primcli 1.54.0 → 1.55.1

package/dist/oclif/index.js

@@ -1,14 +1,14 @@
-import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadActiveChatState, P as agentProfileName, R as loadConnectedAgentProfile, T as saveSignupCredentials, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-DGrZCUfw.js";
-import { $ as apiResultHttpStatus, $n as resendAgentSignupVerification, $t as createEndpoint, A as readThreadContext, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listSentEmails, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getOrgRoutingTopology, Ct as cliInvocation, D as displayAddress, Dn as getWakeSchedule, Dt as identitySuggestions, E as describeWake, En as getThread, Et as generatedAgentName, F as wakeReadCommand, Fn as listEndpoints, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pullWebhookEvent, Gt as createAuthenticatedCliApiClient, H as recordPendingMail, Hn as listWakeDispatches, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listFunctionLogs, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as resolveCliApiRequestConfig, K as readEmailInteraction, Kt as createCliApiClient, L as wakeRelationship, Ln as listFunctions, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkMembers, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDomains, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as listAgentContacts, Ot as loadSkillLine, Pn as listEmails, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as replyToEmail, Qt as completeWebhookEvent, R as clearConsumedPendingMail, Rn as listRepeatingSends, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getMemory, Sr as verifyAgentSignup, T as bareAddress, Tn as getSentEmail, U as removePendingMail, Un as listWakeSchedules, Ut as queryUsesAutomated, V as readPendingMail, Vn as listWakeAuthorizations, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as pollCliLogin, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as removeDefaultNetworkMember, Xt as checkDefaultNetworkContactAdmission, Yn as redeemCreditCode, Yt as addDefaultNetworkMember, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as reorderRoutes, Zt as cliLogout, _ as awaitingRejectedError, _n as getEmail, _r as updateRepeatingSend, _t as sendWaitClampNotice, a as extractErrorCode, ar as setFunctionRoute, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionTestRunTrace, br as updateWakeSchedule, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteWakeAuthorization, cr as simulateRoute, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dn as getAccount, dr as startCliLogin, dt as formatSendFailureSummary, en as createFunction, er as runWakeSchedule, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAgentContactPolicy, fr as stopRepeatFromEmail, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getDefaultNetworkAgent, gr as updateFunction, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getCreditBalance, hr as updateDefaultNetworkMember, ht as sendIdentityFields, i as createOperationCommand, ir as sendEmail, it as classifySendError, j as sentInThread, jn as listDefaultNetworkAgents, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentNetworks, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeSchedule, lr as startAgentClaim, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mn as getConversation, mr as unsetFunctionRoute, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createWakeAuthorization, nr as searchMemories, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, on as deleteMemory, or as setFunctionSecret, ot as excludeSignalReplies, p as AWAITING_VALUES, pr as testFunction, pt as priorRepliesThatWentOut, q as replyExpectation, qt as refreshStoredCliCredentials, r as TIME_FLAG_DESCRIPTION, rn as createWakeSchedule, rr as semanticSearch, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteRoute, sr as setMemory, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createRoute, tr as searchEmails, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, ur as startAgentSignup, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getFunction, vr as updateRoute, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getRepeatingSend, wt as connectNextSteps, x as hasReplyState, xn as getInboxStatus, xr as verifyAgentClaim, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunctionRouting, yr as updateWakeAuthorization, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRoutes, zt as ensureSearchReportsAutomated } from "../api-command-C_Fn9Zef.js";
-import { S as resolveListenSubscription, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, x as normalizeListenOrigin, y as listenIdentity } from "../shared-mail-files-SPPcis9g.js";
-import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-DhV0DLAA.js";
-import { $ as describeSessionHookItem, A as evaluateContactPolicy, B as agentInvitationHash, C as RECEIVER_MODES, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as ContactsApiError, G as saveConnectionName, H as readAgentInvitation, I as contactAddress, J as recordHookMailCheck, K as savedReceiver, L as contactAgentAddress, M as AddressNotesApiError, N as addressNoteTarget, O as NetworkAdmissionPendingError, P as runAddressNotesRequest, Q as describeSessionHookChange, R as runContactRequest, S as runAgentConnect, T as verificationReplySubmitted, U as receiverStatusCommand, V as connectAgent, W as refusalAfterReplacement, X as claudeConfigDir, Y as boundSessionProfiles, Z as currentCliLocation, _ as disconnectAgent, _t as withOwnerMemberAddress, a as endSession, at as readClaudeSettings, b as invitationProfileName, c as pendingSessionDisconnects, ct as writeClaudeSettings, d as registerSession, dt as jsonIndentation, et as ensureHookLauncher, f as retryPendingDisconnects, ft as readManagedFile, g as AgentDisconnectError, gt as refreshOwnerMemberAddressPeriodically, h as enrollmentResumes, ht as readHookLauncherWarning, i as connectedProfilesForSession, it as inspectClaudeHooks, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as MachineFileError, m as enrollAgent, mt as writeManagedFile, n as OMP_MAIN, nt as findOnPath, o as headlessClaudeRun, ot as repairClaudeHooks, p as runDetached, pt as upsertManagedBlock, q as installClaudeWakeHook, r as agentConnectionState, rt as hasMachineSessionHooks, st as samePath, t as MACHINE_RUNTIMES, tt as ephemeralCliReason, u as readClaudeHookInput, ut as inspectManagedBlock, v as connectWarnings, w as externalReceivingState, x as pollCheckCommand, y as defaultAgentProfileName, z as agentConnectionStatus } from "../machine-session-Do3mw2_w.js";
-import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-BrLq4dXH.js";
-import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background-CMfxkeVP.js";
-import { a as REPEAT_IDLE_MAX_MINUTES, d as parseRepeatTick, f as preparePresenceAliveEmail, g as isEmailReceivedEvent, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as parseWebhookEvent, y as parseFromHeader } from "../repeats-D2xtLium-DmtVD6ol.js";
-import { a as ensureSharedMailSubscription, c as reserveSharedMailSubscription, d as otherParticipants, f as EventConnection, h as pushFile, i as sharedMailScope, l as followEmailConversation, m as pullFile, n as reconcileChatSend, o as createSharedMailWaiter, p as EventReceiverError, r as openSharedMailReceiver, s as openSharedMailStore, t as sendSignal, u as readConversationFollow } from "../signal-command-CqfODMCp.js";
+import { a as REPEAT_IDLE_MAX_MINUTES, d as parseRepeatTick, f as preparePresenceAliveEmail, g as isEmailReceivedEvent, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as parseWebhookEvent, y as parseFromHeader } from "../repeats-x4QM2yoG-De3MV3st.js";
+import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadActiveChatState, P as agentProfileName, R as loadConnectedAgentProfile, T as saveSignupCredentials, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-DMszFbGn.js";
