {
+				reportX402Error(error, {
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir
+				});
+				process.exitCode = 1;
+			}
+		});
+	}
+};
+//#endregion
+//#region src/oclif/commands/payments-pay.ts
+function readChallenge(input) {
+	let raw;
+	if (input.inline !== void 0) raw = input.inline;
+	else if (input.file !== void 0) raw = readFileSync(input.file, "utf8");
+	else raw = readFileSync(0, "utf8");
+	const trimmed = raw.trim();
+	if (!trimmed) throw new Error("no challenge provided; pass --challenge '<json>', --challenge-file <path>, or pipe the challenge JSON on stdin");
+	let parsed;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		throw new Error("challenge is not valid JSON");
+	}
+	if (parsed && typeof parsed === "object" && "data" in parsed) return parsed.data;
+	return parsed;
+}
+var PaymentsPayCommand = class PaymentsPayCommand extends Command {
+	static description = `Pay an x402 payment challenge.
+
+  Reads the challenge object the payee gave you, derives and signs the
+  interaction-bound EIP-3009 authorization locally with your wallet key (read
+  from ${PRIVATE_KEY_ENV} by default), and submits it for non-custodial
+  on-chain settlement. The key never leaves your machine. Provide the challenge
+  inline with --challenge, from a file with --challenge-file, or piped on stdin.`;
+	static summary = "Sign and settle an x402 payment challenge";
+	static examples = [
+		"<%= config.bin %> payments pay --challenge-file challenge.json",
+		"<%= config.bin %> payments pay --challenge '{\"id\":\"...\",\"network\":\"base-sepolia\",...}'",
+		"cat challenge.json | <%= config.bin %> payments pay"
+	];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		"private-key": Flags.string({
+			description: PRIVATE_KEY_FLAG_DESCRIPTION,
+			env: PRIVATE_KEY_ENV
+		}),
+		challenge: Flags.string({
+			description: "The challenge object as a JSON string.",
+			exclusive: ["challenge-file"]
+		}),
+		"challenge-file": Flags.string({
+			description: "Path to a file containing the challenge JSON.",
+			exclusive: ["challenge"]
+		}),
+		json: Flags.boolean({ description: "Print the raw receipt JSON instead of a human summary." }),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(PaymentsPayCommand);
+		const { auth, baseUrlOverridden, requestConfig } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const client = buildX402Client({
+				apiKey: auth.apiKey,
+				resolvedApiBaseUrl: requestConfig.resolvedApiBaseUrl
+			});
+			if (!client) {
+				process.exitCode = 1;
+				return;
+			}
+			try {
+				const challenge = readChallenge({
+					inline: flags.challenge,
+					file: flags["challenge-file"]
+				});
+				const signer = signerFromPrivateKey(flags["private-key"] ?? "");
+				const receipt = await client.pay(challenge, { signer });
+				if (flags.json) {
+					this.log(JSON.stringify(receipt, null, 2));
+					return;
+				}
+				if (receipt.status === "settled" && receipt.settle_tx) {
+					this.log(`Payment settled. Transaction: ${receipt.settle_tx}`);
+					const url = explorerTxUrl(challenge.network, receipt.settle_tx);
+					if (url) this.log(url);
+				} else this.log(`Payment ${receipt.status}.`);
+			} catch (error) {
+				reportX402Error(error, {
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir
+				});
+				process.exitCode = 1;
+			}
+		});
+	}
+};
+//#endregion
+//#region src/oclif/commands/payments-register-payout-address.ts
+var PaymentsRegisterPayoutAddressCommand = class PaymentsRegisterPayoutAddressCommand extends Command {
+	static description = `Register the default payout address your org receives x402 payments at.
