primcli 1.74.1 → 3.0.0-preview.1

package/dist/{scoped-chat-DAiOb622.js → scoped-chat-DZ42V3jq.js}

@@ -1,5 +1,5 @@
-import { b as retryTransient, c as classifySignalContent, q as isTrustedSender } from "./repeats-BL7ZC-_6-B_ESsWTH.js";
-//#region src/oclif/presence-provenance.ts
+import { b as retryTransient, c as classifySignalContent, q as isTrustedSender } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
+// src/oclif/presence-provenance.ts
 function readPresenceProjection(detail) {
 	if (!detail || typeof detail !== "object") return null;
 	const value = detail.presence_control;
@@ -24,8 +24,7 @@ function presenceDisposition(detail) {
 	const proof = readPresenceProjection(detail);
 	return !proof || proof.status === "rejected" ? "ordinary" : proof.status === "verified" ? "quiet" : "pending";
 }
-//#endregion
-//#region src/oclif/scoped-chat.ts
+// src/oclif/scoped-chat.ts
 function isConnectedChatCredential(apiKey) {
 	return apiKey?.startsWith("pconn_") ?? false;
 }
@@ -96,5 +95,4 @@ function isPlainChatReply(detail) {
 		canonicalPartBytes: null
 	}).classification === "plain";
 }
-//#endregion
 export { readBeforeDeadline as a, readPresenceProjection as c, readApiBeforeDeadline as i, isPlainChatReply as n, scopedChatSenderTrust as o, isScopedChatReply as r, presenceDisposition as s, isConnectedChatCredential as t };

package/dist/{shared-mail-files-CZfm7E2k.js → shared-mail-files-BAQSGxxz.js}

@@ -3,7 +3,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { dirname, join, win32 } from "node:path";
 import { setTimeout } from "node:timers/promises";
 import { execFileSync } from "node:child_process";
-//#region src/oclif/listen-state.ts
+// src/oclif/listen-state.ts
 var ListenStateError = class extends Error {};
 function normalizeListenOrigin(value) {
 	const url = new URL(value);
@@ -247,8 +247,7 @@ function resolveListenSubscription(configDir, identity, explicit) {
 		release: acquireListenLock(directory, `subscription:${name}`)
 	};
 }
-//#endregion
-//#region src/oclif/shared-mail-files.ts
+// src/oclif/shared-mail-files.ts
 var SharedMailStateError = class extends ListenStateError {};
 const invalidSharedMail = () => new SharedMailStateError("Shared mail state is invalid or inconsistent. Preserve it before retrying to avoid duplicate delivery.");
 function privateMailPermissions(info, platform = process.platform) {
@@ -371,5 +370,4 @@ function mailTime(value) {
 	if (!Number.isFinite(Date.parse(time))) throw invalidSharedMail();
 	return new Date(time).toISOString();
 }
-//#endregion
 export { resolveListenSubscription as C, normalizeListenOrigin as S, acquireListenLock as _, mailLockBusy as a, listenLockHeld as b, mailTime as c, readMailJson as d, removeMailFile as f, ListenStateError as g, writeMailJson as h, mailId as i, privateMailDirectory as l, withMailLock as m, invalidSharedMail as n, mailObject as o, syncMailDirectory as p, mailAddress as r, mailString as s, SharedMailStateError as t, privateMailPermissions as u, compareListenProcessIdentity as v, listenProcessIdentity as x, listenIdentity as y };

package/dist/{shared-mail-watch-DyQB0MK0.js → shared-mail-watch-BAPMsFNv.js}

@@ -1,8 +1,8 @@
-import { _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, n as invalidSharedMail, o as mailObject, s as mailString, v as compareListenProcessIdentity, x as listenProcessIdentity } from "./shared-mail-files-CZfm7E2k.js";
+import { _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, n as invalidSharedMail, o as mailObject, s as mailString, v as compareListenProcessIdentity, x as listenProcessIdentity } from "./shared-mail-files-BAQSGxxz.js";
 import { watch } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
-//#region src/oclif/shared-mail-watch.ts
+// src/oclif/shared-mail-watch.ts
 function ownerRecord(value) {
 	const o = mailObject(value, [
 		"generation",
@@ -141,5 +141,4 @@ function waitForSharedMailChange(store, options) {
 		}
 	});
 }
-//#endregion
 export { tryOwnSharedMail as n, waitForSharedMailChange as r, readSharedMailOwner as t };

