primcli 1.7.0 → 1.9.0

package/dist/oclif/index.js

@@ -31,11 +31,15 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	createAgentAccount: () => createAgentAccount,
 	createAgentClaimLink: () => createAgentClaimLink,
 	createChallenge: () => createChallenge,
+	createEmailChallenge: () => createEmailChallenge,
 	createEndpoint: () => createEndpoint,
 	createFilter: () => createFilter,
 	createFunction: () => createFunction,
 	createFunctionSecret: () => createFunctionSecret,
 	createOrgSecret: () => createOrgSecret,
+	createRegistry: () => createRegistry,
+	decideRegistryRequest: () => decideRegistryRequest,
+	defineAgent: () => defineAgent,
 	deleteDomain: () => deleteDomain,
 	deleteEmail: () => deleteEmail,
 	deleteEndpoint: () => deleteEndpoint,
@@ -48,6 +52,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	downloadDomainZoneFile: () => downloadDomainZoneFile,
 	downloadRawEmail: () => downloadRawEmail,
 	getAccount: () => getAccount,
+	getAgent: () => getAgent,
 	getChallenge: () => getChallenge,
 	getConversation: () => getConversation,
 	getEmail: () => getEmail,
@@ -56,6 +61,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getFunctionTestRunTrace: () => getFunctionTestRunTrace,
 	getInboxStatus: () => getInboxStatus,
 	getOrgRoutingTopology: () => getOrgRoutingTopology,
+	getRegistry: () => getRegistry,
 	getSendPermissions: () => getSendPermissions,
 	getSentEmail: () => getSentEmail,
 	getSpendPolicy: () => getSpendPolicy,
@@ -73,15 +79,20 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	listFunctions: () => listFunctions,
 	listOrgSecrets: () => listOrgSecrets,
 	listPayoutAddresses: () => listPayoutAddresses,
+	listRegistries: () => listRegistries,
+	listRegistryAgents: () => listRegistryAgents,
+	listRegistryRequests: () => listRegistryRequests,
 	listSentEmails: () => listSentEmails,
 	payChallenge: () => payChallenge,
 	pollCliLogin: () => pollCliLogin,
+	publishAgent: () => publishAgent,
 	registerPayoutAddress: () => registerPayoutAddress,
 	replayDelivery: () => replayDelivery,
 	replayEmailWebhooks: () => replayEmailWebhooks,
 	replyToEmail: () => replyToEmail,
 	resendAgentSignupVerification: () => resendAgentSignupVerification,
 	resendCliSignupVerification: () => resendCliSignupVerification,
+	resolveRegistryHandle: () => resolveRegistryHandle,
 	rotateWebhookSecret: () => rotateWebhookSecret,
 	searchEmails: () => searchEmails,
 	semanticSearch: () => semanticSearch,
@@ -95,12 +106,14 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	startCliSignup: () => startCliSignup,
 	testEndpoint: () => testEndpoint,
 	testFunction: () => testFunction,
+	unpublishAgent: () => unpublishAgent,
 	unsetFunctionRoute: () => unsetFunctionRoute,
 	updateAccount: () => updateAccount,
 	updateDomain: () => updateDomain,
 	updateEndpoint: () => updateEndpoint,
 	updateFilter: () => updateFilter,
 	updateFunction: () => updateFunction,
+	updateRegistry: () => updateRegistry,
 	updateSpendPolicy: () => updateSpendPolicy,
 	verifyAgentClaim: () => verifyAgentClaim,
 	verifyAgentSignup: () => verifyAgentSignup,
@@ -1671,6 +1684,34 @@ const registerPayoutAddress = (options) => (options.client ?? client).post({
 	}
 });
 /**
+* Create an email-native payment challenge
+*
+* Issue an x402 payment challenge over a real email thread (the payee
+* side). Unlike `createChallenge` (which mints a synthetic challenge id),
+* this sends the challenge as an email from `from` to `to` and binds the
+* payment to that DKIM-authenticated thread. The `pay_to` address and the
+* token asset are resolved server-side from your registered default payout
+* address for the network, never from the request. The response carries
+* the thread's `interaction_id` plus the `challenge` (the
+* `payment_requirements`, the `nonce_binding`, and `expires_at`) the payer
+* needs to sign; the payer replies with a signed `payment` interaction
+* step. Amounts are in token base units (USDC has 6 decimals, so `"10000"`
+* is 0.01 USDC).
+*
+*/
+const createEmailChallenge = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/email-challenges",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
 * Create a payment challenge
 *
 * Create an x402 payment challenge (the payee side of a payment). The
@@ -1790,6 +1831,142 @@ const listDeclinedPayments = (options) => (options?.client ?? client).get({
 	url: "/x402/declined-payments",
 	...options
 });
+/**
+* List the registries you own
+*/
+const listRegistries = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries",
+	...options
+});
+/**
+* Create a registry
+*/
+const createRegistry = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get a public registry's metadata
+*/
+const getRegistry = (options) => (options.client ?? client).get({
+	url: "/registries/{slug}",
+	...options
+});
+/**
+* Update a registry you own
+*/
+const updateRegistry = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List agents in a registry
+*/
+const listRegistryAgents = (options) => (options.client ?? client).get({
+	url: "/registries/{slug}/agents",
+	...options
+});
+/**
+* Publish an agent into a registry
+*/
+const publishAgent = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}/agents",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Unpublish an agent from a registry
+*/
+const unpublishAgent = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}/agents/{handle}",
+	...options
+});
+/**
+* Resolve a registry handle to its agent
+*/
+const resolveRegistryHandle = (options) => (options.client ?? client).get({
+	url: "/registries/{slug}/agents/{handle}",
+	...options
+});
+/**
+* List pending publication requests
+*/
+const listRegistryRequests = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}/requests",
+	...options
+});
+/**
+* Approve or reject a publication request
+*/
+const decideRegistryRequest = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}/requests/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Define an agent identity
+*/
+const defineAgent = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agents",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get an agent's public profile by address
+*/
+const getAgent = (options) => (options.client ?? client).get({
+	url: "/agents/{address}",
+	...options
+});
 //#endregion
 //#region ../packages/api-core/src/openapi/openapi.generated.ts
 /**
@@ -1877,6 +2054,10 @@ const openapiDocument = {
 		{
 			"name": "Functions",
 			"description": "Deploy JavaScript handlers that run on inbound mail. Each function\nis a single ESM module whose default export is an object with an\nasync `fetch(request, env)` method, in the shape of a Workers-style\nhandler. Primitive signs each delivery and forwards the\n`Primitive-Signature` header to the handler; verify the raw request\nbody with `PRIMITIVE_WEBHOOK_SECRET` before trusting the parsed event.\nThe `event` field is `email.received` for normal inbound mail, or a\nmachine-mail type (`email.bounced`, `email.tls_report`,\n`email.dmarc_report`, `email.dmarc_failure`) for bounces and reports;\nthe payload shape is otherwise identical. Code runs on\nPrimitive's edge runtime; there is no infrastructure to manage.\nSecrets land in `env` as encrypted bindings and are refreshed on\nevery redeploy.\n"
+		},
+		{
+			"name": "Registries",
+			"description": "The Agent Registry: ownable directories of agents, addressable by a\nregistry-scoped handle. A registry's publish policy (owner_only, request,\nor open) decides whether a publish lists immediately or pends owner\napproval. An agent is defined once with a globally unique,\nreachability-verified address, then published into any registry under a\nhandle. Discovery reads (list, resolve, get) are public for public\nregistries; managing a registry and moderating requests use the owner's\nAPI key.\n"
 		}
 	],
 	"paths": {
@@ -4172,6 +4353,40 @@ const openapiDocument = {
 				}
 			}
 		},
+		"/x402/email-challenges": { "post": {
+			"operationId": "createEmailChallenge",
+			"summary": "Create an email-native payment challenge",
+			"description": "Issue an x402 payment challenge over a real email thread (the payee\nside). Unlike `createChallenge` (which mints a synthetic challenge id),\nthis sends the challenge as an email from `from` to `to` and binds the\npayment to that DKIM-authenticated thread. The `pay_to` address and the\ntoken asset are resolved server-side from your registered default payout\naddress for the network, never from the request. The response carries\nthe thread's `interaction_id` plus the `challenge` (the\n`payment_requirements`, the `nonce_binding`, and `expires_at`) the payer\nneeds to sign; the payer replies with a signed `payment` interaction\nstep. Amounts are in token base units (USDC has 6 decimals, so `\"10000\"`\nis 0.01 USDC).\n",
+			"tags": ["Payments"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{ "$ref": "#/components/parameters/IdempotencyKey" }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateEmailChallengeInput" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Idempotent replay: a request with a previously-used idempotency key\nreturns the original issued challenge without sending a second email.\n",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/X402EmailChallenge" } }
+					}] } } }
+				},
+				"201": {
+					"description": "Email challenge issued",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/X402EmailChallenge" } }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"409": { "$ref": "#/components/responses/Conflict" },
+				"422": { "$ref": "#/components/responses/UnprocessableEntity" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
 		"/x402/challenges": { "post": {
 			"operationId": "createChallenge",
 			"summary": "Create a payment challenge",
@@ -4314,69 +4529,388 @@ const openapiDocument = {