+import { $ as apiResultHttpStatus, $n as resendAgentSignupVerification, $t as createEndpoint, A as readThreadContext, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listSentEmails, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getOrgRoutingTopology, Ct as cliInvocation, D as displayAddress, Dn as getWakeSchedule, Dt as identitySuggestions, E as describeWake, En as getThread, Et as generatedAgentName, F as wakeReadCommand, Fn as listEndpoints, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pullWebhookEvent, Gt as createAuthenticatedCliApiClient, H as recordPendingMail, Hn as listWakeDispatches, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listFunctionLogs, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as resolveCliApiRequestConfig, K as readEmailInteraction, Kt as createCliApiClient, L as wakeRelationship, Ln as listFunctions, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkMembers, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDomains, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as listAgentContacts, Ot as loadSkillLine, Pn as listEmails, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as replyToEmail, Qt as completeWebhookEvent, R as clearConsumedPendingMail, Rn as listRepeatingSends, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getMemory, Sr as verifyAgentSignup, T as bareAddress, Tn as getSentEmail, U as removePendingMail, Un as listWakeSchedules, Ut as queryUsesAutomated, V as readPendingMail, Vn as listWakeAuthorizations, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as pollCliLogin, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as removeDefaultNetworkMember, Xt as checkDefaultNetworkContactAdmission, Yn as redeemCreditCode, Yt as addDefaultNetworkMember, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as reorderRoutes, Zt as cliLogout, _ as awaitingRejectedError, _n as getEmail, _r as updateRepeatingSend, _t as sendWaitClampNotice, a as extractErrorCode, ar as setFunctionRoute, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionTestRunTrace, br as updateWakeSchedule, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteWakeAuthorization, cr as simulateRoute, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dn as getAccount, dr as startCliLogin, dt as formatSendFailureSummary, en as createFunction, er as runWakeSchedule, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAgentContactPolicy, fr as stopRepeatFromEmail, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getDefaultNetworkAgent, gr as updateFunction, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getCreditBalance, hr as updateDefaultNetworkMember, ht as sendIdentityFields, i as createOperationCommand, ir as sendEmail, it as classifySendError, j as sentInThread, jn as listDefaultNetworkAgents, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentNetworks, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeSchedule, lr as startAgentClaim, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mn as getConversation, mr as unsetFunctionRoute, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createWakeAuthorization, nr as searchMemories, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, on as deleteMemory, or as setFunctionSecret, ot as excludeSignalReplies, p as AWAITING_VALUES, pr as testFunction, pt as priorRepliesThatWentOut, q as replyExpectation, qt as refreshStoredCliCredentials, r as TIME_FLAG_DESCRIPTION, rn as createWakeSchedule, rr as semanticSearch, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteRoute, sr as setMemory, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createRoute, tr as searchEmails, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, ur as startAgentSignup, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getFunction, vr as updateRoute, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getRepeatingSend, wt as connectNextSteps, x as hasReplyState, xn as getInboxStatus, xr as verifyAgentClaim, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunctionRouting, yr as updateWakeAuthorization, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRoutes, zt as ensureSearchReportsAutomated } from "../api-command-0FiEAuQi.js";
+import { S as resolveListenSubscription, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, x as normalizeListenOrigin, y as listenIdentity } from "../shared-mail-files-MwlVE90c.js";
+import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-BGzeKcQO.js";
+import { $ as describeSessionHookItem, A as evaluateContactPolicy, B as agentInvitationHash, C as RECEIVER_MODES, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as ContactsApiError, G as saveConnectionName, H as readAgentInvitation, I as contactAddress, J as recordHookMailCheck, K as savedReceiver, L as contactAgentAddress, M as AddressNotesApiError, N as addressNoteTarget, O as NetworkAdmissionPendingError, P as runAddressNotesRequest, Q as describeSessionHookChange, R as runContactRequest, S as runAgentConnect, T as verificationReplySubmitted, U as receiverStatusCommand, V as connectAgent, W as refusalAfterReplacement, X as claudeConfigDir, Y as boundSessionProfiles, Z as currentCliLocation, _ as disconnectAgent, _t as withOwnerMemberAddress, a as endSession, at as readClaudeSettings, b as invitationProfileName, c as pendingSessionDisconnects, ct as writeClaudeSettings, d as registerSession, dt as jsonIndentation, et as ensureHookLauncher, f as retryPendingDisconnects, ft as readManagedFile, g as AgentDisconnectError, gt as refreshOwnerMemberAddressPeriodically, h as enrollmentResumes, ht as readHookLauncherWarning, i as connectedProfilesForSession, it as inspectClaudeHooks, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as MachineFileError, m as enrollAgent, mt as writeManagedFile, n as OMP_MAIN, nt as findOnPath, o as headlessClaudeRun, ot as repairClaudeHooks, p as runDetached, pt as upsertManagedBlock, q as installClaudeWakeHook, r as agentConnectionState, rt as hasMachineSessionHooks, st as samePath, t as MACHINE_RUNTIMES, tt as ephemeralCliReason, u as readClaudeHookInput, ut as inspectManagedBlock, v as connectWarnings, w as externalReceivingState, x as pollCheckCommand, y as defaultAgentProfileName, z as agentConnectionStatus } from "../machine-session-CufQfBvp.js";
+import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-C7cpIxVS.js";
+import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background--0peztKE.js";
+import { a as ensureSharedMailSubscription, c as reserveSharedMailSubscription, d as otherParticipants, f as EventConnection, i as sharedMailScope, l as followEmailConversation, n as reconcileChatSend, o as createSharedMailWaiter, p as EventReceiverError, r as openSharedMailReceiver, s as openSharedMailStore, t as sendSignal, u as readConversationFollow } from "../signal-command-COQff2Vq.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, restoreAutoWorking } from "./auto-signals.js";
-import { t as guardJsonOutputCommands } from "../json-output-Cf-GFeff.js";
+import { t as guardJsonOutputCommands } from "../json-output-CEskSQJi.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
 import { chmodSync, closeSync, constants, cpSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
@@ -35269,6 +35269,7 @@ function isMemoryJsonValue(value, seen = /* @__PURE__ */ new Set()) {
 */
 const CURSOR_FILE = "mail-check.json";
 var MailCheckApiError = class extends Error {
+	payload;
 	constructor(payload) {
 		super("The mail check request failed.");
 		this.payload = payload;
@@ -35421,6 +35422,333 @@ Requires a connected agent profile selected with ${AGENT_PROFILE_ENV}. Output is
 	}
 };
 //#endregion
+//#region ../sdk-node/dist/payloads-BldLJXGd.js
+/**
+* Load a Node builtin at call time. Exported for direct testing of the
+* unavailable-module error path; production code goes through the typed
+* wrappers below.