package/dist/{signal-command-Cte4mAL3.js → signal-command-CRUMUCNa.js}

@@ -1,15 +1,15 @@
-import { Dn as sendEmail, Ft as getEmail, _ as describeApiFailure, cn as listSentEmails, h as sendPreparedSignal, p as prepareSignalEmail, pt as createEndpoint } from "./repeats-BL7ZC-_6-B_ESsWTH.js";
-import { _ as acquireListenLock, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, x as listenProcessIdentity, y as listenIdentity } from "./shared-mail-files-CZfm7E2k.js";
-import { Y as classifySendError, dt as successfulSendOutcome, h as bareAddress, o as extractErrorPayload } from "./api-command-fKP3NYa7.js";
-import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-DAiOb622.js";
-import { n as tryOwnSharedMail, r as waitForSharedMailChange, t as readSharedMailOwner } from "./shared-mail-watch-DyQB0MK0.js";
+import { It as getEmail, Pn as sendEmail, _ as describeApiFailure, h as sendPreparedSignal, hn as listSentEmails, p as prepareSignalEmail, pt as createEndpoint } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
+import { X as classifySendError, ft as successfulSendOutcome, g as bareAddress, o as extractErrorPayload } from "./api-command-ctHBqTL5.js";
 import { recordSentSignal } from "./oclif/auto-signals.js";
+import { _ as acquireListenLock, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, x as listenProcessIdentity, y as listenIdentity } from "./shared-mail-files-BAQSGxxz.js";
+import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-DZ42V3jq.js";
+import { n as tryOwnSharedMail, r as waitForSharedMailChange, t as readSharedMailOwner } from "./shared-mail-watch-BAPMsFNv.js";
 import { Errors } from "@oclif/core";
 import { opendirSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
 import { dirname, join } from "node:path";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-//#region ../sdk-node/dist/api-DcpEJV3m.js
+// ../sdk-node/dist/api-BKmwTTyX.js
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
 	let lastEventId;
@@ -613,7 +613,7 @@ const pullWebhookEvent = (options) => (options.client ?? client$1).post({
 /**
 * Report the outcome of a local webhook delivery attempt
 *
-* Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
+* Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; sdk includes accepted (and optional timeout/io transport_error); http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
 */
 const completeWebhookEvent = (options) => (options.client ?? client$1).post({
 	security: [{
@@ -652,9 +652,9 @@ function validateOffer(value) {
 		"delivery_id",
 		"lease_token",
 		"event_type",
-		"body",
 		"lease_expires_at"
-	].every((key) => typeof d[key] === "string") || !Number.isFinite(Date.parse(String(d.lease_expires_at))) || !record$1(d.headers) || !Object.values(d.headers).every((header) => typeof header === "string"))) throw new EventReceiverError("Invalid event delivery response", "invalid_response");
+	].every((key) => typeof d[key] === "string") || d.body !== null && d.body !== void 0 && typeof d.body !== "string" || !Number.isFinite(Date.parse(String(d.lease_expires_at))) || !record$1(d.headers) || !Object.values(d.headers).every((header) => typeof header === "string"))) throw new EventReceiverError("Invalid event delivery response", "invalid_response");
+	if (d !== null && d.body === void 0) d.body = null;
 	return value;
 }
 function retryAfter(value) {
@@ -842,8 +842,7 @@ var EventConnection = class {
 		if (!record$1(receipt) || !["completed", "already_completed"].includes(String(receipt.result))) throw new EventReceiverError("Invalid event receipt", "invalid_response");
 	}
 };
-//#endregion
-//#region src/oclif/email-participants.ts
+// src/oclif/email-participants.ts
 /**
 * Everyone else an email was addressed to: its parsed To and Cc, as bare
 * lowercase addresses, without `self` (the mailbox reading it) or the sender,
@@ -878,8 +877,7 @@ function otherParticipants(detail, self) {
 	}
 	return named ? out : [];
 }
-//#endregion
-//#region src/oclif/conversation-follow.ts
+// src/oclif/conversation-follow.ts
 function directory(context) {
 	const key = createHash("sha256").update(JSON.stringify([context.scope, mailAddress(context.recipient)])).digest("hex");