 				"403": { "$ref": "#/components/responses/Forbidden" },
 				"429": { "$ref": "#/components/responses/RateLimited" }
 			}
-		} }
-	},
-	"components": {
-		"securitySchemes": {
-			"BearerAuth": {
-				"type": "http",
-				"scheme": "bearer",
-				"description": "API key with `prim_` prefix: `Authorization: Bearer prim_<key>`"
+		} },
+		"/registries": {
+			"get": {
+				"operationId": "listRegistries",
+				"summary": "List the registries you own",
+				"tags": ["Registries"],
+				"responses": {
+					"200": {
+						"description": "Registries owned by the caller",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": {
+							"type": "array",
+							"items": { "$ref": "#/components/schemas/Registry" }
+						} } }] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" }
+				}
 			},
-			"DownloadToken": {
-				"type": "apiKey",
-				"in": "query",
-				"name": "token",
-				"description": "Signed download token provided in webhook payloads"
+			"post": {
+				"operationId": "createRegistry",
+				"summary": "Create a registry",
+				"tags": ["Registries"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateRegistryInput" } } }
+				},
+				"responses": {
+					"201": {
+						"description": "Registry created",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": {
+							"type": "object",
+							"properties": {
+								"id": {
+									"type": "string",
+									"format": "uuid"
+								},
+								"slug": { "type": "string" }
+							},
+							"required": ["id", "slug"]
+						} } }] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"409": { "$ref": "#/components/responses/Conflict" },
+					"422": { "$ref": "#/components/responses/ValidationError" }
+				}
 			}
 		},
-		"parameters": {
-			"ResourceId": {
-				"name": "id",
+		"/registries/{slug}": {
+			"parameters": [{
+				"name": "slug",
 				"in": "path",
 				"required": true,
-				"schema": {
-					"type": "string",
-					"format": "uuid"
-				},
-				"description": "Resource UUID"
-			},
-			"Cursor": {
-				"name": "cursor",
-				"in": "query",
 				"schema": { "type": "string" },
-				"description": "Pagination cursor from a previous response's `meta.cursor` field.\nFormat: `{ISO-datetime}|{id}`\n"
+				"description": "The registry slug"
+			}],
+			"get": {
+				"operationId": "getRegistry",
+				"summary": "Get a public registry's metadata",
+				"tags": ["Registries"],
+				"security": [],
+				"responses": {
+					"200": {
+						"description": "Registry metadata",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": { "$ref": "#/components/schemas/Registry" } } }] } } }
+					},
+					"404": { "$ref": "#/components/responses/NotFound" }
+				}
 			},
-			"Limit": {
-				"name": "limit",
-				"in": "query",
-				"schema": {
-					"type": "integer",
-					"minimum": 1,
-					"maximum": 100,
-					"default": 50
+			"patch": {
+				"operationId": "updateRegistry",
+				"summary": "Update a registry you own",
+				"tags": ["Registries"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateRegistryInput" } } }
 				},
-				"description": "Number of results per page"
+				"responses": {
+					"200": {
+						"description": "Registry updated",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": {
+							"type": "object",
+							"properties": { "id": {
+								"type": "string",
+								"format": "uuid"
+							} },
+							"required": ["id"]
+						} } }] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"404": { "$ref": "#/components/responses/NotFound" },
+					"422": { "$ref": "#/components/responses/ValidationError" }
+				}
 			}
 		},
-		"responses": {
-			"Unauthorized": {
-				"description": "Invalid or missing API key",
-				"content": { "application/json": {
-					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-					"example": {
-						"success": false,
-						"error": {
-							"code": "unauthorized",
-							"message": "Invalid or missing API key"
-						}
+		"/registries/{slug}/agents": {
+			"parameters": [{
+				"name": "slug",
+				"in": "path",
+				"required": true,
+				"schema": { "type": "string" }
+			}],
+			"get": {
+				"operationId": "listRegistryAgents",
+				"summary": "List agents in a registry",
+				"tags": ["Registries"],
+				"security": [],
+				"parameters": [{
+					"name": "limit",
+					"in": "query",
+					"required": false,
+					"schema": {
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 200
 					}
+				}, {
+					"name": "cursor",
+					"in": "query",
+					"required": false,
+					"schema": { "type": "string" },
+					"description": "The address of the last agent from the previous page."
+				}],
+				"responses": { "200": {
+					"description": "Approved, reachable agents. Empty for an unknown or private registry.",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/ListEnvelope" }, { "properties": { "data": {
+						"type": "array",
+						"items": { "$ref": "#/components/schemas/RegistryAgent" }
+					} } }] } } }
 				} }
 			},
-			"Forbidden": {
-				"description": "Authenticated caller lacks permission for the operation",
-				"content": { "application/json": {
-					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+			"post": {
+				"operationId": "publishAgent",
+				"summary": "Publish an agent into a registry",
+				"tags": ["Registries"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublishAgentInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Idempotent replay of an existing publication",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": { "$ref": "#/components/schemas/PublishAgentResult" } } }] } } }
+					},
+					"201": {
+						"description": "Published (approved) or request created (requested)",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": { "$ref": "#/components/schemas/PublishAgentResult" } } }] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"404": { "$ref": "#/components/responses/NotFound" },
+					"409": { "$ref": "#/components/responses/Conflict" },
+					"422": { "$ref": "#/components/responses/ValidationError" }
+				}
+			}
+		},
+		"/registries/{slug}/agents/{handle}": {
+			"parameters": [{
+				"name": "slug",
+				"in": "path",
+				"required": true,
+				"schema": { "type": "string" }
+			}, {
+				"name": "handle",
+				"in": "path",
+				"required": true,
+				"schema": { "type": "string" }
+			}],
+			"get": {
+				"operationId": "resolveRegistryHandle",
+				"summary": "Resolve a registry handle to its agent",
+				"tags": ["Registries"],
+				"security": [],
+				"responses": {
+					"200": {
+						"description": "The agent listing under the handle",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": { "$ref": "#/components/schemas/RegistryAgent" } } }] } } }
+					},
+					"404": { "$ref": "#/components/responses/NotFound" }
+				}
+			},
+			"delete": {
+				"operationId": "unpublishAgent",
+				"summary": "Unpublish an agent from a registry",
+				"tags": ["Registries"],
+				"responses": {
+					"200": { "$ref": "#/components/responses/Deleted" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"404": { "$ref": "#/components/responses/NotFound" }
+				}
+			}
+		},
+		"/registries/{slug}/requests": {
+			"parameters": [{
+				"name": "slug",
+				"in": "path",
+				"required": true,
+				"schema": { "type": "string" }
+			}],
+			"get": {
+				"operationId": "listRegistryRequests",
+				"summary": "List pending publication requests",
+				"tags": ["Registries"],
+				"parameters": [{
+					"name": "limit",
+					"in": "query",
+					"required": false,
+					"schema": {
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 200
+					}
+				}],
+				"responses": {
+					"200": {
+						"description": "Pending requests for a registry you own",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": {
+							"type": "array",
+							"items": { "$ref": "#/components/schemas/RegistryRequest" }
+						} } }] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"404": { "$ref": "#/components/responses/NotFound" }
+				}
+			}
+		},
+		"/registries/{slug}/requests/{id}": {
+			"parameters": [{
+				"name": "slug",
+				"in": "path",
+				"required": true,
+				"schema": { "type": "string" }
+			}, { "$ref": "#/components/parameters/ResourceId" }],
+			"post": {
+				"operationId": "decideRegistryRequest",
+				"summary": "Approve or reject a publication request",
+				"tags": ["Registries"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/DecideRegistryRequestInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Decision applied",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": {
+							"type": "object",
+							"properties": { "status": {
+								"type": "string",
+								"enum": ["approved", "rejected"]
+							} },
+							"required": ["status"]
+						} } }] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"404": { "$ref": "#/components/responses/NotFound" },
+					"409": { "$ref": "#/components/responses/Conflict" },
+					"422": { "$ref": "#/components/responses/ValidationError" }
+				}
+			}
+		},
+		"/agents": { "post": {
+			"operationId": "defineAgent",
+			"summary": "Define an agent identity",
+			"tags": ["Registries"],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/DefineAgentInput" } } }
+			},
+			"responses": {
+				"201": {
+					"description": "Agent defined",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"address": { "type": "string" }
+						},
+						"required": ["id", "address"]
+					} } }] } } }
+				},
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"409": { "$ref": "#/components/responses/Conflict" },
+				"422": { "$ref": "#/components/responses/ValidationError" }
+			}
+		} },
+		"/agents/{address}": {
+			"parameters": [{
+				"name": "address",
+				"in": "path",
+				"required": true,
+				"schema": { "type": "string" },
+				"description": "The agent's email address (URL-encoded)."