+*/
+async function loadBuiltin(specifier, operation) {
+	let builtin;
+	if (typeof process !== "undefined" && typeof process.getBuiltinModule === "function") try {
+		builtin = process.getBuiltinModule(specifier);
+	} catch {
+		builtin = void 0;
+	}
+	if (builtin !== void 0 && builtin !== null) return builtin;
+	try {
+		return await import(specifier);
+	} catch (cause) {
+		throw new Error(`${operation} requires file system access, which this runtime does not provide. Pass in-memory bytes instead of a file path when running outside Node.js.`, { cause });
+	}
+}
+/** `node:fs`, loaded lazily so Workers-style bundles never see the import. */
+function loadNodeFs(operation) {
+	return loadBuiltin("node:fs", operation);
+}
+/** `node:fs/promises`, loaded lazily for the same reason as {@link loadNodeFs}. */
+function loadNodeFsPromises(operation) {
+	return loadBuiltin("node:fs/promises", operation);
+}
+const CHUNK_SIZE = 67108864;
+const MANIFEST_VERSION = 1;
+const CHUNK_KDF_INFO = "payloads-chunk";
+const OBJECT_ID_BYTES = 16;
+const CEK_BYTES = 32;
+function subtle() {
+	return globalThis.crypto.subtle;
+}
+const textEncoder = new TextEncoder();
+function randomBytes(length) {
+	const out = new Uint8Array(length);
+	globalThis.crypto.getRandomValues(out);
+	return out;
+}
+function toHex(bytes) {
+	let out = "";
+	for (const b of bytes) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+function fromHex(hex) {
+	if (hex.length % 2 !== 0) throw new Error("invalid hex: odd length");
+	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("invalid hex: non-hex character");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+	return out;
+}
+async function contentHash(bytes) {
+	return new Uint8Array(await subtle().digest("SHA-256", bytes));
+}
+async function contentHashHex(bytes) {
+	return toHex(await contentHash(bytes));
+}
+/** Binary Merkle root over ordered hex leaf hashes (odd node promoted). */
+async function merkleRoot(leafHashesHex) {
+	if (leafHashesHex.length === 0) return contentHashHex(/* @__PURE__ */ new Uint8Array(0));
+	let level = leafHashesHex.map(fromHex);
+	while (level.length > 1) {
+		const next = [];
+		for (let i = 0; i < level.length; i += 2) {
+			const left = level[i];
+			const right = i + 1 < level.length ? level[i + 1] : level[i];
+			const combined = new Uint8Array(left.length + right.length);
+			combined.set(left, 0);
+			combined.set(right, left.length);
+			next.push(await contentHash(combined));
+		}
+		level = next;
+	}
+	return toHex(level[0]);
+}
+async function deriveChunkKey(cek, index) {
+	const baseKey = await subtle().importKey("raw", cek, "HKDF", false, ["deriveKey"]);
+	const info = textEncoder.encode(`${CHUNK_KDF_INFO}:${index}`);
+	return subtle().deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(32),
+		info
+	}, baseKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+function chunkNonce(index) {
+	const nonce = /* @__PURE__ */ new Uint8Array(12);
+	new DataView(nonce.buffer).setUint32(8, index >>> 0, false);
+	return nonce;
+}
+function chunkAad(objectId, index) {
+	const aad = new Uint8Array(objectId.length + 4);
+	aad.set(objectId, 0);
+	new DataView(aad.buffer).setUint32(objectId.length, index >>> 0, false);
+	return aad;
+}
+async function encryptChunk(cek, objectId, index, plaintext) {
+	const key = await deriveChunkKey(cek, index);
+	const ct = await subtle().encrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, plaintext);
+	return new Uint8Array(ct);
+}
+async function decryptChunk(cek, objectId, index, ciphertext) {
+	const key = await deriveChunkKey(cek, index);
+	const pt = await subtle().decrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, ciphertext);
+	return new Uint8Array(pt);
+}
+function authHeaders(apiKey) {
+	return { authorization: `Bearer ${apiKey}` };
+}
+function apiRoot(baseUrl) {
+	let end = baseUrl.length;
+	while (end > 0 && baseUrl.charCodeAt(end - 1) === 47) end--;
+	return `${baseUrl.slice(0, end)}/v1/payloads`;
+}
+const DEFAULT_MAX_RETRIES = 6;
+const RETRYABLE_STATUS = /* @__PURE__ */ new Set([
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+function sleep$3(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* fetch with exponential backoff on transient failures. Request bodies here are
+* in-memory buffers/strings (never streams), so a retry can safely resend them.
+*/
+async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES) {
+	for (let attempt = 0;; attempt++) {
+		let res;
+		let networkError;
+		try {
+			res = await fetch(url, init);
+		} catch (err) {
+			networkError = err;
+		}
+		if (res && !RETRYABLE_STATUS.has(res.status)) return res;
+		if (attempt >= maxRetries) {
+			if (res) return res;
+			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
+		}
+		if (res) await res.text().catch(() => {});
+		await sleep$3(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
+	}
+}
+async function initiate(opts, manifest) {
+	const res = await retryingFetch(apiRoot(opts.baseUrl), {
+		method: "POST",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({ manifest })
+	}, "initiate");
+	if (!res.ok) throw new Error(`initiate failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function putChunk(opts, root, d, bytes) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, {
+		method: "PUT",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/octet-stream"
+		},
+		body: bytes
+	}, `chunk ${d.index} upload`);
+	if (!res.ok) throw new Error(`chunk ${d.index} upload failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function finalize(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/finalize`, {
+		method: "POST",
+		headers: authHeaders(opts.apiKey)
+	}, "finalize");
+	if (!res.ok) throw new Error(`finalize failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function fetchManifest(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/manifest`, { headers: authHeaders(opts.apiKey) }, "get manifest");
+	if (!res.ok) throw new Error(`get manifest failed: HTTP ${res.status} ${await res.text()}`);
+	return (await res.json()).data.manifest;
+}
+async function getChunkBytes(opts, root, d) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, { headers: authHeaders(opts.apiKey) }, `get chunk ${d.index}`);
+	if (!res.ok) throw new Error(`get chunk ${d.index} failed: HTTP ${res.status}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+async function readWindow(fh, position, length) {
+	const buf = Buffer.allocUnsafe(length);
+	let read = 0;
+	while (read < length) {
+		const { bytesRead } = await fh.read(buf, read, length - read, position + read);
+		if (bytesRead === 0) break;
+		read += bytesRead;
+	}
+	return read === length ? buf : buf.subarray(0, read);
+}
+async function mapLimit(items, limit, fn) {
+	let next = 0;
+	let firstError;
+	const worker = async () => {
+		while (next < items.length && firstError === void 0) {
+			const i = next++;
+			try {
+				await fn(items[i], i);
+			} catch (err) {
+				if (firstError === void 0) firstError = err;
+				return;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length || 1) }, () => worker()));
+	if (firstError !== void 0) throw firstError;
+}
+/**
+* Stream a file up as a Primitive Payload. Two passes over the file (encrypt to
+* build the manifest, then encrypt again to upload) keep memory bounded to a few
+* chunks — the whole object is never resident. Returns the content address
+* (merkleRoot) and the hex CEK needed to download it.
