primcli 1.75.0 → 3.0.0-preview.1

package/dist/{scoped-chat-B0thCwME.js → scoped-chat-DZ42V3jq.js}

@@ -1,4 +1,4 @@
-import { b as retryTransient, c as classifySignalContent, q as isTrustedSender } from "./repeats-Dj_o6c-X-LyCkKYjp.js";
+import { b as retryTransient, c as classifySignalContent, q as isTrustedSender } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
 // src/oclif/presence-provenance.ts
 function readPresenceProjection(detail) {
 	if (!detail || typeof detail !== "object") return null;

package/dist/{signal-command-DCPsJBdz.js → signal-command-CRUMUCNa.js}

@@ -1,15 +1,15 @@
-import { Dn as sendEmail, Ft as getEmail, _ as describeApiFailure, cn as listSentEmails, h as sendPreparedSignal, p as prepareSignalEmail, pt as createEndpoint } from "./repeats-Dj_o6c-X-LyCkKYjp.js";
-import { Y as classifySendError, dt as successfulSendOutcome, h as bareAddress, o as extractErrorPayload } from "./api-command-rlS3eTlZ.js";
+import { It as getEmail, Pn as sendEmail, _ as describeApiFailure, h as sendPreparedSignal, hn as listSentEmails, p as prepareSignalEmail, pt as createEndpoint } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
+import { X as classifySendError, ft as successfulSendOutcome, g as bareAddress, o as extractErrorPayload } from "./api-command-ctHBqTL5.js";
 import { recordSentSignal } from "./oclif/auto-signals.js";
 import { _ as acquireListenLock, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, x as listenProcessIdentity, y as listenIdentity } from "./shared-mail-files-BAQSGxxz.js";
-import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-B0thCwME.js";
+import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-DZ42V3jq.js";
 import { n as tryOwnSharedMail, r as waitForSharedMailChange, t as readSharedMailOwner } from "./shared-mail-watch-BAPMsFNv.js";
 import { Errors } from "@oclif/core";
 import { opendirSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
 import { dirname, join } from "node:path";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-// ../sdk-node/dist/api-D7-k6yPG.js
+// ../sdk-node/dist/api-BKmwTTyX.js
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
 	let lastEventId;
@@ -613,7 +613,7 @@ const pullWebhookEvent = (options) => (options.client ?? client$1).post({
 /**
 * Report the outcome of a local webhook delivery attempt
 *
-* Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
+* Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; sdk includes accepted (and optional timeout/io transport_error); http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
 */
 const completeWebhookEvent = (options) => (options.client ?? client$1).post({
 	security: [{
@@ -652,9 +652,9 @@ function validateOffer(value) {
 		"delivery_id",
 		"lease_token",
 		"event_type",
-		"body",
 		"lease_expires_at"
-	].every((key) => typeof d[key] === "string") || !Number.isFinite(Date.parse(String(d.lease_expires_at))) || !record$1(d.headers) || !Object.values(d.headers).every((header) => typeof header === "string"))) throw new EventReceiverError("Invalid event delivery response", "invalid_response");
+	].every((key) => typeof d[key] === "string") || d.body !== null && d.body !== void 0 && typeof d.body !== "string" || !Number.isFinite(Date.parse(String(d.lease_expires_at))) || !record$1(d.headers) || !Object.values(d.headers).every((header) => typeof header === "string"))) throw new EventReceiverError("Invalid event delivery response", "invalid_response");
+	if (d !== null && d.body === void 0) d.body = null;
 	return value;
 }
 function retryAfter(value) {
@@ -1928,6 +1928,7 @@ async function runSharedMailTransport(options) {
 			const delivery = offer.delivery;
 			if (!delivery) continue;
 			const started = performance.now();
+			if (delivery.body === null) throw invalid$1("The API withheld this event's content from the listening credential.");
 			let body;
 			try {
 				body = JSON.parse(delivery.body);
@@ -2219,7 +2220,7 @@ async function sendSignal(context, options) {
 		to: context.identity.agentAddress,
 		messageId: detail.message_id,
 		subject: detail.subject ?? null,
-		references: detail.parsed.references ?? []
+		references: detail.parsed?.references ?? []
 	};
 	const key = createHash("sha256").update(JSON.stringify([
 		scope,