+			}],
+			"get": {
+				"operationId": "getAgent",
+				"summary": "Get an agent's public profile by address",
+				"tags": ["Registries"],
+				"security": [],
+				"responses": {
+					"200": {
+						"description": "The agent's public profile",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, { "properties": { "data": { "$ref": "#/components/schemas/RegistryAgent" } } }] } } }
+					},
+					"404": { "$ref": "#/components/responses/NotFound" }
+				}
+			}
+		}
+	},
+	"components": {
+		"securitySchemes": {
+			"BearerAuth": {
+				"type": "http",
+				"scheme": "bearer",
+				"description": "API key with `prim_` prefix: `Authorization: Bearer prim_<key>`"
+			},
+			"DownloadToken": {
+				"type": "apiKey",
+				"in": "query",
+				"name": "token",
+				"description": "Signed download token provided in webhook payloads"
+			}
+		},
+		"parameters": {
+			"ResourceId": {
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"description": "Resource UUID"
+			},
+			"IdempotencyKey": {
+				"name": "idempotency-key",
+				"in": "header",
+				"required": false,
+				"schema": {
+					"type": "string",
+					"maxLength": 255
+				},
+				"description": "Optional idempotency key. Retrying a request with the same key returns\nthe original result instead of repeating the side effect (for\n`createEmailChallenge`, re-sending the email).\n"
+			},
+			"Cursor": {
+				"name": "cursor",
+				"in": "query",
+				"schema": { "type": "string" },
+				"description": "Pagination cursor from a previous response's `meta.cursor` field.\nFormat: `{ISO-datetime}|{id}`\n"
+			},
+			"Limit": {
+				"name": "limit",
+				"in": "query",
+				"schema": {
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 100,
+					"default": 50
+				},
+				"description": "Number of results per page"
+			}
+		},
+		"responses": {
+			"Unauthorized": {
+				"description": "Invalid or missing API key",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+					"example": {
+						"success": false,
+						"error": {
+							"code": "unauthorized",
+							"message": "Invalid or missing API key"
+						}
+					}
+				} }
+			},
+			"Forbidden": {
+				"description": "Authenticated caller lacks permission for the operation",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
 					"example": {
 						"success": false,
 						"error": {
@@ -4523,69 +5057,75 @@ const openapiDocument = {
 			}
 		},
 		"schemas": {
-			"RegisterPayoutAddressInput": {
+			"PublishPolicy": {
+				"type": "string",
+				"enum": [
+					"owner_only",
+					"request",
+					"open"
+				],
+				"description": "Who may publish into a registry. owner_only: only the registry owner.\nrequest: anyone may request and the owner approves. open: anyone may\npublish and it lists immediately (no approval step).\n"
+			},
+			"Registry": {
 				"type": "object",
-				"additionalProperties": false,
 				"properties": {
-					"address": {
-						"type": "string",
-						"pattern": "^0x[0-9a-fA-F]{40}$",
-						"description": "The payout address (your signer's own EVM address), 0x-prefixed."
-					},
-					"network": {
-						"type": "string",
-						"enum": ["base", "base-sepolia"],
-						"description": "The chain the address receives on."
-					},
-					"signature": {
+					"id": {
 						"type": "string",
-						"pattern": "^0x[0-9a-fA-F]+$",
-						"description": "A `personal_sign` signature over the org-bound message produced by\nthe SDK helper `buildPayoutRegistrationMessage`. Recovered and\nchecked against `address`; the org id is bound into the signed bytes.\n"
+						"format": "uuid"
 					},
-					"issued_at": {
-						"type": "string",
-						"format": "date-time",
-						"description": "ISO-8601 timestamp embedded in the signed message. Must be within a\nshort freshness window (about 10 minutes) of server time.\n"
+					"slug": { "type": "string" },
+					"name": { "type": "string" },
+					"description": { "type": ["string", "null"] },
+					"is_public": { "type": "boolean" },
+					"publish_policy": { "$ref": "#/components/schemas/PublishPolicy" }
+				},
+				"required": [
+					"id",
+					"slug",
+					"name",
+					"description",
+					"is_public",
+					"publish_policy"
+				]
+			},
+			"RegistryAgent": {
+				"type": "object",
+				"description": "An agent's public directory profile.",
+				"properties": {
+					"address": { "type": "string" },
+					"display_name": { "type": "string" },
+					"title": { "type": ["string", "null"] },
+					"description": { "type": ["string", "null"] },
+					"tags": {
+						"type": "array",
+						"items": { "type": "string" }
 					},
-					"label": {
-						"type": "string",
-						"maxLength": 80,
-						"description": "Optional human-readable label."
+					"handle": {
+						"type": ["string", "null"],
+						"description": "The registry-scoped name. Null on the global by-address read."
 					}
 				},
 				"required": [
 					"address",
-					"network",
-					"signature",
-					"issued_at"
+					"display_name",
+					"title",
+					"description",
+					"tags",
+					"handle"
 				]
 			},
-			"X402PayoutAddress": {
+			"RegistryRequest": {
 				"type": "object",
+				"description": "A pending publication request, as the registry owner sees it.",
 				"properties": {
 					"id": {
 						"type": "string",
 						"format": "uuid"
 					},
-					"address": {
-						"type": "string",
-						"description": "The checksummed payout address."
-					},
-					"network": {
-						"type": "string",
-						"enum": ["base", "base-sepolia"]
-					},
-					"label": { "type": ["string", "null"] },
-					"is_default": {
-						"type": "boolean",
-						"description": "Exactly one address per (org, network) is the default."
-					},
-					"verified_at": {
-						"type": "string",
-						"format": "date-time",
-						"description": "When ownership of the address was last proven."
-					},
-					"created_at": {
+					"address": { "type": "string" },
+					"display_name": { "type": "string" },
+					"handle": { "type": ["string", "null"] },
+					"requested_at": {
 						"type": "string",
 						"format": "date-time"
 					}
@@ -4593,24 +5133,216 @@ const openapiDocument = {
 				"required": [
 					"id",
 					"address",
-					"network",
-					"label",
-					"is_default",
-					"verified_at"
+					"display_name",
+					"handle",
+					"requested_at"
 				]
 			},
-			"CreateChallengeInput": {
+			"CreateRegistryInput": {
 				"type": "object",
-				"additionalProperties": false,
 				"properties": {
-					"amount": {
+					"slug": {
 						"type": "string",
-						"pattern": "^[1-9][0-9]{0,38}$",
-						"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
+						"pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$",
+						"description": "Lowercase slug, unique across registries."
 					},
-					"network": {
+					"name": {
 						"type": "string",
-						"enum": ["base", "base-sepolia"]
+						"minLength": 1,
+						"maxLength": 120
+					},
+					"description": {
+						"type": ["string", "null"],
+						"maxLength": 2e3
+					},
+					"is_public": { "type": "boolean" },
+					"publish_policy": { "$ref": "#/components/schemas/PublishPolicy" }
+				},
+				"required": ["slug", "name"]
+			},
+			"UpdateRegistryInput": {
+				"type": "object",
+				"minProperties": 1,
+				"properties": {
+					"name": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 120
+					},
+					"description": {
+						"type": ["string", "null"],
+						"maxLength": 2e3
+					},
+					"is_public": { "type": "boolean" },
+					"publish_policy": { "$ref": "#/components/schemas/PublishPolicy" }
+				}
+			},
+			"DefineAgentInput": {
+				"type": "object",
+				"properties": {
+					"address": {
+						"type": "string",
+						"description": "The agent's globally unique email address; must route to the endpoint."
+					},
+					"endpoint_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"display_name": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 120
+					},
+					"title": {
+						"type": ["string", "null"],
+						"maxLength": 120
+					},
+					"description": {
+						"type": ["string", "null"],
+						"maxLength": 2e3
+					},
+					"tags": {
+						"type": "array",
+						"items": {
+							"type": "string",
+							"maxLength": 40
+						},
+						"maxItems": 20
+					}
+				},
+				"required": [
+					"address",
+					"endpoint_id",
+					"display_name"
+				]
+			},
+			"PublishAgentInput": {
+				"type": "object",
+				"properties": {
+					"address": { "type": "string" },
+					"handle": {
+						"type": "string",
+						"description": "The registry-scoped name to list the agent under."
+					}
+				},
+				"required": ["address", "handle"]
+			},
+			"PublishAgentResult": {
+				"type": "object",
+				"properties": {
+					"status": {
+						"type": "string",
+						"enum": ["approved", "requested"],
+						"description": "approved lists immediately; requested pends owner approval."
