primcli 1.9.0 → 1.11.0

package/README.md

@@ -93,6 +93,9 @@ primitive payments pay --challenge-file challenge.json
 cat challenge.json | primitive payments pay
 
 # Email-native flow: the payee issues a challenge over an email thread.
+# Note: create-email-challenge takes --amount in token base units only; unlike
+# `charge` it has no --amount-usdc. USDC has 6 decimals, so multiply by
+# 1,000,000: 0.01 USDC is --amount 10000.
 primitive payments create-email-challenge --from payee@your-domain.example \
   --to payer@their-domain.example --amount 10000 --network base-sepolia
 # Payer: sign a received email challenge into an interaction.json payment step.

package/dist/oclif/index.js

@@ -4629,7 +4629,8 @@ const openapiDocument = {
 				"name": "slug",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry slug."
 			}],
 			"get": {
 				"operationId": "listRegistryAgents",
@@ -4644,7 +4645,8 @@ const openapiDocument = {
 						"type": "integer",
 						"minimum": 1,
 						"maximum": 200
-					}
+					},
+					"description": "Maximum number of items to return (1-200)."
 				}, {
 					"name": "cursor",
 					"in": "query",
@@ -4690,12 +4692,14 @@ const openapiDocument = {
 				"name": "slug",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry slug."
 			}, {
 				"name": "handle",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry-scoped handle the agent is published under."
 			}],
 			"get": {
 				"operationId": "resolveRegistryHandle",
@@ -4726,7 +4730,8 @@ const openapiDocument = {
 				"name": "slug",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry slug."
 			}],
 			"get": {
 				"operationId": "listRegistryRequests",
@@ -4740,7 +4745,8 @@ const openapiDocument = {
 						"type": "integer",
 						"minimum": 1,
 						"maximum": 200
-					}
+					},
+					"description": "Maximum number of items to return (1-200)."
 				}],
 				"responses": {
 					"200": {
@@ -4760,7 +4766,8 @@ const openapiDocument = {
 				"name": "slug",
 				"in": "path",
 				"required": true,
-				"schema": { "type": "string" }
+				"schema": { "type": "string" },
+				"description": "The registry slug."
 			}, { "$ref": "#/components/parameters/ResourceId" }],
 			"post": {
 				"operationId": "decideRegistryRequest",
@@ -5531,7 +5538,7 @@ const openapiDocument = {
 					"amount": {
 						"type": "string",
 						"pattern": "^[1-9][0-9]{0,38}$",
-						"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
+						"description": "Amount to collect, in token base units (unlike the `charge` CLI\ncommand, which also accepts `--amount-usdc`, this field takes base\nunits only). USDC has 6 decimals, so `\"10000\"` is 0.01 USDC:\nmultiply a human USDC amount by 1,000,000 (0.01 USDC -> `\"10000\"`).\n"
 					},
 					"network": {
 						"type": "string",
@@ -5541,7 +5548,7 @@ const openapiDocument = {
 						"type": "integer",
 						"minimum": 60,
 						"maximum": 86400,
-						"description": "Seconds until the challenge expires. Defaults to 3600."
+						"description": "Seconds until the challenge expires. Defaults to 300."
 					},
 					"resource": {
 						"type": "string",
@@ -15478,7 +15485,7 @@ const operationManifest = [
 				"amount": {
 					"type": "string",
 					"pattern": "^[1-9][0-9]{0,38}$",
-					"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
+					"description": "Amount to collect, in token base units (unlike the `charge` CLI\ncommand, which also accepts `--amount-usdc`, this field takes base\nunits only). USDC has 6 decimals, so `\"10000\"` is 0.01 USDC:\nmultiply a human USDC amount by 1,000,000 (0.01 USDC -> `\"10000\"`).\n"
 				},
 				"network": {
 					"type": "string",
@@ -15488,7 +15495,7 @@ const operationManifest = [
 					"type": "integer",
 					"minimum": 60,
 					"maximum": 86400,
-					"description": "Seconds until the challenge expires. Defaults to 3600."