+*/
+async function pushFile(filePath, opts) {
+	const { open, stat } = await loadNodeFsPromises("pushFile");
+	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
+	const concurrency = opts.concurrency ?? 3;
+	const { size } = await stat(filePath);
+	const cek = randomBytes(CEK_BYTES);
+	const objectId = randomBytes(OBJECT_ID_BYTES);
+	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
+	const fh = await open(filePath, "r");
+	try {
+		const descriptors = [];
+		for (let index = 0; index < chunkCount; index++) {
+			const position = index * chunkSize;
+			const length = Math.min(chunkSize, size - position);
+			const plaintext = await readWindow(fh, position, length);
+			const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
+			descriptors.push({
+				index,
+				ciphertextHash: await contentHashHex(ciphertext),
+				plaintextSize: length,
+				ciphertextSize: ciphertext.length
+			});
+			opts.onProgress?.("encrypt", index + 1, chunkCount);
+		}
+		const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
+		await initiate(opts, {
+			version: MANIFEST_VERSION,
+			objectId: toHex(objectId),
+			chunkSize,
+			totalPlaintextSize: size,
+			chunkCount,
+			chunks: descriptors,
+			merkleRoot: root
+		});
+		let uploaded = 0;
+		await mapLimit(descriptors, concurrency, async (d) => {
+			const position = d.index * chunkSize;
+			const plaintext = await readWindow(fh, position, d.plaintextSize);
+			const ciphertext = await encryptChunk(cek, objectId, d.index, plaintext);
+			await putChunk(opts, root, d, ciphertext);
+			opts.onProgress?.("upload", ++uploaded, chunkCount);
+		});
+		await finalize(opts, root);
+		return {
+			merkleRoot: root,
+			cek: toHex(cek),
+			chunkCount,
+			totalBytes: size
+		};
+	} finally {
+		await fh.close();
+	}
+}
+/**
+* Stream a Primitive Payload down to a file, verifying and decrypting one chunk
+* at a time (bounded memory). Every chunk is content-address-checked before
+* decryption, so a corrupt or substituted chunk throws.
+*/
+async function pullFile(root, outPath, opts) {
+	const { createWriteStream } = await loadNodeFs("pullFile");
+	const { rm } = await loadNodeFsPromises("pullFile");
+	const manifest = await fetchManifest(opts, root);
+	const computedRoot = await merkleRoot(manifest.chunks.map((c) => c.ciphertextHash));
+	if (computedRoot !== root) throw new Error(`manifest does not match the requested content address (got ${computedRoot})`);
+	const cek = fromHex(opts.cek);
+	const objectId = fromHex(manifest.objectId);
+	const out = createWriteStream(outPath);
+	let onWriteError = () => {};
+	const writeErrored = new Promise((_, reject) => {
+		onWriteError = reject;
+	});
+	writeErrored.catch(() => {});
+	out.on("error", (err) => onWriteError(err));
+	try {
+		let done = 0;
+		for (const d of manifest.chunks) {
+			const ciphertext = await getChunkBytes(opts, root, d);
+			if (await contentHashHex(ciphertext) !== d.ciphertextHash) throw new Error(`chunk ${d.index} failed integrity check`);
+			const plaintext = await decryptChunk(cek, objectId, d.index, ciphertext);
+			if (!out.write(plaintext)) await Promise.race([new Promise((resolve) => out.once("drain", resolve)), writeErrored]);
+			opts.onProgress?.("download", ++done, manifest.chunkCount);
+		}
+		await Promise.race([new Promise((resolve) => out.end(resolve)), writeErrored]);
+	} catch (err) {
+		out.destroy();
+		await rm(outPath, { force: true });
+		throw err;
+	}
+	return manifest;
+}
+//#endregion
 //#region src/oclif/session-address-guard.ts
 /**
 * The session a connect or enroll runs in: the explicit --session, else the
@@ -35731,8 +36059,10 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 				};
 			}
 			if (!claimOnly) {
-				if (!session && !flags.resume) if (flags.profile) pollProfile = flags.profile;
-				else pollProfile = invitationProfileName(await readInvitationOnce());
+				if (!session && !flags.resume) {
+					if (flags.profile) pollProfile = flags.profile;
+					else pollProfile = invitationProfileName(await readInvitationOnce());
+				}
 				const output = await runAgentConnect({
 					configDir: this.config.configDir,
 					packageRoot: this.config.root,
@@ -36345,6 +36675,8 @@ var AgentNotesDeleteCommand = class AgentNotesDeleteCommand extends Command {
 };
 const RENAME_UNSUPPORTED_MESSAGE = "This Primitive API does not support renaming yet. The display name was not changed.";
 var AgentRenameApiError = class extends Error {
+	payload;
+	status;
 	constructor(payload, status) {
 		super("Agent rename request failed.");
 		this.payload = payload;
@@ -36880,8 +37212,9 @@ var AgentUpgradeCommand = class AgentUpgradeCommand extends Command {
 			return;
 		}
 		process$1.stderr.write(`Verification code sent to ${email}.\n`);
+		const code = flags.code ?? await promptRequired$1("Verification code: ");
 		const verified = await verifyAgentClaim({
-			body: { verification_code: flags.code ?? await promptRequired$1("Verification code: ") },
+			body: { verification_code: code },
 			client: apiClient.client,
 			responseStyle: "fields"
 		});
@@ -36914,7 +37247,7 @@ async function promptRequired$1(question) {
 /** The address note that holds an agent's current work claim. */
 const WORKING_NOTE_NAME = "AGENT_WORKING";
 /** Default claim lifetime when --until is omitted. */
-const DEFAULT_CLAIM_MS = 14400 * 1e3;
+const DEFAULT_CLAIM_MS = 144e5;
 /** Validate the claim text and expiry and build the stored note value. */
 function buildWorkingClaim(params) {
 	const claim = params.claim.trim();
@@ -37037,14 +37370,14 @@ const STDIN_WAIT_MS = 3e4;
 const workingClaimStdin = { read: () => {
 	if (process.stdin.isTTY) throw new Error("--stdin needs the claim piped in, not typed at a terminal.");
 	const limit = 2002;