+					},
+					"handle": { "type": "string" },
+					"idempotent_replay": {
+						"type": "boolean",
+						"description": "True when the publish matched an existing identical publication."
+					}
+				},
+				"required": [
+					"status",
+					"handle",
+					"idempotent_replay"
+				]
+			},
+			"DecideRegistryRequestInput": {
+				"type": "object",
+				"properties": { "decision": {
+					"type": "string",
+					"enum": ["approved", "rejected"]
+				} },
+				"required": ["decision"]
+			},
+			"RegisterPayoutAddressInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"address": {
+						"type": "string",
+						"pattern": "^0x[0-9a-fA-F]{40}$",
+						"description": "The payout address (your signer's own EVM address), 0x-prefixed."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"],
+						"description": "The chain the address receives on."
+					},
+					"signature": {
+						"type": "string",
+						"pattern": "^0x[0-9a-fA-F]+$",
+						"description": "A `personal_sign` signature over the org-bound message produced by\nthe SDK helper `buildPayoutRegistrationMessage`. Recovered and\nchecked against `address`; the org id is bound into the signed bytes.\n"
+					},
+					"issued_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "ISO-8601 timestamp embedded in the signed message. Must be within a\nshort freshness window (about 10 minutes) of server time.\n"
+					},
+					"label": {
+						"type": "string",
+						"maxLength": 80,
+						"description": "Optional human-readable label."
+					}
+				},
+				"required": [
+					"address",
+					"network",
+					"signature",
+					"issued_at"
+				]
+			},
+			"X402PayoutAddress": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"address": {
+						"type": "string",
+						"description": "The checksummed payout address."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"label": { "type": ["string", "null"] },
+					"is_default": {
+						"type": "boolean",
+						"description": "Exactly one address per (org, network) is the default."
+					},
+					"verified_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "When ownership of the address was last proven."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"address",
+					"network",
+					"label",
+					"is_default",
+					"verified_at"
+				]
+			},
+			"CreateChallengeInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"amount": {
+						"type": "string",
+						"pattern": "^[1-9][0-9]{0,38}$",
+						"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
 					},
 					"payer_org": {
 						"type": "string",
@@ -4781,6 +5513,94 @@ const openapiDocument = {
 					"expires_at"
 				]
 			},
+			"CreateEmailChallengeInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "Issue a payment challenge over an email thread. `from` is your sending\naddress (the funds receiver; ownership is enforced at send, exactly as\nfor outbound mail) and `to` is the payer's address. The `pay_to` payout\nwallet and the token asset are resolved server-side, never taken from\nthe request.\n",
+				"properties": {
+					"from": {
+						"type": "string",
+						"format": "email",
+						"description": "Your sending address (the payee / funds receiver). Must be an\naddress your org is allowed to send from.\n"
+					},
+					"to": {
+						"type": "string",
+						"format": "email",
+						"description": "The payer's email address the challenge is sent to."
+					},
+					"amount": {
+						"type": "string",
+						"pattern": "^[1-9][0-9]{0,38}$",
+						"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"expires_in": {
+						"type": "integer",
+						"minimum": 60,
+						"maximum": 86400,
+						"description": "Seconds until the challenge expires. Defaults to 3600."
+					},
+					"resource": {
+						"type": "string",
+						"format": "uri",
+						"maxLength": 2048,
+						"description": "Optional URL identifying what is being paid for."
+					},
+					"description": {
+						"type": "string",
+						"maxLength": 512,
+						"description": "Optional human-readable description of the payment."
+					}
+				},
+				"required": [
+					"from",
+					"to",
+					"amount",
+					"network"
+				]
+			},
+			"X402EmailChallengeDetails": {
+				"type": "object",
+				"description": "The challenge the payer needs to sign and pay, carried inside an\nemail-native challenge response.\n",
+				"properties": {
+					"payment_requirements": { "$ref": "#/components/schemas/X402PaymentRequirements" },
+					"nonce_binding": { "$ref": "#/components/schemas/X402NonceBinding" },
+					"expires_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "ISO-8601 expiry of the challenge."
+					}
+				},
+				"required": [
+					"payment_requirements",
+					"nonce_binding",
+					"expires_at"
+				]
+			},
+			"X402EmailChallenge": {
+				"type": "object",
+				"description": "The result of issuing an email-native payment challenge. `interaction_id`\nis the real email thread id (`uuid@domain`) the payment is bound to;\n`challenge_id` is the underlying challenge record. Hand the `challenge`\nto the payer, who replies with a signed `payment` interaction step (the\nSDK `payEmailChallenge` helper builds it).\n",
+				"properties": {
+					"interaction_id": {
+						"type": "string",
+						"description": "The email thread id (`uuid@domain`) the payment is bound to."
+					},
+					"challenge_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The underlying challenge record id."
+					},
+					"challenge": { "$ref": "#/components/schemas/X402EmailChallengeDetails" }
+				},
+				"required": [
+					"interaction_id",
+					"challenge_id",
+					"challenge"
+				]
+			},
 			"X402PaymentPayload": {
 				"type": "object",
 				"description": "A signed x402 v1 `PaymentPayload`. The SDK `pay()` helper builds this;\ncallers rarely construct it by hand. Field names are x402-native.\n",
@@ -14631,28 +15451,200 @@ const operationManifest = [
 	},
 	{
 		"binaryResponse": false,
-		"bodyRequired": false,
-		"command": "get-challenge",
-		"description": "Fetch a challenge you created, to poll its `status` and settlement\nreceipt (`settle_tx`). Scoped to the challenger org that created it.\n",
-		"hasJsonBody": false,
-		"method": "GET",
-		"operationId": "getChallenge",
-		"path": "/x402/challenges/{id}",
-		"pathParams": [{
-			"description": "Resource UUID",
-			"enum": null,
-			"name": "id",
-			"required": true,
-			"type": "string"
-		}],
+		"bodyRequired": true,
+		"command": "create-email-challenge",
+		"description": "Issue an x402 payment challenge over a real email thread (the payee\nside). Unlike `createChallenge` (which mints a synthetic challenge id),\nthis sends the challenge as an email from `from` to `to` and binds the\npayment to that DKIM-authenticated thread. The `pay_to` address and the\ntoken asset are resolved server-side from your registered default payout\naddress for the network, never from the request. The response carries\nthe thread's `interaction_id` plus the `challenge` (the\n`payment_requirements`, the `nonce_binding`, and `expires_at`) the payer\nneeds to sign; the payer replies with a signed `payment` interaction\nstep. Amounts are in token base units (USDC has 6 decimals, so `\"10000\"`\nis 0.01 USDC).\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createEmailChallenge",
+		"path": "/x402/email-challenges",
+		"pathParams": [],
 		"queryParams": [],
-		"requestSchema": null,
-		"responseSchema": {
+		"requestSchema": {
 			"type": "object",
+			"additionalProperties": false,
+			"description": "Issue a payment challenge over an email thread. `from` is your sending\naddress (the funds receiver; ownership is enforced at send, exactly as\nfor outbound mail) and `to` is the payer's address. The `pay_to` payout\nwallet and the token asset are resolved server-side, never taken from\nthe request.\n",
 			"properties": {
-				"id": {
+				"from": {
 					"type": "string",
-					"format": "uuid"
+					"format": "email",
+					"description": "Your sending address (the payee / funds receiver). Must be an\naddress your org is allowed to send from.\n"
+				},
+				"to": {
+					"type": "string",
+					"format": "email",
+					"description": "The payer's email address the challenge is sent to."
+				},
+				"amount": {
+					"type": "string",
+					"pattern": "^[1-9][0-9]{0,38}$",
+					"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"]
+				},
+				"expires_in": {
+					"type": "integer",
+					"minimum": 60,
+					"maximum": 86400,
+					"description": "Seconds until the challenge expires. Defaults to 3600."
+				},
+				"resource": {
+					"type": "string",
+					"format": "uri",
+					"maxLength": 2048,
+					"description": "Optional URL identifying what is being paid for."
+				},
+				"description": {
+					"type": "string",
+					"maxLength": 512,
+					"description": "Optional human-readable description of the payment."
+				}
+			},
+			"required": [
+				"from",
+				"to",
+				"amount",
+				"network"
+			]
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "The result of issuing an email-native payment challenge. `interaction_id`\nis the real email thread id (`uuid@domain`) the payment is bound to;\n`challenge_id` is the underlying challenge record. Hand the `challenge`\nto the payer, who replies with a signed `payment` interaction step (the\nSDK `payEmailChallenge` helper builds it).\n",
+			"properties": {
+				"interaction_id": {
+					"type": "string",
+					"description": "The email thread id (`uuid@domain`) the payment is bound to."
+				},
+				"challenge_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "The underlying challenge record id."