 	return join(context.configDir, "conversation-follows", key);
@@ -943,8 +941,7 @@ async function followEmailConversation(context, detail) {
 		return follow;
 	});
 }
-//#endregion
-//#region src/oclif/shared-mail-state.ts
+// src/oclif/shared-mail-state.ts
 function createSharedMailWaiter() {
 	return {
 		token: randomUUID(),
@@ -1830,8 +1827,7 @@ async function openSharedMailStore(options) {
 		}
 	};
 }
-//#endregion
-//#region src/oclif/listen-credential.ts
+// src/oclif/listen-credential.ts
 /** The API's code for an account credential creating a pull subscription. */
 const AGENT_CONNECTION_REQUIRED = "pull_subscription_requires_agent_connection";
 const AGENT_CONNECTION_REQUIRED_MESSAGE = "primitive listen needs a connected agent credential, which limits the subscription to one address. Connect one with primitive agent connect and select its profile. With an account API key, watch mail with primitive emails watch or receive it at an HTTP webhook endpoint instead.";
@@ -1839,8 +1835,7 @@ const AGENT_CONNECTION_REQUIRED_MESSAGE = "primitive listen needs a connected ag
 function isConnectedAgentKey(apiKey) {
 	return apiKey?.startsWith("pconn_") === true;
 }
-//#endregion
-//#region src/oclif/shared-mail-transport.ts
+// src/oclif/shared-mail-transport.ts
 function invalid$1(message) {
 	return new EventReceiverError(message, "invalid_response");
 }
@@ -1933,6 +1928,7 @@ async function runSharedMailTransport(options) {
 			const delivery = offer.delivery;
 			if (!delivery) continue;
 			const started = performance.now();
+			if (delivery.body === null) throw invalid$1("The API withheld this event's content from the listening credential.");
 			let body;
 			try {
 				body = JSON.parse(delivery.body);
@@ -1967,8 +1963,7 @@ async function runSharedMailTransport(options) {
 		stream.close();
 	}
 }
-//#endregion
-//#region src/oclif/shared-mail-receiver.ts
+// src/oclif/shared-mail-receiver.ts
 function sharedMailScope(apiKey, baseUrl) {
 	if (!apiKey?.startsWith("pconn_")) throw new Error("Shared mail receiving requires connected credentials.");
 	return listenIdentity(baseUrl, `connection:${scryptSync(apiKey, "primitive-listener-identity-v1", 32).toString("hex")}`);
@@ -2083,8 +2078,7 @@ async function openSharedMailReceiver(options) {
 		}
 	};
 }
-//#endregion
-//#region src/oclif/reconcile-chat-send.ts
+// src/oclif/reconcile-chat-send.ts
 /** Lookup only. An empty result never authorizes another send. */
 async function reconcileChatSend(params) {
 	const result = await readApiBeforeDeadline(params.deadline, (signal) => listSentEmails({
@@ -2105,8 +2099,7 @@ async function reconcileChatSend(params) {
 	if (sent.client_idempotency_key !== params.idempotencyKey || typeof sent.from_address !== "string" || sent.from_address.trim().toLowerCase() !== params.from.trim().toLowerCase() || typeof sent.to_address !== "string" || sent.to_address.trim().toLowerCase() !== params.recipient.trim().toLowerCase() || typeof sent.id !== "string" || !sent.id) throw new Errors.CLIError("The saved send lookup returned conflicting identity metadata. Inspect the existing send before retrying.", { exit: 1 });
 	return sent;
 }
-//#endregion
-//#region src/oclif/signal-command.ts
+// src/oclif/signal-command.ts
 const sendStatuses = /* @__PURE__ */ new Set([
 	"queued",
 	"submitted_to_agent",
@@ -2227,7 +2220,7 @@ async function sendSignal(context, options) {
 		to: context.identity.agentAddress,
 		messageId: detail.message_id,
 		subject: detail.subject ?? null,
-		references: detail.parsed.references ?? []
+		references: detail.parsed?.references ?? []
 	};
 	const key = createHash("sha256").update(JSON.stringify([
 		scope,
@@ -2345,5 +2338,4 @@ async function sendSignal(context, options) {
 		release();
 	}
 }
-//#endregion
 export { ensureSharedMailSubscription as a, isConnectedAgentKey as c, reserveSharedMailSubscription as d, followEmailConversation as f, EventReceiverError as g, EventConnection as h, sharedMailScope as i, createSharedMailWaiter as l, otherParticipants as m, reconcileChatSend as n, AGENT_CONNECTION_REQUIRED as o, readConversationFollow as p, openSharedMailReceiver as r, AGENT_CONNECTION_REQUIRED_MESSAGE as s, sendSignal as t, openSharedMailStore as u };