-	const buffer = Buffer.alloc(limit + 1);
+	const buffer = Buffer.alloc(2003);
 	const pause = new Int32Array(new SharedArrayBuffer(4));
 	const deadline = Date.now() + STDIN_WAIT_MS;
 	let length = 0;
 	while (length <= limit) {
 		let read = 0;
 		try {
-			read = readSync(0, buffer, length, limit + 1 - length, null);
+			read = readSync(0, buffer, length, 2003 - length, null);
 		} catch (error) {
 			const code = error.code;
 			if (code === "EOF") break;
@@ -37376,6 +37709,7 @@ function reclaimStaleLock(path, previous, temporary, contender) {
 	}
 }
 var ChatLockContentionError = class extends Error {
+	holderPid;
 	constructor(holderPid) {
 		super(holderPid > 0 ? `Another \`primitive chat\` invocation (pid ${holderPid}) is in progress. Wait for it to finish, or kill it before retrying.` : "The chat lock holder could not be verified. Retry after the current invocation finishes.");
 		this.holderPid = holderPid;
@@ -37520,7 +37854,7 @@ function saveChatReceipt(receipt) {
 }
 function parseReceipt(raw) {
 	const value = JSON.parse(raw);
-	if (!value || value.version !== 1 || typeof value.request_hash !== "string" || typeof value.sent_at !== "string" || !Number.isFinite(Date.parse(value.sent_at)) || typeof value.completed !== "boolean" || value.reply !== void 0 && (!value.reply || typeof value.reply !== "object" || typeof value.reply.emailId !== "string" || !value.reply.emailId || typeof value.reply.requestId !== "string" || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value.reply.requestId)) || value.idempotency_key !== void 0 && (typeof value.idempotency_key !== "string" || !/^[!-~]{1,255}$/.test(value.idempotency_key)) || value.send_attempted !== void 0 && typeof value.send_attempted !== "boolean" || value.sent !== null && (!value.sent || typeof value.sent.id !== "string" || !value.sent.id || typeof value.sent.status !== "string")) throw new Error("Invalid chat receipt");
+	if (value?.version !== 1 || typeof value.request_hash !== "string" || typeof value.sent_at !== "string" || !Number.isFinite(Date.parse(value.sent_at)) || typeof value.completed !== "boolean" || value.reply !== void 0 && (!value.reply || typeof value.reply !== "object" || typeof value.reply.emailId !== "string" || !value.reply.emailId || typeof value.reply.requestId !== "string" || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value.reply.requestId)) || value.idempotency_key !== void 0 && (typeof value.idempotency_key !== "string" || !/^[!-~]{1,255}$/.test(value.idempotency_key)) || value.send_attempted !== void 0 && typeof value.send_attempted !== "boolean" || value.sent !== null && (!value.sent || typeof value.sent.id !== "string" || !value.sent.id || typeof value.sent.status !== "string")) throw new Error("Invalid chat receipt");
 	return value;
 }
 /**
@@ -37637,7 +37971,7 @@ function parseContactInteraction(bytes, now = Date.now()) {
 	const result = parseInteractionEnvelope$1(bytes);
 	if (result.status !== "valid") return null;
 	const e = result.envelope;
-	if (e.protocol !== "primitive.contact" || e.protocol_version !== 1 || !["request", "accept"].includes(e.step) || typeof e.expires_at !== "string" || !Number.isFinite(Date.parse(e.expires_at)) || Date.parse(e.expires_at) <= now || Date.parse(e.expires_at) > now + 604800 * 1e3 || !e.payload || typeof e.payload !== "object" || Array.isArray(e.payload)) return null;
+	if (e.protocol !== "primitive.contact" || e.protocol_version !== 1 || !["request", "accept"].includes(e.step) || typeof e.expires_at !== "string" || !Number.isFinite(Date.parse(e.expires_at)) || Date.parse(e.expires_at) <= now || Date.parse(e.expires_at) > now + 6048e5 || !e.payload || typeof e.payload !== "object" || Array.isArray(e.payload)) return null;
 	const payload = e.payload;
 	if (e.step === "request") {
 		if (e.prev_step_id !== null || Object.keys(payload).length !== 1 || typeof payload.reason !== "string" || !payload.reason.trim() || Array.from(payload.reason).length > 2e3) return null;
@@ -37651,7 +37985,7 @@ async function readContactInteraction(detail, readPart, signal, now = Date.now()
 	const canonical = parts.filter((part) => part.filename?.toLowerCase() === "interaction.json");
 	if (canonical.length !== 1) return null;
 	const part = canonical[0];
-	if (!part || part.content_type?.split(";")[0]?.trim().toLowerCase() !== "application/json" || !Number.isSafeInteger(part.part_index) || part.part_index === void 0 || part.part_index < 0 || !Number.isSafeInteger(part.size_bytes) || part.size_bytes < 1 || part.size_bytes > 8192 || typeof part.sha256 !== "string" || !/^[a-f0-9]{64}$/i.test(part.sha256)) return null;
+	if (part?.content_type?.split(";")[0]?.trim().toLowerCase() !== "application/json" || !Number.isSafeInteger(part.part_index) || part.part_index === void 0 || part.part_index < 0 || !Number.isSafeInteger(part.size_bytes) || part.size_bytes < 1 || part.size_bytes > 8192 || typeof part.sha256 !== "string" || !/^[a-f0-9]{64}$/i.test(part.sha256)) return null;
 	let bytes;
 	try {
 		bytes = await readPart(detail.id, part.part_index, signal);
@@ -38235,8 +38569,7 @@ async function enablePeer(context, peer, reason) {
 		...reason ? { purpose: reason } : {}
 	});
 	await policy.refresh(signal());
-	const allowed = await policy.admit(peer, (/* @__PURE__ */ new Date()).toISOString(), signal());
-	if (!allowed || allowed.kind !== "allowed") throw new Error("Contact notification permission changed. No contact email was sent; inspect the saved preference before retrying.");
+	if ((await policy.admit(peer, (/* @__PURE__ */ new Date()).toISOString(), signal()))?.kind !== "allowed") throw new Error("Contact notification permission changed. No contact email was sent; inspect the saved preference before retrying.");
 }