+				},
+				"challenge": {
+					"type": "object",
+					"description": "The challenge the payer needs to sign and pay, carried inside an\nemail-native challenge response.\n",
+					"properties": {
+						"payment_requirements": {
+							"type": "object",
+							"description": "The x402 `PaymentRequirements` the payer signs over. Field names are\nx402's native camelCase, preserved byte-for-byte.\n",
+							"properties": {
+								"scheme": {
+									"type": "string",
+									"description": "The x402 settlement scheme. Always `exact` for v1.",
+									"example": "exact"
+								},
+								"network": {
+									"type": "string",
+									"enum": ["base", "base-sepolia"]
+								},
+								"maxAmountRequired": {
+									"type": "string",
+									"description": "Amount in token base units."
+								},
+								"payTo": {
+									"type": "string",
+									"description": "The payee's resolved payout address (checksummed)."
+								},
+								"asset": {
+									"type": "string",
+									"description": "The token contract address (checksummed). USDC."
+								},
+								"resource": { "type": "string" },
+								"description": { "type": "string" },
+								"maxTimeoutSeconds": { "type": "integer" },
+								"extra": {
+									"type": "object",
+									"description": "The token's load-bearing EIP-712 domain params. `name` differs by\nchain (Base mainnet USDC is `USD Coin`, Base Sepolia is `USDC`); a\nwrong value produces a signature the verifier rejects.\n",
+									"properties": {
+										"name": { "type": "string" },
+										"version": { "type": "string" }
+									},
+									"required": ["name", "version"]
+								}
+							},
+							"required": [
+								"scheme",
+								"network",
+								"maxAmountRequired",
+								"payTo",
+								"asset",
+								"extra"
+							]
+						},
+						"nonce_binding": {
+							"type": "object",
+							"description": "The interaction binding the payer hashes into the EIP-3009 nonce\n(`deriveEip3009Nonce`). Pinning the nonce to this binding is what lets an\nx402 payment ride asynchronous transports safely: a replayed challenge\ncan't redirect funds and a signed payment can't settle twice.\n",
+							"properties": {
+								"interaction_id": {
+									"type": "string",
+									"description": "Interaction id, including its `@domain` part."
+								},
+								"challenge_step_id": {
+									"type": "string",
+									"format": "uuid"
+								},
+								"challenge_nonce": {
+									"type": "string",
+									"pattern": "^[0-9a-f]{64}$",
+									"description": "32 random bytes as 64 lowercase hex chars."
+								}
+							},
+							"required": [
+								"interaction_id",
+								"challenge_step_id",
+								"challenge_nonce"
+							]
+						},
+						"expires_at": {
+							"type": "string",
+							"format": "date-time",
+							"description": "ISO-8601 expiry of the challenge."
+						}
+					},
+					"required": [
+						"payment_requirements",
+						"nonce_binding",
+						"expires_at"
+					]
+				}
+			},
+			"required": [
+				"interaction_id",
+				"challenge_id",
+				"challenge"
+			]
+		},
+		"sdkName": "createEmailChallenge",
+		"summary": "Create an email-native payment challenge",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-challenge",
+		"description": "Fetch a challenge you created, to poll its `status` and settlement\nreceipt (`settle_tx`). Scoped to the challenger org that created it.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getChallenge",
+		"path": "/x402/challenges/{id}",
+		"pathParams": [{
+			"description": "Resource UUID",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
 				},
 				"status": {
 					"type": "string",
@@ -15142,96 +16134,732 @@ const operationManifest = [
 					"format": "date-time",
 					"description": "When ownership of the address was last proven."
 				},
-				"created_at": {
-					"type": "string",
-					"format": "date-time"
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
+			"required": [
+				"id",
+				"address",
+				"network",
+				"label",
+				"is_default",
+				"verified_at"
+			]
+		},
+		"sdkName": "registerPayoutAddress",
+		"summary": "Register a payout address",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-spend-policy",
+		"description": "Update your org's spend policy. Applied as a merge: only the fields you\ninclude change, and omitted fields keep their current value, so a partial\nupdate can't silently reset the kill-switch. Send an explicit `null` to\nclear a cap. Caps are in token base units.\n",
+		"hasJsonBody": true,
+		"method": "PUT",
+		"operationId": "updateSpendPolicy",
+		"path": "/x402/spend-policy",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Merge update: only the fields you include change; omit a field to keep\nits current value; send `null` to clear a cap.\n",
+			"properties": {
+				"paused": { "type": "boolean" },
+				"max_per_payment": {
+					"type": ["string", "null"],
+					"pattern": "^[1-9][0-9]{0,38}$"
+				},
+				"max_per_day": {
+					"type": ["string", "null"],
+					"pattern": "^[1-9][0-9]{0,38}$"
+				},
+				"allowlist": {
+					"type": ["array", "null"],
+					"maxItems": 1e3,
+					"items": {
+						"type": "string",
+						"format": "uuid"
+					}
+				}
+			}
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "The payer's outbound spend policy. Returned with defaults (not paused,\nno caps, any on-net payee) when none is set.\n",
+			"properties": {
+				"paused": {
+					"type": "boolean",
+					"description": "Kill-switch. When true, all outbound payments are refused."
+				},
+				"max_per_payment": {
+					"type": ["string", "null"],
+					"description": "Per-payment cap in token base units, or null for no cap."
+				},
+				"max_per_day": {
+					"type": ["string", "null"],
+					"description": "Rolling-day cap in token base units, or null for no cap."
+				},
+				"allowlist": {
+					"type": ["array", "null"],
+					"items": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"description": "Allowed payee org ids. `null` allows any on-net payee; `[]` denies\nall.\n"
+				}
+			},
+			"required": [
+				"paused",
+				"max_per_payment",
+				"max_per_day",
+				"allowlist"
+			]
+		},
+		"sdkName": "updateSpendPolicy",
+		"summary": "Update your spend policy",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "create-registry",
+		"description": null,
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createRegistry",
+		"path": "/registries",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"properties": {
+				"slug": {
+					"type": "string",
+					"pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$",
+					"description": "Lowercase slug, unique across registries."
+				},
+				"name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 120
+				},
+				"description": {
+					"type": ["string", "null"],
+					"maxLength": 2e3
+				},
+				"is_public": { "type": "boolean" },
+				"publish_policy": {
+					"type": "string",
+					"enum": [
+						"owner_only",
+						"request",
+						"open"
+					],
+					"description": "Who may publish into a registry. owner_only: only the registry owner.\nrequest: anyone may request and the owner approves. open: anyone may\npublish and it lists immediately (no approval step).\n"
+				}
+			},
+			"required": ["slug", "name"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"slug": { "type": "string" }
+			},
+			"required": ["id", "slug"]
+		},
+		"sdkName": "createRegistry",
+		"summary": "Create a registry",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "decide-registry-request",
+		"description": null,
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "decideRegistryRequest",
+		"path": "/registries/{slug}/requests/{id}",
+		"pathParams": [{
+			"description": null,
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}, {
+			"description": "Resource UUID",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"properties": { "decision": {
+				"type": "string",
+				"enum": ["approved", "rejected"]
+			} },
+			"required": ["decision"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": { "status": {
+				"type": "string",
+				"enum": ["approved", "rejected"]
+			} },
+			"required": ["status"]
+		},
+		"sdkName": "decideRegistryRequest",
+		"summary": "Approve or reject a publication request",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "define-agent",
+		"description": null,
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "defineAgent",
+		"path": "/agents",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"properties": {
+				"address": {
+					"type": "string",
+					"description": "The agent's globally unique email address; must route to the endpoint."
+				},
+				"endpoint_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"display_name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 120
+				},
+				"title": {
+					"type": ["string", "null"],
+					"maxLength": 120
+				},
+				"description": {
+					"type": ["string", "null"],
+					"maxLength": 2e3
+				},
+				"tags": {
+					"type": "array",
+					"items": {
+						"type": "string",
+						"maxLength": 40
+					},
+					"maxItems": 20
+				}
+			},
+			"required": [
+				"address",
+				"endpoint_id",
+				"display_name"
+			]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"address": { "type": "string" }
+			},
+			"required": ["id", "address"]
+		},
+		"sdkName": "defineAgent",
+		"summary": "Define an agent identity",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-agent",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getAgent",
+		"path": "/agents/{address}",
+		"pathParams": [{
+			"description": "The agent's email address (URL-encoded).",
+			"enum": null,
+			"name": "address",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"description": "An agent's public directory profile.",
+			"properties": {
+				"address": { "type": "string" },
+				"display_name": { "type": "string" },
+				"title": { "type": ["string", "null"] },
+				"description": { "type": ["string", "null"] },
+				"tags": {
+					"type": "array",
+					"items": { "type": "string" }
+				},
+				"handle": {
+					"type": ["string", "null"],
+					"description": "The registry-scoped name. Null on the global by-address read."