package/dist/skills/primitive-connect/references/connect.md

@@ -61,7 +61,9 @@ Add `--contact-requests` only when the owner asked this address to receive
 first-contact requests from unknown senders. Add `--name "<short name>"` and
 `--info "<role and useful capabilities>"` to seed this address's private
 `AGENT_INFO` note for peers; an existing note is never overwritten, and the text
-must not contain secrets or transcript content.
+must not contain secrets or transcript content. Other connected agents in the
+organization can read your `AGENT_INFO`, `AGENT_WORKING` and `AGENT_RUNTIME`
+notes, but not your other notes.
 
 Do not install the skill separately, check the CLI version, read command help,
 start a listener or write `AGENT_INFO` yourself; the command does each of these

package/dist/skills/primitive-connect/references/contacts.md

@@ -65,11 +65,16 @@ sender able to see peers and the recipient listed;
 the sender need not be listed and the recipient need not see peers. Explicit
 silence overrides network wake. Known-address email remains separate.
 Inspect names, addresses, and last recorded activity, which is not proof of a
-running receiver. If several agents match, read `AGENT_INFO`, `AGENT_USES`, and
-`AGENT_WORKING` for plausible peers with `GET /address-notes?address=<agent-address>`
-(CLI: `primitive agent notes get <name> --address <agent-address>`) before choosing
+running receiver. If several agents match, read `AGENT_INFO` and `AGENT_WORKING`
+for plausible peers with `GET /address-notes?address=<agent-address>` (CLI:
+`primitive agent notes get AGENT_INFO --address <agent-address>` and
+`primitive agent working get --address <agent-address>`) before choosing
 whom to email. Ask the owner only if the choice remains ambiguous. These notes
-may be stale and do not grant task authority. Keep your own `AGENT_WORKING`
+may be stale and do not grant task authority. From a connected agent, the
+notes of another agent in its organization are limited to `AGENT_INFO`,
+`AGENT_WORKING` and `AGENT_RUNTIME`. Reading any other note there returns 403,
+which does not mean the note is absent, and list reads leave those notes out.
+Keep your own `AGENT_WORKING`
 note in the claim form described under [Collaborate with other
 agents](collaboration.md), not as a running log. Existing profiles may seed
 `AGENT_INFO` once if absent, as in [Manual and HTTP

package/dist/skills/primitive-connect.json

@@ -1,10 +1,10 @@
 {
   "name": "primitive-connect",
-  "version": "38229bc689e6b37b",
+  "version": "078bd8f84619ab6c",
   "source": {
     "repository": "https://github.com/primitivedotdev/skills",
     "path": "skills/primitive-connect",
-    "commit": "a737d72b70ad813a5539a3f492546da52998ec0e"
+    "commit": "46bd9ca38d9edea664d78d08a4cae0a8536438b3"
   },
   "files": {
     "SKILL.md": "37d40b66010319c6a176bc8eb66affd93cab0968c609ad523dac087d3077d29d",
@@ -12,9 +12,9 @@
     "package.json": "3ea7cf130139b3106b3e4909032bc53571e6e4cdbde48ab572262e3b4a250ca4",
     "references/collaboration.md": "b9c599bf66ae58ea8c779cdceddb11882cc9f0da2fba0e4ca363ad8d01d64d5b",
     "references/communication.md": "d9599e3c563a4cd1c7dd658f730306b669f7ad6522b3632dc55fd5feee60cd30",
-    "references/connect.md": "dc39fb8bbaffa69e30a3895f195beb12cfc95c991140ab5a7adb6e1e3293272a",
+    "references/connect.md": "46d3e62e6b021100a0ddf84269bcb59a1725a3da4e360c797f378ce13cf5c4ec",
     "references/contact-requests.md": "a6afb51ec2cd0bf807095e034942c6e81c82c8b8489a3e2464cd8ce9f4c28d43",
-    "references/contacts.md": "11af5638bd4799f10bfa6fdc1c1cebf90db7c8a43d4ed5498b96c14779f1a482",
+    "references/contacts.md": "f85c7feea0e426f4f33b45df25016130b5766265fe10cdbe79d6cd8c45361763",
     "references/conversations.md": "c8a1125db76e40e8bf2e550223e4d4e1a86536ca43ccdd835024f6d6502098a7",
     "references/external-services.md": "211e03cec546d2f83c78bd38985cc64203272df47eb52cf1bdce885bceee3089",
     "references/manual-setup.md": "433f111c425cb976d153e22c851064e2e730f45229d8747ec91827f3a76b5d0e",