 async function requestContact(context, options) {
 	const peer = canonicalContactSelector({
@@ -38610,12 +38943,12 @@ function deriveSubject(body) {
 	for (const line of body.split("\n")) {
 		const trimmed = line.trim();
 		if (!trimmed) continue;
-		return trimmed.length > SUBJECT_MAX_LENGTH ? `${trimmed.slice(0, SUBJECT_MAX_LENGTH - 3)}...` : trimmed;
+		return trimmed.length > SUBJECT_MAX_LENGTH ? `${trimmed.slice(0, 197)}...` : trimmed;
 	}
 	return "Message";
 }
 const CHAT_SUBJECT_MAX_LENGTH = 60;
-const TITLES$1 = new Set([
+const TITLES$1 = /* @__PURE__ */ new Set([
 	"dr",
 	"mr",
 	"mrs",
@@ -38630,7 +38963,7 @@ const TITLES$1 = new Set([
 	"approx",
 	"fig"
 ]);
-const ABBREVIATIONS = new Set([
+const ABBREVIATIONS = /* @__PURE__ */ new Set([
 	"etc",
 	"inc",
 	"ltd",
@@ -38666,7 +38999,7 @@ function firstSentence(line) {
 function deriveChatSubject(body) {
 	const sentence = firstSentence(deriveSubject(body));
 	if (sentence.length <= CHAT_SUBJECT_MAX_LENGTH) return sentence;
-	const room = sentence.slice(0, CHAT_SUBJECT_MAX_LENGTH - 3);
+	const room = sentence.slice(0, 57);
 	const space = room.lastIndexOf(" ");
 	return `${(space >= CHAT_SUBJECT_MAX_LENGTH / 2 ? room.slice(0, space) : room).replace(/[\s,;:.!?-]+$/, "")}...`;
 }
@@ -38888,6 +39221,8 @@ function chatSuccessText(message) {
 	return chatColor("greenBright", message);
 }
 var ChatProgressIndicator = class {
+	stream;
+	now;
 	currentMessage = null;
 	frameIndex = 0;
 	lastLineLength = 0;
@@ -39934,8 +40269,10 @@ var ChatCommand = class ChatCommand extends Command {
 					this.chatProgress.priorReplies = priorReplies;
 					if (!resumed) {
 						const warning = priorReplies === null ? `Could not check whether you already replied to email ${parentReply.id} (the API returned no reply history). Prior-reply check skipped; sending the reply anyway.` : formatPriorRepliesWarning(priorReplies);
-						if (warning !== null) if (progress) progress.notice(warning);
-						else process.stderr.write(`${chatNoticeText(warning)}\n`);
+						if (warning !== null) {
+							if (progress) progress.notice(warning);
+							else process.stderr.write(`${chatNoticeText(warning)}\n`);
+						}
 					}
 				}
 				if (resumed) progress?.start("Resuming the recorded send without sending again");
@@ -41561,7 +41898,7 @@ async function readTickPart(input) {
 	if (detail.parsed?.status !== "complete") return null;
 	const parts = (detail.parsed.attachments ?? []).filter((part) => part.filename?.toLowerCase() === "interaction.json");
 	const part = parts.length === 1 ? parts[0] : void 0;
-	if (!part || part.content_type?.split(";")[0]?.trim().toLowerCase() !== "application/json" || part.part_index === void 0 || !Number.isSafeInteger(part.part_index) || part.part_index < 0 || !Number.isSafeInteger(part.size_bytes) || part.size_bytes <= 0 || part.size_bytes > 65536 || typeof part.sha256 !== "string" || !/^[a-f0-9]{64}$/i.test(part.sha256)) return null;
+	if (part?.content_type?.split(";")[0]?.trim().toLowerCase() !== "application/json" || part.part_index === void 0 || !Number.isSafeInteger(part.part_index) || part.part_index < 0 || !Number.isSafeInteger(part.size_bytes) || part.size_bytes <= 0 || part.size_bytes > 65536 || typeof part.sha256 !== "string" || !/^[a-f0-9]{64}$/i.test(part.sha256)) return null;
 	const readPart = input.readPart ?? notificationPartReader(async () => input.client);
 	let bytes;
 	try {
@@ -43617,7 +43954,7 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	url: "https://primitive.dev"
 };
 const SDK_VERSION_RANGE = "^1.35.0";
-const CLI_VERSION_RANGE = "^1.54.0";
+const CLI_VERSION_RANGE = "^1.55.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -45052,7 +45389,7 @@ var FunctionsTemplatesCommand = class FunctionsTemplatesCommand extends Command
 //#endregion
 //#region src/oclif/commands/functions-test-function.ts
 const DEFAULT_WAIT_TIMEOUT_SECONDS$1 = 60;
-const TERMINAL_TEST_TRACE_STATES = new Set([
+const TERMINAL_TEST_TRACE_STATES = /* @__PURE__ */ new Set([
 	"completed",
 	"failed",
 	"send_failed"
@@ -45329,6 +45666,8 @@ const MAX_LONG_POLL_SECONDS = 30;
 const EPOCH_CURSOR = "1970-01-01T00:00:00.000000Z|00000000-0000-4000-8000-000000000000";
 /** An API call failed; carries the error payload for printing. */
 var InboxNextApiError = class extends Error {
+	surface;
+	payload;
 	constructor(surface, payload) {
 		super(`${surface} failed`);
 		this.surface = surface;
@@ -45690,7 +46029,7 @@ function formatTranscript(result, bin) {
 		...conversation.messages.map((message, index) => formatMessage(message, index)),
 		"",
 		...transcriptFooter(interaction, actions, email.id, bin),
-		`Then run \`${bin} inbox next\` again.`
+		`Then run \`${followUpCommandPrefix(bin)} inbox next\` again.`
 	].join("\n");
 }
 /**
@@ -46224,8 +46563,8 @@ var InboxSetupCommand = class InboxSetupCommand extends Command {
 //#endregion
 //#region src/oclif/listen-handlers.ts
 const HANDLER_TIMEOUT_MS = 3e4;
-const MAX_RESPONSE_BYTES = 1024 * 1024;
-const FORWARDED_HEADERS = new Set([
+const MAX_RESPONSE_BYTES = 1048576;
+const FORWARDED_HEADERS = /* @__PURE__ */ new Set([
 	"content-type",
 	"user-agent",
 	"primitive-signature",
@@ -46385,6 +46724,8 @@ function structuredErrorCode(body) {
 	}
 }
 var ForwardFailure = class extends Error {
+	statusCode;
+	transportError;
 	constructor(statusCode, transportError) {
 		super("Webhook transport did not complete.");
 		this.statusCode = statusCode;
@@ -46536,15 +46877,16 @@ const hash = (value) => createHash("sha256").update(value).digest("hex");
 const invalid = () => new ListenStateError("Contact request notice state is unavailable. Preserve it to avoid duplicate notices.");
 /** Stable across profile, credential and native-session changes in one config. */