+				}
+			},
+			"required": [
+				"address",
+				"display_name",
+				"title",
+				"description",
+				"tags",
+				"handle"
+			]
+		},
+		"sdkName": "getAgent",
+		"summary": "Get an agent's public profile by address",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-registry",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getRegistry",
+		"path": "/registries/{slug}",
+		"pathParams": [{
+			"description": "The registry slug",
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"slug": { "type": "string" },
+				"name": { "type": "string" },
+				"description": { "type": ["string", "null"] },
+				"is_public": { "type": "boolean" },
+				"publish_policy": {
+					"type": "string",
+					"enum": [
+						"owner_only",
+						"request",
+						"open"
+					],
+					"description": "Who may publish into a registry. owner_only: only the registry owner.\nrequest: anyone may request and the owner approves. open: anyone may\npublish and it lists immediately (no approval step).\n"
+				}
+			},
+			"required": [
+				"id",
+				"slug",
+				"name",
+				"description",
+				"is_public",
+				"publish_policy"
+			]
+		},
+		"sdkName": "getRegistry",
+		"summary": "Get a public registry's metadata",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-registries",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listRegistries",
+		"path": "/registries",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"slug": { "type": "string" },
+					"name": { "type": "string" },
+					"description": { "type": ["string", "null"] },
+					"is_public": { "type": "boolean" },
+					"publish_policy": {
+						"type": "string",
+						"enum": [
+							"owner_only",
+							"request",
+							"open"
+						],
+						"description": "Who may publish into a registry. owner_only: only the registry owner.\nrequest: anyone may request and the owner approves. open: anyone may\npublish and it lists immediately (no approval step).\n"
+					}
+				},
+				"required": [
+					"id",
+					"slug",
+					"name",
+					"description",
+					"is_public",
+					"publish_policy"
+				]
+			}
+		},
+		"sdkName": "listRegistries",
+		"summary": "List the registries you own",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-registry-agents",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listRegistryAgents",
+		"path": "/registries/{slug}/agents",
+		"pathParams": [{
+			"description": null,
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [{
+			"description": null,
+			"enum": null,
+			"maximum": 200,
+			"minimum": 1,
+			"name": "limit",
+			"required": false,
+			"type": "integer"
+		}, {
+			"description": "The address of the last agent from the previous page.",
+			"enum": null,
+			"name": "cursor",
+			"required": false,
+			"type": "string"
+		}],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"description": "An agent's public directory profile.",
+				"properties": {
+					"address": { "type": "string" },
+					"display_name": { "type": "string" },
+					"title": { "type": ["string", "null"] },
+					"description": { "type": ["string", "null"] },
+					"tags": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"handle": {
+						"type": ["string", "null"],
+						"description": "The registry-scoped name. Null on the global by-address read."
+					}
+				},
+				"required": [
+					"address",
+					"display_name",
+					"title",
+					"description",
+					"tags",
+					"handle"
+				]
+			}
+		},
+		"sdkName": "listRegistryAgents",
+		"summary": "List agents in a registry",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-registry-requests",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listRegistryRequests",
+		"path": "/registries/{slug}/requests",
+		"pathParams": [{
+			"description": null,
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [{
+			"description": null,
+			"enum": null,
+			"maximum": 200,
+			"minimum": 1,
+			"name": "limit",
+			"required": false,
+			"type": "integer"
+		}],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"description": "A pending publication request, as the registry owner sees it.",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"address": { "type": "string" },
+					"display_name": { "type": "string" },
+					"handle": { "type": ["string", "null"] },
+					"requested_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"address",
+					"display_name",
+					"handle",
+					"requested_at"
+				]
+			}
+		},
+		"sdkName": "listRegistryRequests",
+		"summary": "List pending publication requests",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "publish-agent",
+		"description": null,
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "publishAgent",
+		"path": "/registries/{slug}/agents",
+		"pathParams": [{
+			"description": null,
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"properties": {
+				"address": { "type": "string" },
+				"handle": {
+					"type": "string",
+					"description": "The registry-scoped name to list the agent under."
+				}
+			},
+			"required": ["address", "handle"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"status": {
+					"type": "string",
+					"enum": ["approved", "requested"],
+					"description": "approved lists immediately; requested pends owner approval."
+				},
+				"handle": { "type": "string" },
+				"idempotent_replay": {
+					"type": "boolean",
+					"description": "True when the publish matched an existing identical publication."
+				}
+			},
+			"required": [
+				"status",
+				"handle",
+				"idempotent_replay"
+			]
+		},
+		"sdkName": "publishAgent",
+		"summary": "Publish an agent into a registry",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "resolve-registry-handle",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "resolveRegistryHandle",
+		"path": "/registries/{slug}/agents/{handle}",
+		"pathParams": [{
+			"description": null,
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}, {
+			"description": null,
+			"enum": null,
+			"name": "handle",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"description": "An agent's public directory profile.",
+			"properties": {
+				"address": { "type": "string" },
+				"display_name": { "type": "string" },
+				"title": { "type": ["string", "null"] },
+				"description": { "type": ["string", "null"] },
+				"tags": {
+					"type": "array",
+					"items": { "type": "string" }
+				},
+				"handle": {
+					"type": ["string", "null"],
+					"description": "The registry-scoped name. Null on the global by-address read."
 				}
 			},
 			"required": [
-				"id",
 				"address",
-				"network",
-				"label",
-				"is_default",
-				"verified_at"
+				"display_name",
+				"title",
+				"description",
+				"tags",
+				"handle"
 			]
 		},
-		"sdkName": "registerPayoutAddress",
-		"summary": "Register a payout address",
-		"tag": "Payments",
-		"tagCommand": "payments"
+		"sdkName": "resolveRegistryHandle",
+		"summary": "Resolve a registry handle to its agent",
+		"tag": "Registries",
+		"tagCommand": "registries"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "unpublish-agent",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "DELETE",
+		"operationId": "unpublishAgent",
+		"path": "/registries/{slug}/agents/{handle}",
+		"pathParams": [{
+			"description": null,
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}, {
+			"description": null,
+			"enum": null,
+			"name": "handle",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": null,
+		"sdkName": "unpublishAgent",
+		"summary": "Unpublish an agent from a registry",
+		"tag": "Registries",
+		"tagCommand": "registries"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "update-spend-policy",
-		"description": "Update your org's spend policy. Applied as a merge: only the fields you\ninclude change, and omitted fields keep their current value, so a partial\nupdate can't silently reset the kill-switch. Send an explicit `null` to\nclear a cap. Caps are in token base units.\n",
+		"command": "update-registry",
+		"description": null,
 		"hasJsonBody": true,
-		"method": "PUT",
-		"operationId": "updateSpendPolicy",
-		"path": "/x402/spend-policy",
-		"pathParams": [],
+		"method": "PATCH",
+		"operationId": "updateRegistry",
+		"path": "/registries/{slug}",
+		"pathParams": [{
+			"description": "The registry slug",
+			"enum": null,
+			"name": "slug",
+			"required": true,
+			"type": "string"
+		}],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
-			"additionalProperties": false,
-			"description": "Merge update: only the fields you include change; omit a field to keep\nits current value; send `null` to clear a cap.\n",
+			"minProperties": 1,
 			"properties": {
-				"paused": { "type": "boolean" },
-				"max_per_payment": {
-					"type": ["string", "null"],
-					"pattern": "^[1-9][0-9]{0,38}$"
+				"name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 120
 				},
-				"max_per_day": {
+				"description": {
 					"type": ["string", "null"],
-					"pattern": "^[1-9][0-9]{0,38}$"
+					"maxLength": 2e3
 				},
-				"allowlist": {
-					"type": ["array", "null"],
-					"maxItems": 1e3,
-					"items": {
-						"type": "string",
-						"format": "uuid"
-					}
+				"is_public": { "type": "boolean" },
+				"publish_policy": {
+					"type": "string",
+					"enum": [
+						"owner_only",
+						"request",
+						"open"
+					],
+					"description": "Who may publish into a registry. owner_only: only the registry owner.\nrequest: anyone may request and the owner approves. open: anyone may\npublish and it lists immediately (no approval step).\n"
 				}
 			}
 		},
 		"responseSchema": {
 			"type": "object",
-			"description": "The payer's outbound spend policy. Returned with defaults (not paused,\nno caps, any on-net payee) when none is set.\n",
-			"properties": {
-				"paused": {
-					"type": "boolean",
-					"description": "Kill-switch. When true, all outbound payments are refused."
-				},
-				"max_per_payment": {
-					"type": ["string", "null"],
-					"description": "Per-payment cap in token base units, or null for no cap."
-				},
-				"max_per_day": {
-					"type": ["string", "null"],
-					"description": "Rolling-day cap in token base units, or null for no cap."