package/man/primitive.1

@@ -190,6 +190,40 @@ Run
 .B primitive logout --force
 to remove local credentials, pending email-code auth state, and stale credential locks without contacting Primitive.
 .PP
+Where the server supports it, browser login logs you in as yourself. Run
+.B primitive orgs
+to list your organizations and whether the CLI may be used in each, and
+.B primitive org use ORG
+to switch by name or id. Pass
+.B --org ORG
+to any command, or set
+.BR PRIMITIVE_CLI_ORG ,
+to act in another organization for that command.
+.B primitive memories
+keeps its own boolean
+.B --org
+flag. A login saved by an earlier CLI, an API key and a connected agent
+profile are bound to one organization and refuse a different one.
+.PP
+Run
+.B primitive keys list
+to list API key metadata; it never shows a secret. API keys are created,
+rotated and revoked in the dashboard for now. CLI commands for this are
+planned.
+.B primitive whoami --check PERMISSION
+reports whether the current credential may use a permission.
+.PP
+Run
+.B primitive org leave
+to leave the organization you are signed in to. It asks for confirmation first;
+pass --yes to skip the prompt in scripts. Leaving is final. Only a person
+signed in with
+.B primitive login
+can leave; API keys are refused. The only owner of an organization cannot leave
+it. If the server asks for a dashboard confirmation, open the page it names and
+paste the token at the prompt, or pass it with --step-up-token. Refusals from
+the server are printed as returned.
+.PP
 Run
 .B primitive whoami
 to verify account authentication. With PRIMITIVE_AGENT_PROFILE selected, it

package/package.json

@@ -1,9 +1,22 @@
 {
   "name": "primcli",
-  "version": "1.75.0",
+  "version": "3.0.0-preview.1",
+  "publishConfig": {
+    "tag": "preview"
+  },
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,
+  "exports": {
+    "./receiver": {
+      "types": "./dist/receiver.d.ts",
+      "default": "./dist/receiver.js"
+    },
+    "./package.json": "./package.json",
+    "./bin/*": "./bin/*",
+    "./dist/*": "./dist/*",
+    "./man/*": "./man/*"
+  },
   "files": [
     "bin",
     "dist",
@@ -69,9 +82,6 @@
       "domains": {
         "description": "Claim, verify, manage email domains, and download DNS zone files"
       },
-      "registries": {
-        "description": "Create and manage agent registries, publish and resolve agents by handle, and moderate publication requests"
-      },
       "network": {
         "description": "Discover same-organization agents by email address and manage default network visibility. Use `primitive network` to see the commands."
       },
@@ -128,13 +138,49 @@
         "description": "Browse and install Function templates. Use `primitive templates list-templates`, `primitive templates get-template`, `primitive templates install-template`, and `primitive templates get-template-install`."
       },
       "org": {
-        "description": "Manage org-level (global) resources shared across functions"
+        "description": "Switch the CLI between your organizations (`primitive org use <org>`, list them with `primitive orgs`), manage org-level (global) resources shared across functions, or leave the organization"
       },
       "org:secrets": {
         "description": "Global secrets shared across every function. Use `primitive org secrets list|set|remove`. Changes land in a function on its next redeploy; a function secret of the same name overrides the global."
       },
-      "payments": {
-        "description": "Collect and pay x402 stablecoin (USDC) payments. Start with `primitive payments register-payout-address`, then `primitive payments create-challenge` to request a payment and `primitive payments pay` to settle one. Settlement is non-custodial; signing happens locally with your wallet key. Manage caps with `primitive payments get-policy|update-spend-policy`."
+      "keys": {
+        "description": "List organization API keys (metadata only, never secrets) with `primitive keys list`. API keys are created, rotated and revoked in the dashboard for now. CLI commands for this are planned."
+      },
+      "roles": {
+        "description": "Read roles, groups, mailbox access and the access mode. Use `primitive roles list|groups|mailbox-access|access-mode`; generated API names remain available."
+      },
+      "projects": {
+        "description": "Organization people, shared projects and project invitations"
+      },
+      "organizations": {
+        "description": "Organization invitations"
+      },
+      "mailbox-access": {
+        "description": "Who may read, draft and send for each mailbox, and the groups access can be given to"
+      },
+      "credentials": {
+        "description": "API keys, the credential inventory, the credential audit trail and the credential policy"
+      },
+      "organization-settings": {
+        "description": "Your connected apps and CLI logins, the organization's connected apps, name, logo, search settings and billing"
+      },
+      "roles-and-members": {
+        "description": "Roles, member roles and removal, the mailbox access mode, break-glass, transfers and suspensions, and leaving the organization"
+      },
+      "agent-work": {
+        "description": "Agent work records: create, list and read them, report status, and propose, agree or withdraw deadlines"
+      },
+      "address-notes": {
+        "description": "Private organization notes and public JSON notes about email addresses"
+      },
+      "interactions": {
+        "description": "Typed multi-step protocols carried over email between agents"
+      },
+      "stats": {
+        "description": "Received and sent mail per hour, and how webhook deliveries ended"
+      },
+      "email-rules": {
+        "description": "Rules written in plain English that pick out received mail"
       },
       "routes": {
         "description": "Manage recipient routes. Bind an address pattern to an endpoint or function: `primitive routes add alice@d --function <id>`, `primitive routes list`, `primitive routes test <recipient>`, `primitive routes remove <id>`."
@@ -201,7 +247,6 @@
     "@oclif/plugin-autocomplete": "^4.0.6",
     "@oclif/plugin-help": "^7.0.4",
     "@oclif/plugin-warn-if-update-available": "^4.0.1",
-    "viem": "^2.57.14",
     "ws": "^8.22.0"
   },
   "devDependencies": {