 function openContactRequestNotices(configDir, identity) {
-	const directory = join(configDir, "contact-request-notices", hash(JSON.stringify([
+	const key = hash(JSON.stringify([
 		identity.apiBaseUrl,
 		identity.orgId,
 		identity.agentAddress
-	])));
+	]));
+	const directory = join(configDir, "contact-request-notices", key);
 	privateMailDirectory(directory, true);
 	const path = join(directory, "notices.json");
 	function read() {
-		const raw = readMailJson(path, 512 * 1024);
+		const raw = readMailJson(path, 524288);
 		if (raw === null) return {
 			activatedAt: null,
 			notices: []
@@ -46712,13 +47054,14 @@ async function reserveConversationStatus(context, status, now = Date.now()) {
 		const previous = retained.find((entry) => entry.key === key);
 		const emailId = mailId(status.emailId);
 		if (previous?.emailIds.includes(emailId)) return false;
+		const next = [...retained.filter((entry) => entry.key !== key), {
+			key,
+			emailIds: [...previous?.emailIds ?? [], emailId].slice(-16),
+			at: due ? now : previous?.at ?? now
+		}].slice(-256);
 		writeMailJson(path, {
 			version: 1,
-			entries: [...retained.filter((entry) => entry.key !== key), {
-				key,
-				emailIds: [...previous?.emailIds ?? [], emailId].slice(-16),
-				at: due ? now : previous?.at ?? now
-			}].slice(-256)
+			entries: next
 		});
 		return due;
 	});
@@ -46843,7 +47186,8 @@ function openPresenceControls(options) {
 		}
 		const parsed = parsePresenceEnvelope(bytes);
 		if (parsed.status !== "valid" || parsed.envelope.step !== "probe" || parsed.envelope.payload.address !== profile.agent_address) return "quiet";
-		const intentDirectory = join(directory, createHash("sha256").update(parsed.envelope.interaction_id).digest("hex"));
+		const key = createHash("sha256").update(parsed.envelope.interaction_id).digest("hex");
+		const intentDirectory = join(directory, key);
 		privateMailDirectory(intentDirectory, true);
 		let release;
 		try {
@@ -47012,7 +47356,6 @@ function normalizePresenceText(text) {
 }
 //#endregion
 //#region src/oclif/thread-mutes.ts
-const MAX_MUTES = 500;
 const SESSION = /^(?:claude|codex):[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/;
 var ThreadMuteStateError = class extends Error {};
 function mutePath(configDir, profileName) {
@@ -47063,7 +47406,7 @@ function isThreadMuted(configDir, profileName, threadId, sessionKey) {
 }
 async function update(configDir, profileName, change) {
 	return withMailLock(lockDirectory(configDir, profileName), () => {
-		const next = change(readThreadMutes(configDir, profileName)).slice(-MAX_MUTES);
+		const next = change(readThreadMutes(configDir, profileName)).slice(-500);
 		writeMailJson(mutePath(configDir, profileName), {
 			version: 1,
 			threads: next
@@ -47421,8 +47764,10 @@ async function runSharedNotificationListen(options) {
 			try {
 				await reconcile(row);
 			} catch (error) {
-				if (!(dispatchFailure instanceof NotificationOutcomeUnknownError)) if (error instanceof NotificationOutcomeUnknownError) dispatchFailure = error;
-				else dispatchFailure ??= error;
+				if (!(dispatchFailure instanceof NotificationOutcomeUnknownError)) {
+					if (error instanceof NotificationOutcomeUnknownError) dispatchFailure = error;
+					else dispatchFailure ??= error;
+				}
 			}
 			if (dispatchFailure !== void 0) throw dispatchFailure;
 			return completed;
@@ -47498,6 +47843,9 @@ async function hydrateNotification(store, detail, peer) {
 //#region src/oclif/listen-runner.ts
 var ListenError = class extends Error {};
 var RequestFailure = class extends ListenError {
+	status;
+	code;
+	retryAfter;
 	constructor(status, code, retryAfter) {
 		super(code === "agent_connection_scope_forbidden" ? "This operation is outside the connected address grant. Use inbound email events and this credential’s own subscription." : status === 401 || status === 403 ? "Listener authorization failed. Run primitive signin or check your API key and account permissions." : status === 409 && code === "subscription_conflict" ? "This subscription has different event filters. Omit --events to resume it, or use primitive listen --subscription new-subscription (add your --events selection)." : `Listener API request failed (HTTP ${status || "transport"}, ${code}).`);
 		this.status = status;
@@ -49012,12 +49360,14 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function openBrowser(url) {
-	const child = spawn(process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open", process.platform === "win32" ? [
+	const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+	const args = process.platform === "win32" ? [
 		"/c",
 		"start",
 		"",
 		url
-	] : [url], {
+	] : [url];
+	const child = spawn(command, args, {
 		detached: true,
 		stdio: "ignore"
 	});
@@ -49197,8 +49547,9 @@ var LoginCommand$1 = class extends Command {
 				throw cliError$3(existingStatus.message);
 			} else throw cliError$3(`Already logged in${existing.org_name ? ` for ${existing.org_name}` : ""}. Run \`primitive logout\` before logging in again.`);
 		}
+		const deviceName = flags["device-name"] ?? hostname();
 		const started = await startCliLogin({
-			body: { device_name: flags["device-name"] ?? hostname() },
+			body: { device_name: deviceName },
 			client: apiClient.client,
 			responseStyle: "fields"
 		});
@@ -49410,10 +49761,12 @@ function writeSignupStatus(status) {
 	}
 	process$1.stdout.write(`Pending Primitive signup for ${status.email}.\n`);
 	if (status.code_length !== null) process$1.stdout.write(`Verification code length: ${status.code_length}\n`);
-	if (status.expires_at) if (status.expired) process$1.stdout.write(`Expired at: ${status.expires_at}\n`);
-	else {
-		process$1.stdout.write(`Expires at: ${status.expires_at}\n`);