-				},
-				"allowlist": {
-					"type": ["array", "null"],
-					"items": {
-						"type": "string",
-						"format": "uuid"
-					},
-					"description": "Allowed payee org ids. `null` allows any on-net payee; `[]` denies\nall.\n"
-				}
-			},
-			"required": [
-				"paused",
-				"max_per_payment",
-				"max_per_day",
-				"allowlist"
-			]
+			"properties": { "id": {
+				"type": "string",
+				"format": "uuid"
+			} },
+			"required": ["id"]
 		},
-		"sdkName": "updateSpendPolicy",
-		"summary": "Update your spend policy",
-		"tag": "Payments",
-		"tagCommand": "payments"
+		"sdkName": "updateRegistry",
+		"summary": "Update a registry you own",
+		"tag": "Registries",
+		"tagCommand": "registries"
 	},
 	{
 		"binaryResponse": false,
@@ -21020,8 +22648,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.7.0";
-const CLI_VERSION_RANGE = "^1.7.0";
+const SDK_VERSION_RANGE = "^1.9.0";
+const CLI_VERSION_RANGE = "^1.9.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -24509,6 +26137,43 @@ function buildPayoutRegistrationMessage(input) {
 		`issued: ${input.issuedAt}`
 	].join("\n");
 }
+/**
+* The protocol the email-native payment interaction runs (`x402.payment/1`).
+* The payer's reply carries the `payment` step of this protocol.
+*/
+const X402_INTERACTION_PROTOCOL = "x402.payment";
+/** A UUID (used for `interaction_id`'s local part and the step ids). */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** An interaction id is `uuid@domain`. */
+const WIRE_ID_RE = new RegExp(`^${UUID_RE.source.slice(1, -1)}@[^\\s@]+$`, "i");
+/**
+* Build the section-2.3 interaction.json envelope for a `payment` step. Pure: no
+* I/O. `payment` is the signed exact-EVM payload (from
+* `buildExactEvmPaymentPayload`); `prevStepId` is the challenge step id this
+* payment answers, and `stepId` is a fresh UUID for the payment step. Returns
+* the envelope and its canonical JSON, so the bytes the platform reads back are
+* exactly the ones produced here.
+*/
+function buildPaymentStepEnvelope(params) {
+	if (!WIRE_ID_RE.test(params.interactionId)) throw new Error("buildPaymentStepEnvelope: interactionId must be uuid@domain");
+	if (!UUID_RE.test(params.stepId)) throw new Error("buildPaymentStepEnvelope: stepId must be a uuid");
+	if (!UUID_RE.test(params.prevStepId)) throw new Error("buildPaymentStepEnvelope: prevStepId must be a uuid");
+	const envelope = {
+		interaction_version: 1,
+		interaction_id: params.interactionId,
+		protocol: X402_INTERACTION_PROTOCOL,
+		protocol_version: 1,
+		step: "payment",
+		step_id: params.stepId,
+		prev_step_id: params.prevStepId,
+		expires_at: params.expiresAt ?? null,
+		payload: { payment: params.payment }
+	};
+	return {
+		envelope,
+		json: JSON.stringify(envelope)
+	};
+}
 /** Assemble the wire payload from a signed authorization. */
 function toPaymentPayload(network, auth, signature) {
 	return {
@@ -24586,6 +26251,15 @@ function buildExactEvmPaymentPayload(params) {
 	if (!NONCE_HEX_RE.test(params.authorization.nonce)) throw new Error("buildExactEvmPaymentPayload: authorization.nonce must be a 0x-prefixed 32-byte (64 hex char) value");
 	return toPaymentPayload(params.network, params.authorization, params.signature);
 }
+/**
+* x402 agent-to-agent payments.
+*
+* `charge()` (payee) asks for a payment; `pay()` (payer) signs and settles it
+* with the customer's own key. The signing is local and non-custodial; the key
+* never leaves the caller. The server resolves the real payee address, verifies
+* every signed field against its own records, and enforces the spend policy, so
+* the SDK's job is just: derive the bound authorization, sign, and submit.
+*/
 const CHAIN_IDS = {
 	"base-sepolia": 84532,
 	base: 8453
@@ -24601,6 +26275,17 @@ const CHARGE_INPUT_KEYS = {
 	expiresIn: true,
 	idempotencyKey: true
 };
+const EMAIL_CHARGE_INPUT_KEYS = {
+	from: true,
+	to: true,
+	amount: true,
+	amountUsdc: true,
+	network: true,
+	description: true,
+	resource: true,
+	expiresIn: true,
+	idempotencyKey: true
+};
 function usdcToBaseUnits$1(human) {
 	const trimmed = human.trim();
 	if (!/^\d+(\.\d+)?$/.test(trimmed)) return null;
@@ -24637,13 +26322,37 @@ function validateChallenge(c) {
 	if (!c.expires_at) bad("expires_at");
 	const nb = c.nonce_binding;
 	if (!nb?.interaction_id || !nb.challenge_step_id || !nb.challenge_nonce) bad("nonce_binding");
-	const pr = c.payment_requirements;
+	validatePaymentRequirements(c.payment_requirements, bad);
+}
+/** Validate the x402 PaymentRequirements shared by both challenge shapes. */
+function validatePaymentRequirements(pr, bad) {
 	if (!pr) bad("payment_requirements");
 	if (!/^[1-9][0-9]{0,38}$/.test(pr.maxAmountRequired ?? "")) bad("payment_requirements.maxAmountRequired (expected a positive integer string in token base units)");
 	if (!/^0x[0-9a-fA-F]{40}$/.test(pr.payTo ?? "")) bad("payment_requirements.payTo (expected a 0x address)");
 	if (!/^0x[0-9a-fA-F]{40}$/.test(pr.asset ?? "")) bad("payment_requirements.asset (expected a 0x address)");
 	if (!pr.extra?.name || !pr.extra.version) bad("payment_requirements.extra (name/version)");
 }
+/**
+* Assert an email-native challenge is fully hydrated before signing, so a
+* missing field fails with a named X402Error instead of an opaque error
+* mid-sign. The interaction_id and the challenge step id (the nonce binding's
+* fields) drive both the bound nonce and the payment-step envelope, so they are
+* checked here.
+*/
+function validateEmailChallenge(c) {
+	const bad = (field) => {
+		throw new X402Error(`email challenge is missing or malformed: ${field}`, 0);
+	};
+	if (!c || typeof c !== "object") bad("email challenge");
+	if (!c.interaction_id) bad("interaction_id");
+	const ch = c.challenge;
+	if (!ch || typeof ch !== "object") bad("challenge");
+	if (!ch.expires_at) bad("challenge.expires_at");
+	const nb = ch.nonce_binding;
+	if (!nb?.interaction_id || !nb.challenge_step_id || !nb.challenge_nonce) bad("challenge.nonce_binding");
+	if (nb.interaction_id !== c.interaction_id) bad("interaction_id (mismatch with challenge.nonce_binding.interaction_id)");
+	validatePaymentRequirements(ch.payment_requirements, bad);
+}
 var X402Client = class {
 	#apiKey;
 	#baseUrl;
@@ -24703,6 +26412,99 @@ var X402Client = class {
 		return this.#request("POST", "/v1/x402/challenges", body, { headers: input.idempotencyKey ? { "idempotency-key": input.idempotencyKey } : void 0 });
 	}
 	/**
+	* Issue a payment challenge over an email thread (payee side). Sends the
+	* challenge as an email from `from` to `to` and binds the payment to that
+	* thread. Returns the challenge (including the real `interaction_id`); deliver
+	* it to the payer, who calls `payEmailChallenge` to build the signed payment.
+	*
+	* Provide exactly one of `amount` (base units) or `amountUsdc` (human USDC).
+	*/
+	async createEmailChallenge(input) {
+		for (const key of Object.keys(input)) if (!(key in EMAIL_CHARGE_INPUT_KEYS)) throw new X402Error(`unknown createEmailChallenge() option "${key}"; expected one of: ${Object.keys(EMAIL_CHARGE_INPUT_KEYS).join(", ")}`, 0);
+		if (!input.from) throw new X402Error("createEmailChallenge() requires `from`", 0);
+		if (!input.to) throw new X402Error("createEmailChallenge() requires `to`", 0);
+		if (input.amount !== void 0 && input.amountUsdc !== void 0) throw new X402Error("createEmailChallenge() takes exactly one of `amount` (base units) or `amountUsdc` (human USDC), not both", 0);
+		const amount = input.amountUsdc !== void 0 ? usdcToBaseUnits$1(input.amountUsdc) : input.amount ?? null;
+		if (!amount || !/^[1-9][0-9]{0,38}$/.test(amount)) throw new X402Error("createEmailChallenge() requires `amount` as a positive integer string in token base units (e.g. \"10000\"), or `amountUsdc` as a positive USDC amount with at most 6 decimals (e.g. \"0.01\")", 0);
+		const body = {
+			from: input.from,
+			to: input.to,
+			amount,
+			network: input.network ?? "base-sepolia"
+		};
+		if (input.description) body.description = input.description;
+		if (input.resource) body.resource = input.resource;
+		if (input.expiresIn !== void 0) body.expires_in = input.expiresIn;
+		return this.#request("POST", "/v1/x402/email-challenges", body, { headers: input.idempotencyKey ? { "idempotency-key": input.idempotencyKey } : void 0 });
+	}
+	/**
+	* Build the signed payment step for an email-native challenge (payer side).