package/man/primitive.1

@@ -12,6 +12,10 @@ primitive \- command line interface for Primitive email and Functions
 .B primitive
 .I command
 .B --help
+.br
+.B primitive
+.I command
+.B --help-full
 .SH DESCRIPTION
 .B primitive
 is the command line interface for Primitive. It sends mail, inspects inbound and outbound email, manages domains and webhook endpoints, deploys Primitive Functions, and exposes generated API operations for scripting.
@@ -116,7 +120,7 @@ The generated commands
 and
 .B endpoints complete-webhook-event
 expose local webhook delivery on API hosts where it is enabled. Each command
-makes one API request. Use their --help output for the input fields. Consumers
+makes one API request. Use their --help-full output for the input fields. Consumers
 deduplicate event IDs and report the outcome with the returned attempt and lease.
 Queue retention does not extend source-content retention; inspect gap counts.
 .SH AGENT LOOP
@@ -186,6 +190,40 @@ Run
 .B primitive logout --force
 to remove local credentials, pending email-code auth state, and stale credential locks without contacting Primitive.
 .PP
+Where the server supports it, browser login logs you in as yourself. Run
+.B primitive orgs
+to list your organizations and whether the CLI may be used in each, and
+.B primitive org use ORG
+to switch by name or id. Pass
+.B --org ORG
+to any command, or set
+.BR PRIMITIVE_CLI_ORG ,
+to act in another organization for that command.
+.B primitive memories
+keeps its own boolean
+.B --org
+flag. A login saved by an earlier CLI, an API key and a connected agent
+profile are bound to one organization and refuse a different one.
+.PP
+Run
+.B primitive keys list
+to list API key metadata; it never shows a secret. API keys are created,
+rotated and revoked in the dashboard for now. CLI commands for this are
+planned.
+.B primitive whoami --check PERMISSION
+reports whether the current credential may use a permission.
+.PP
+Run
+.B primitive org leave
+to leave the organization you are signed in to. It asks for confirmation first;
+pass --yes to skip the prompt in scripts. Leaving is final. Only a person
+signed in with
+.B primitive login
+can leave; API keys are refused. The only owner of an organization cannot leave
+it. If the server asks for a dashboard confirmation, open the page it names and
+paste the token at the prompt, or pass it with --step-up-token. Refusals from
+the server are printed as returned.
+.PP
 Run
 .B primitive whoami
 to verify account authentication. With PRIMITIVE_AGENT_PROFILE selected, it
@@ -345,8 +383,11 @@ Use an explicit Primitive API key for this command.
 .B --time
 Print command duration to standard error after completion.
 .TP
-.B --help
-Show command help.
+.B -h, --help
+Show short command help: a summary, usage, one line per flag, and two examples.
+.TP
+.B --help-full
+Show the complete command help, with full flag descriptions and every example.
 .SH EXIT STATUS
 .B primitive chat,
 .B primitive chat reply,