+					"description": "Seconds until the challenge expires. Defaults to 300."
 				},
 				"resource": {
 					"type": "string",
@@ -16292,7 +16299,7 @@ const operationManifest = [
 		"operationId": "decideRegistryRequest",
 		"path": "/registries/{slug}/requests/{id}",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
@@ -16554,14 +16561,14 @@ const operationManifest = [
 		"operationId": "listRegistryAgents",
 		"path": "/registries/{slug}/agents",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
 			"type": "string"
 		}],
 		"queryParams": [{
-			"description": null,
+			"description": "Maximum number of items to return (1-200).",
 			"enum": null,
 			"maximum": 200,
 			"minimum": 1,
@@ -16620,14 +16627,14 @@ const operationManifest = [
 		"operationId": "listRegistryRequests",
 		"path": "/registries/{slug}/requests",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
 			"type": "string"
 		}],
 		"queryParams": [{
-			"description": null,
+			"description": "Maximum number of items to return (1-200).",
 			"enum": null,
 			"maximum": 200,
 			"minimum": 1,
@@ -16678,7 +16685,7 @@ const operationManifest = [
 		"operationId": "publishAgent",
 		"path": "/registries/{slug}/agents",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
@@ -16731,13 +16738,13 @@ const operationManifest = [
 		"operationId": "resolveRegistryHandle",
 		"path": "/registries/{slug}/agents/{handle}",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
 			"type": "string"
 		}, {
-			"description": null,
+			"description": "The registry-scoped handle the agent is published under.",
 			"enum": null,
 			"name": "handle",
 			"required": true,
@@ -16786,13 +16793,13 @@ const operationManifest = [
 		"operationId": "unpublishAgent",
 		"path": "/registries/{slug}/agents/{handle}",
 		"pathParams": [{
-			"description": null,
+			"description": "The registry slug.",
 			"enum": null,
 			"name": "slug",
 			"required": true,
 			"type": "string"
 		}, {
-			"description": null,
+			"description": "The registry-scoped handle the agent is published under.",
 			"enum": null,
 			"name": "handle",
 			"required": true,
@@ -22648,8 +22655,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.9.0";
-const CLI_VERSION_RANGE = "^1.9.0";
+const SDK_VERSION_RANGE = "^1.11.0";
+const CLI_VERSION_RANGE = "^1.11.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -26194,24 +26201,47 @@ function toPaymentPayload(network, auth, signature) {
 	};
 }
 /**
-* Compute the EIP-3009 validity window for a payment. `validBefore` is the
-* value that governs on-chain validity, so it MUST cover the challenge's
-* `expires_at` plus a settlement margin; `validAfter` is set generously in the
-* past for clock skew. The total window is hard-capped at `maxWindowSec` so
-* neither a far-future `challengeExpiresAtSec` nor a widened margin can produce
-* a window the platform verifier would later reject.
+* Compute the EIP-3009 validity window for a payment, landing inside the band
+* the platform accepts. `validBefore` governs on-chain validity, so it MUST
+* stay far enough in the future to settle (>= `minHeadroomSec`) yet not so far
+* that the total window exceeds the `maxWindowSec` cap; `validAfter` is set
+* generously in the past for clock skew.
+*
+* Both ends of that band are payer landmines: a too-tight `validBefore` (low
+* headroom, e.g. a near-expired challenge) is rejected for being about to
+* expire, and a too-wide window (far-future expiry) is rejected as
+* "authorization window too wide". By default this clamps the computed window
+* into the band so a caller who does not override always gets a signable
+* window.
+*
+* If the caller passes an explicit `validBeforeSec` or `validAfterSec`, that is
+* an intent to pin the bound: when it falls outside the band this throws a
+* specific error naming which bound was violated (rather than silently signing