+	* Given a received `X402EmailChallenge` and the caller's signer, this derives
+	* the interaction-bound authorization, signs it locally, and returns the
+	* signed `interaction.json` payment-step envelope plus its canonical JSON
+	* bytes. It does NOT send anything.
+	*
+	* The caller sends `result.json` back as an `interaction.json` attachment on a
+	* reply to the challenge email (e.g. via the SDK's `send` / `reply`); the
+	* platform reads the envelope from those exact bytes, re-derives the bound
+	* nonce, and settles.
+	*/
+	async payEmailChallenge(challenge, options) {
+		if (!options?.signer?.address || typeof options.signer.signTypedData !== "function") throw new X402Error("payEmailChallenge() requires options.signer with { address, signTypedData } (e.g. a viem LocalAccount)", 0);
+		validateEmailChallenge(challenge);
+		const details = challenge.challenge;
+		const pr = details.payment_requirements;
+		const network = pr.network;
+		const chainId = CHAIN_IDS[network];
+		if (chainId === void 0) throw new X402Error(`unsupported network: ${network}`, 0);
+		if (pr.scheme !== "exact") throw new X402Error(`unsupported payment scheme: ${pr.scheme}`, 0);
+		const nowSec = Math.floor(Date.now() / 1e3);
+		const expiresAtMs = Date.parse(details.expires_at);
+		if (Number.isNaN(expiresAtMs)) throw new X402Error(`challenge has an invalid expires_at: ${details.expires_at}`, 0);
+		const expiresAtSec = Math.floor(expiresAtMs / 1e3);
+		if (expiresAtSec <= nowSec) throw new X402Error(`challenge has already expired (expires_at ${details.expires_at}); not signing`, 0);
+		let validAfter;
+		let validBefore;
+		try {
+			({validAfter, validBefore} = computePaymentValidityWindow({
+				challengeExpiresAtSec: expiresAtSec,
+				nowSec
+			}));
+		} catch (cause) {
+			throw new X402Error(cause instanceof Error ? cause.message : String(cause), 0, void 0, { cause });
+		}
+		const { authorization, signature } = await signInteractionPayment({
+			sign: (typedData) => options.signer.signTypedData(typedData),
+			payer: options.signer.address,
+			domain: {
+				name: pr.extra.name,
+				version: pr.extra.version,
+				chainId,
+				verifyingContract: pr.asset
+			},
+			payTo: pr.payTo,
+			amount: BigInt(pr.maxAmountRequired),
+			nonceBinding: {
+				interactionId: details.nonce_binding.interaction_id,
+				challengeStepId: details.nonce_binding.challenge_step_id,
+				challengeNonce: details.nonce_binding.challenge_nonce
+			},
+			validAfter,
+			validBefore
+		});
+		const payment = buildExactEvmPaymentPayload({
+			network,
+			authorization,
+			signature
+		});
+		return buildPaymentStepEnvelope({
+			interactionId: challenge.interaction_id,
+			stepId: randomUUID(),
+			prevStepId: details.nonce_binding.challenge_step_id,
+			payment
+		});
+	}
+	/**
 	* Pay a challenge (payer side). Derives the interaction-bound authorization,
 	* signs it locally with the caller's key, and submits it for settlement.
 	*/
@@ -25122,6 +26924,116 @@ var PaymentsPayCommand = class PaymentsPayCommand extends Command {
 	}
 };
 //#endregion
+//#region src/oclif/commands/payments-pay-email-step.ts
+function readEmailChallenge(input) {
+	let raw;
+	if (input.inline !== void 0) raw = input.inline;
+	else if (input.file !== void 0) raw = readFileSync(input.file, "utf8");
+	else {
+		if (process.stdin.isTTY) process.stderr.write("Reading the email challenge JSON from stdin; paste it and press Ctrl-D (or use --challenge / --challenge-file).\n");
+		raw = readFileSync(0, "utf8");
+	}
+	const trimmed = raw.trim();
+	if (!trimmed) throw new Error("no challenge provided; pass --challenge '<json>', --challenge-file <path>, or pipe the email challenge JSON on stdin");
+	let parsed;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		throw new Error("challenge is not valid JSON");
+	}
+	if (parsed && typeof parsed === "object" && "data" in parsed) {
+		const data = parsed.data;
+		if (!data || typeof data !== "object") throw new Error("challenge envelope has no `data` object; pass the email challenge JSON itself or a `{ \"data\": { ... } }` envelope");
+		return data;
+	}
+	return parsed;
+}
+var PaymentsPayEmailStepCommand = class PaymentsPayEmailStepCommand extends Command {
+	static description = `Sign an email-native x402 challenge into a payment-step interaction.json.
+
+  Reads the email challenge the payee issued (the JSON from
+  \`payments create-email-challenge\`), derives and signs the interaction-bound
+  EIP-3009 authorization locally with your wallet key (read from
+  ${PRIVATE_KEY_ENV} by default), and prints the signed \`interaction.json\`
+  payment-step envelope. The key never leaves your machine.
+
+  This command does NOT send the payment. Attach the printed envelope as the
+  \`interaction.json\` part of your reply to the challenge email, for example:
+    primitive payments pay-email-step --challenge-file challenge.json > interaction.json
+    primitive reply --attachment interaction.json
+
+  Provide the challenge inline with --challenge, from a file with
+  --challenge-file, or piped on stdin.`;
+	static summary = "Sign an email x402 challenge into a payment-step envelope";
+	static examples = [
+		"<%= config.bin %> payments pay-email-step --challenge-file challenge.json > interaction.json",
+		"<%= config.bin %> payments pay-email-step --challenge '{\"interaction_id\":\"...\",\"challenge\":{...}}'",
+		"cat challenge.json | <%= config.bin %> payments pay-email-step"
+	];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: API_BASE_URL_FLAG_DESCRIPTION,
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		"private-key": Flags.string({
+			description: PRIVATE_KEY_FLAG_DESCRIPTION,
+			env: PRIVATE_KEY_ENV
+		}),
+		challenge: Flags.string({
+			description: "The email challenge object as a JSON string.",
+			exclusive: ["challenge-file"]
+		}),
+		"challenge-file": Flags.string({
+			description: "Path to a file containing the email challenge JSON.",
+			exclusive: ["challenge"]
+		}),
+		json: Flags.boolean({ description: "Print the full signed envelope object (default prints the interaction.json bytes)." }),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	async run() {
+		const { flags } = await this.parse(PaymentsPayEmailStepCommand);
+		const requestConfig = resolveCliApiRequestConfig({
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		const baseUrlOverridden = requestConfig.baseUrlOverridden;
+		const auth = {
+			apiKey: flags["api-key"],
+			apiBaseUrl: requestConfig.resolvedApiBaseUrl,
+			source: "none",
+			credentials: null
+		};
+		await runWithTiming(flags.time, async () => {
+			const client = createX402Client({
+				apiKey: flags["api-key"] || void 0,
+				baseUrl: x402BaseUrl(requestConfig.resolvedApiBaseUrl)
+			});
+			try {
+				const challenge = readEmailChallenge({
+					inline: flags.challenge,
+					file: flags["challenge-file"]
+				});
+				const signer = signerFromPrivateKey(flags["private-key"] ?? "");
+				const built = await client.payEmailChallenge(challenge, { signer });
+				if (flags.json) this.log(JSON.stringify(built.envelope, null, 2));
+				else this.log(built.json);
+			} catch (error) {
+				reportX402Error(error, {
+					auth,
+					baseUrlOverridden,
+					configDir: this.config.configDir
+				});
+				process.exitCode = 1;
+			}
+		});
+	}
+};
+//#endregion
 //#region src/oclif/commands/payments-register-payout-address.ts
 var PaymentsRegisterPayoutAddressCommand = class PaymentsRegisterPayoutAddressCommand extends Command {
 	static description = `Register the default payout address your org receives x402 payments at.
@@ -26721,7 +28633,8 @@ const COMMANDS = {
 	"payments:register-payout": PaymentsRegisterPayoutAddressCommand,
 	"payments:charge": PaymentsChargeCommand,
 	"payments:pay-challenge": PaymentsPayCommand,
-	"payments:pay": PaymentsPayCommand
+	"payments:pay": PaymentsPayCommand,
+	"payments:pay-email-step": PaymentsPayEmailStepCommand
 };
 //#endregion
 export { CANONICAL_OPERATION_ALIASES, COMMANDS, lookupOperation };