+
+  Proves control of the address by signing an org-bound message locally with
+  your wallet key (read from ${PRIVATE_KEY_ENV} by default), then registers the
+  recovered address as the default for the chosen network. Registering again
+  replaces the existing default. Run this before \`payments create-challenge\`.`;
+	static summary = "Register a payout address for receiving x402 payments";
+	static examples = ["<%= config.bin %> payments register-payout-address", "<%= config.bin %> payments register-payout-address --network base --label treasury"];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		"private-key": Flags.string({
+			description: PRIVATE_KEY_FLAG_DESCRIPTION,
+			env: PRIVATE_KEY_ENV
+		}),
+		network: Flags.string({
+			description: "Chain the address receives on.",
+			options: ["base", "base-sepolia"],
+			default: "base-sepolia"
+		}),
+		label: Flags.string({ description: "Optional human-readable label for the address." }),
+		"issued-at": Flags.string({ description: "ISO-8601 timestamp embedded in the signed message. Defaults to now. Must be within ~10 minutes of server time." }),
+		json: Flags.boolean({ description: "Print the raw payout-address JSON instead of a human summary." }),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(PaymentsRegisterPayoutAddressCommand);
+		const { apiClient, auth, baseUrlOverridden, requestConfig } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		await runWithTiming(flags.time, async () => {
+			const account = await getAccount({
+				client: apiClient.client,
+				responseStyle: "fields"
+			});
+			if (account.error) {
+				const payload = extractErrorPayload(account.error);
+				writeErrorWithHints(payload);
+				surfaceUnauthorizedHint({
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir,
+					payload
+				});
+				process.exitCode = 1;
+				return;
+			}
+			const org = account.data.data.id;
+			const client = buildX402Client({
+				apiKey: auth.apiKey,
+				resolvedApiBaseUrl: requestConfig.resolvedApiBaseUrl
+			});
+			if (!client) {
+				process.exitCode = 1;
+				return;
+			}
+			try {
+				const signer = signerFromPrivateKey(flags["private-key"] ?? "");
+				const result = await client.registerPayoutAddress({
+					org,
+					network: flags.network,
+					...flags["issued-at"] ? { issuedAt: flags["issued-at"] } : {},
+					...flags.label ? { label: flags.label } : {}
+				}, { signer });
+				if (flags.json) this.log(JSON.stringify(result, null, 2));
+				else this.log(`Registered ${result.address} as the default payout address for ${result.network}. You can now run \`primitive payments charge\`.`);
+			} catch (error) {
+				reportX402Error(error, {
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir
+				});
+				process.exitCode = 1;
+			}
+		});
+	}
+};
+//#endregion
 //#region src/oclif/message-body-sources.ts
 function defaultReadFile(path) {
 	return readFileSync(path, "utf8");
@@ -23754,7 +26227,9 @@ const OVERRIDDEN_OPERATION_IDS = new Set([
 	"domains:download-domain-zone-file",
 	"functions:test-function",
 	"inbox:get-inbox-status",
-	"search:semantic-search"
+	"search:semantic-search",
+	"payments:register-payout-address",
+	"payments:pay-challenge"
 ]);
 const generatedCommands = Object.fromEntries(operationManifest.filter((operation) => !OVERRIDDEN_OPERATION_IDS.has(operationId(operation))).map((operation) => [operationId(operation), createOperationCommand(operation)]));
 const COMMANDS = {
@@ -23827,7 +26302,12 @@ const COMMANDS = {
 		return [alias, command];
 	})),
 	...generatedCommands,
-	"functions:logs": FunctionsLogsCommand
+	"functions:logs": FunctionsLogsCommand,
+	"payments:register-payout-address": PaymentsRegisterPayoutAddressCommand,
+	"payments:register-payout": PaymentsRegisterPayoutAddressCommand,
+	"payments:charge": PaymentsChargeCommand,
+	"payments:pay-challenge": PaymentsPayCommand,
+	"payments:pay": PaymentsPayCommand
 };
 //#endregion
 export { CANONICAL_OPERATION_ALIASES, COMMANDS, lookupOperation };