+* a doomed authorization), unless `clamp` is left enabled, in which case the
+* pinned value is clamped into the band like the computed one.
 */
 function computePaymentValidityWindow(params) {
 	const margin = params.settlementMarginSec ?? 300;
 	const skew = params.clockSkewSec ?? 300;
-	const validBefore = BigInt(params.challengeExpiresAtSec + margin);
-	const validAfter = BigInt(params.nowSec - skew);
-	if (validBefore <= validAfter) throw new Error("invalid validity window: validBefore must be after validAfter (challenge already expired?)");
-	const maxWindow = BigInt(params.maxWindowSec ?? 86400);
-	if (validBefore - validAfter > maxWindow) throw new Error(`invalid validity window: total window exceeds the ${maxWindow}s cap (challenge expiry too far out?)`);
+	const maxWindow = params.maxWindowSec ?? 86400;
+	const minHeadroom = params.minHeadroomSec ?? 60;
+	const clamp = params.clamp ?? true;
+	if (maxWindow < minHeadroom) throw new Error(`invalid validity window config: maxWindowSec (${maxWindow}) is smaller than minHeadroomSec (${minHeadroom})`);
+	const validAfter = params.validAfterSec !== void 0 ? params.validAfterSec : params.nowSec - skew;
+	const rawValidBefore = params.validBeforeSec !== void 0 ? params.validBeforeSec : params.challengeExpiresAtSec + margin;
+	const floor = params.nowSec + minHeadroom;
+	const ceiling = validAfter + maxWindow;
+	const tooTight = rawValidBefore < floor;
+	const tooWide = rawValidBefore > ceiling;
+	if (!clamp && params.validBeforeSec !== void 0) {
+		if (tooTight) throw new Error(`invalid validity window: validBefore (${rawValidBefore}) is below the minimum settlement headroom (must be >= now + ${minHeadroom}s = ${floor}); the authorization would be rejected as about to expire`);
+		if (tooWide) throw new Error(`invalid validity window: validBefore (${rawValidBefore}) exceeds the ${maxWindow}s window cap (must be <= validAfter + ${maxWindow}s = ${ceiling}); the authorization window is too wide`);
+	}
+	const bandedValidBefore = tooTight ? floor : tooWide ? ceiling : rawValidBefore;
+	if (bandedValidBefore <= validAfter) throw new Error("invalid validity window: validBefore must be after validAfter (challenge already expired or validAfter pinned too late?)");
 	return {
-		validAfter,
-		validBefore
+		validAfter: BigInt(validAfter),
+		validBefore: BigInt(bandedValidBefore)
 	};
 }
 /**
@@ -26308,6 +26338,7 @@ var X402Error = class extends Error {
 		this.retryAfter = options?.retryAfter ?? null;
 	}
 };
+new RegExp(`^${/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.source.slice(1, -1)}@[^\\s@]+$`, "i");
 /**
 * Assert a challenge is fully hydrated before signing, so a missing field fails
 * with a named X402Error instead of an opaque viem/BigInt error mid-sign.
@@ -28529,6 +28560,18 @@ const CANONICAL_OPERATION_ALIASES = {
 	"functions:get": "functions:get-function",
 	"functions:list": "functions:list-functions",
 	"functions:list-secrets": "functions:list-function-secrets",
+	"registries:agent": "registries:get-agent",
+	"registries:agents": "registries:list-registry-agents",
+	"registries:create": "registries:create-registry",
+	"registries:decide": "registries:decide-registry-request",
+	"registries:define": "registries:define-agent",
+	"registries:get": "registries:get-registry",
+	"registries:list": "registries:list-registries",
+	"registries:publish": "registries:publish-agent",
+	"registries:requests": "registries:list-registry-requests",
+	"registries:resolve": "registries:resolve-registry-handle",
+	"registries:unpublish": "registries:unpublish-agent",
+	"registries:update": "registries:update-registry",
 	"sending:get": "sending:get-sent-email",
 	"sending:list": "sending:list-sent-emails",
 	"sending:permissions": "sending:get-send-permissions",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,