package/package.json

@@ -1,9 +1,22 @@
 {
   "name": "primcli",
-  "version": "1.74.1",
+  "version": "3.0.0-preview.1",
+  "publishConfig": {
+    "tag": "preview"
+  },
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,
+  "exports": {
+    "./receiver": {
+      "types": "./dist/receiver.d.ts",
+      "default": "./dist/receiver.js"
+    },
+    "./package.json": "./package.json",
+    "./bin/*": "./bin/*",
+    "./dist/*": "./dist/*",
+    "./man/*": "./man/*"
+  },
   "files": [
     "bin",
     "dist",
@@ -18,6 +31,11 @@
   ],
   "oclif": {
     "bin": "primitive",
+    "helpClass": "./dist/oclif/help.js",
+    "additionalHelpFlags": [
+      "-h",
+      "--help-full"
+    ],
     "commands": {
       "strategy": "explicit",
       "target": "./dist/oclif/index.js",
@@ -64,9 +82,6 @@
       "domains": {
         "description": "Claim, verify, manage email domains, and download DNS zone files"
       },
-      "registries": {
-        "description": "Create and manage agent registries, publish and resolve agents by handle, and moderate publication requests"
-      },
       "network": {
         "description": "Discover same-organization agents by email address and manage default network visibility. Use `primitive network` to see the commands."
       },
@@ -123,13 +138,49 @@
         "description": "Browse and install Function templates. Use `primitive templates list-templates`, `primitive templates get-template`, `primitive templates install-template`, and `primitive templates get-template-install`."
       },
       "org": {
-        "description": "Manage org-level (global) resources shared across functions"
+        "description": "Switch the CLI between your organizations (`primitive org use <org>`, list them with `primitive orgs`), manage org-level (global) resources shared across functions, or leave the organization"
       },
       "org:secrets": {
         "description": "Global secrets shared across every function. Use `primitive org secrets list|set|remove`. Changes land in a function on its next redeploy; a function secret of the same name overrides the global."
       },
-      "payments": {
-        "description": "Collect and pay x402 stablecoin (USDC) payments. Start with `primitive payments register-payout-address`, then `primitive payments create-challenge` to request a payment and `primitive payments pay` to settle one. Settlement is non-custodial; signing happens locally with your wallet key. Manage caps with `primitive payments get-policy|update-spend-policy`."
+      "keys": {
+        "description": "List organization API keys (metadata only, never secrets) with `primitive keys list`. API keys are created, rotated and revoked in the dashboard for now. CLI commands for this are planned."
+      },
+      "roles": {
+        "description": "Read roles, groups, mailbox access and the access mode. Use `primitive roles list|groups|mailbox-access|access-mode`; generated API names remain available."
+      },
+      "projects": {
+        "description": "Organization people, shared projects and project invitations"
+      },
+      "organizations": {
+        "description": "Organization invitations"
+      },
+      "mailbox-access": {
+        "description": "Who may read, draft and send for each mailbox, and the groups access can be given to"
+      },
+      "credentials": {
+        "description": "API keys, the credential inventory, the credential audit trail and the credential policy"
+      },
+      "organization-settings": {
+        "description": "Your connected apps and CLI logins, the organization's connected apps, name, logo, search settings and billing"
+      },
+      "roles-and-members": {
+        "description": "Roles, member roles and removal, the mailbox access mode, break-glass, transfers and suspensions, and leaving the organization"
+      },
+      "agent-work": {
+        "description": "Agent work records: create, list and read them, report status, and propose, agree or withdraw deadlines"
+      },
+      "address-notes": {
+        "description": "Private organization notes and public JSON notes about email addresses"
+      },
+      "interactions": {
+        "description": "Typed multi-step protocols carried over email between agents"
+      },
+      "stats": {
+        "description": "Received and sent mail per hour, and how webhook deliveries ended"
+      },
+      "email-rules": {
+        "description": "Rules written in plain English that pick out received mail"
       },
       "routes": {
         "description": "Manage recipient routes. Bind an address pattern to an endpoint or function: `primitive routes add alice@d --function <id>`, `primitive routes list`, `primitive routes test <recipient>`, `primitive routes remove <id>`."
@@ -192,25 +243,24 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@oclif/core": "^5.1.7",
-    "@oclif/plugin-autocomplete": "^4.0.4",
+    "@oclif/core": "^5.1.11",
+    "@oclif/plugin-autocomplete": "^4.0.6",
     "@oclif/plugin-help": "^7.0.4",
     "@oclif/plugin-warn-if-update-available": "^4.0.1",
-    "viem": "^2.57.7",
     "ws": "^8.22.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.5.15",
+    "@biomejs/biome": "^2.6.4",
     "@primitivedotdev/api-core": "workspace:*",
     "@primitivedotdev/sdk": "workspace:*",
-    "@types/node": "^26.6.5",
+    "@types/node": "^26.6.6",
     "@types/ws": "^8.18.2",
     "@vitest/coverage-v8": "^5.0.5",
-    "oclif": "^6.0.10",
-    "tsdown": "^0.23.1",
+    "oclif": "^6.0.15",
+    "tsdown": "^0.23.4",
     "tsx": "4.23.14",
     "typescript": "^5.7.2",
-    "vite": "^8.3.4",
+    "vite": "^8.3.5",
     "vitest": "^5.0.5"
   }
 }