-		process$1.stdout.write(`Expires in: ${formatSignupSeconds(status.expires_in)}\n`);
+	if (status.expires_at) {
+		if (status.expired) process$1.stdout.write(`Expired at: ${status.expires_at}\n`);
+		else {
+			process$1.stdout.write(`Expires at: ${status.expires_at}\n`);
+			process$1.stdout.write(`Expires in: ${formatSignupSeconds(status.expires_in)}\n`);
+		}
 	}
 	if (status.resend_after !== null) process$1.stdout.write(`Resend after: ${formatSignupSeconds(status.resend_after)}\n`);
 	if (status.confirm_command) process$1.stdout.write(`Confirm: ${status.confirm_command}\n`);
@@ -50543,7 +50896,8 @@ function backupStamp(now) {
 	return now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
 }
 function runtimePresent(runtime, paths, env) {
-	return existsSync(runtime === "claude" ? paths.claudeDir : runtime === "codex" ? paths.codexHome : paths.ompRoot) || findOnPath(runtime, env) !== null;
+	const directory = runtime === "claude" ? paths.claudeDir : runtime === "codex" ? paths.codexHome : paths.ompRoot;
+	return existsSync(directory) || findOnPath(runtime, env) !== null;
 }
 function runtimePaths(env, home) {
 	const ompRoot = resolve(home, env.PI_CONFIG_DIR || ".omp");
@@ -50732,9 +51086,11 @@ async function runMachineDoctor(options) {
 			});
 		},
 		repair: () => {
-			const read = readManagedFile(path());
+			const target = path();
+			const read = readManagedFile(target);
 			if (read.state === "invalid") return false;
-			const next = upsertManagedBlock(read.state === "present" ? read.text : "", managedInstructions(runtime, { skillBundled: loadBundle() !== null }));
+			const text = read.state === "present" ? read.text : "";
+			const next = upsertManagedBlock(text, managedInstructions(runtime, { skillBundled: loadBundle() !== null }));
 			if (read.state === "present" && next === read.text) return false;
 			writeManagedFile({
 				read,
@@ -51667,6 +52023,7 @@ var MemoriesSearchCommand = class MemoriesSearchCommand extends Command {
 //#endregion
 //#region src/oclif/network.ts
 var NetworkApiError = class extends Error {
+	payload;
 	constructor(payload) {
 		super("Network request failed.");
 		this.payload = payload;
@@ -51739,13 +52096,14 @@ async function runNetworkRequest(client, request) {
 	}))).data;
 	if (request.action !== "set") throw new Error("Unknown network operation.");
 	if (request.see === void 0 && request.beSeen === void 0) throw new Error("Pass --see on|off, --be-seen on|off, or both.");
+	const body = {
+		...request.see === void 0 ? {} : { can_view: request.see === "on" },
+		...request.beSeen === void 0 ? {} : { is_listed: request.beSeen === "on" }
+	};
 	return (await response(updateDefaultNetworkMember({
 		client,
 		path,
-		body: {
-			...request.see === void 0 ? {} : { can_view: request.see === "on" },
-			...request.beSeen === void 0 ? {} : { is_listed: request.beSeen === "on" }
-		},
+		body,
 		responseStyle: "fields"
 	}))).data;
 }
@@ -52746,7 +53104,7 @@ var X402Client = class {
 			throw new X402Error(`non-JSON response (${res.status}) from ${path}: ${text.slice(0, 200)}`, res.status, text.slice(0, 500), { retryAfter });
 		}
 		if (!res.ok || json?.success === false) throw new X402Error(json?.error?.message ?? `request failed with ${res.status}`, res.status, json ?? text.slice(0, 500), { retryAfter });
-		if (!json || json.success !== true || json.data === void 0) throw new X402Error(`unexpected response shape (${res.status}) from ${path}: missing success/data envelope`, res.status, json ?? text.slice(0, 500), { retryAfter });
+		if (json?.success !== true || json.data === void 0) throw new X402Error(`unexpected response shape (${res.status}) from ${path}: missing success/data envelope`, res.status, json ?? text.slice(0, 500), { retryAfter });
 		return json.data;
 	}
 	/** Request a payment (payee side). Returns the challenge to hand to the payer. */
@@ -53165,9 +53523,9 @@ function usdcToBaseUnits(human) {
 /** Format token base units ("10000") back to a human USDC string ("0.01"). */
 function formatUsdc(baseUnits) {
 	if (!/^\d+$/.test(baseUnits)) return baseUnits;
-	const padded = baseUnits.padStart(USDC_DECIMALS + 1, "0");
-	const whole = padded.slice(0, -USDC_DECIMALS);
-	const frac = padded.slice(-USDC_DECIMALS).replace(/0+$/, "");
+	const padded = baseUnits.padStart(7, "0");
+	const whole = padded.slice(0, -6);
+	const frac = padded.slice(-6).replace(/0+$/, "");
 	return frac ? `${whole}.${frac}` : whole;
 }
 /** Block-explorer URL for a settlement tx, or null for an unknown network/tx. */
@@ -53615,7 +53973,7 @@ var PaymentsPayEmailStepCommand = class PaymentsPayEmailStepCommand extends Comm
 /** The human-readable notice describing the async-settlement model. */
 const settlementWaitNotice = "Note: the payment has been SENT, but x402 settlement is asynchronous. --wait only confirms email delivery (SMTP 250), not on-chain settlement. The settle_tx hash arrives in a follow-up x402 settlement interaction email from the payee. Use --wait-settle to poll for it.";
 /** The steps a payer has already seen / sent, so a matching later step is the receipt. */
-const NON_RECEIPT_STEPS = new Set(["challenge", "payment"]);
+const NON_RECEIPT_STEPS = /* @__PURE__ */ new Set(["challenge", "payment"]);
 /**
 * Best-effort extraction of a `settle_tx` from a receipt envelope. The exact
 * receipt wire shape is owned by the platform and not pinned in the SDK, so we
@@ -57813,7 +58171,7 @@ const DESCRIBE_OPERATION_ALIASES = {
 function resolveOperationAlias(id) {
 	return DESCRIBE_OPERATION_ALIASES[id] ?? id;
 }
-const OVERRIDDEN_OPERATION_IDS = new Set([
+const OVERRIDDEN_OPERATION_IDS = /* @__PURE__ */ new Set([
 	"agent-connections:claim-agent-connection",
 	"domains:download-domain-zone-file",
 	"functions:test-function",