primcli 3.0.0-preview.1 → 3.0.0-preview.10

package/dist/{scoped-chat-DZ42V3jq.js → scoped-chat-C4TDfZND.js}

@@ -1,4 +1,4 @@
-import { b as retryTransient, c as classifySignalContent, q as isTrustedSender } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
+import { Z as isTrustedSender, b as retryTransient, c as classifySignalContent } from "./repeats-Dj_o6c-X-CDaE-kdZ.js";
 // src/oclif/presence-provenance.ts
 function readPresenceProjection(detail) {
 	if (!detail || typeof detail !== "object") return null;

package/dist/{signal-command-CRUMUCNa.js → signal-command-f5QeK45s.js}

@@ -1,15 +1,15 @@
-import { It as getEmail, Pn as sendEmail, _ as describeApiFailure, h as sendPreparedSignal, hn as listSentEmails, p as prepareSignalEmail, pt as createEndpoint } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
-import { X as classifySendError, ft as successfulSendOutcome, g as bareAddress, o as extractErrorPayload } from "./api-command-ctHBqTL5.js";
+import { Dn as listSentEmails, Ht as getEmail, Jn as sendEmail, _ as describeApiFailure, h as sendPreparedSignal, p as prepareSignalEmail, vt as createEndpoint } from "./repeats-Dj_o6c-X-CDaE-kdZ.js";
+import { Dt as successfulSendOutcome, dt as classifySendError, j as bareAddress, s as extractErrorPayload } from "./api-command-D0KHkqhA.js";
 import { recordSentSignal } from "./oclif/auto-signals.js";
 import { _ as acquireListenLock, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, x as listenProcessIdentity, y as listenIdentity } from "./shared-mail-files-BAQSGxxz.js";
-import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-DZ42V3jq.js";
+import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-C4TDfZND.js";
 import { n as tryOwnSharedMail, r as waitForSharedMailChange, t as readSharedMailOwner } from "./shared-mail-watch-BAPMsFNv.js";
 import { Errors } from "@oclif/core";
 import { opendirSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
 import { dirname, join } from "node:path";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-// ../sdk-node/dist/api-BKmwTTyX.js
+// ../sdk-node/dist/api-v3fGf2O7.js
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
 	let lastEventId;

package/man/primitive.1

@@ -207,9 +207,24 @@ profile are bound to one organization and refuse a different one.
 .PP
 Run
 .B primitive keys list
-to list API key metadata; it never shows a secret. API keys are created,
-rotated and revoked in the dashboard for now. CLI commands for this are
-planned.
+or
+.B primitive keys get ID
+to see API keys and their permissions; neither shows a secret.
+.BR "primitive keys create" ,
+.B rotate
+and
+.B update
+run directly. If your organization requires approval, the command prints the
+approval link and waits for the one-time token the page shows, or takes it with
+.BR --step-up-token .
+A new secret is printed once and never saved.
+.B primitive keys update ID --expires-at TIME
+extends a key before it expires; rotating keeps its expiry unless
+.B rotate
+is given
+.BR --expires-at .
+.B primitive keys revoke ID
+revokes a key.
 .B primitive whoami --check PERMISSION
 reports whether the current credential may use a permission.
 .PP
@@ -222,7 +237,8 @@ signed in with
 can leave; API keys are refused. The only owner of an organization cannot leave
 it. If the server asks for a dashboard confirmation, open the page it names and
 paste the token at the prompt, or pass it with --step-up-token. Refusals from
-the server are printed as returned.
+the server are printed as returned. Without a terminal and without --yes, it
+exits 2 before anything is sent.
 .PP
 Run
 .B primitive whoami

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "3.0.0-preview.1",
+  "version": "3.0.0-preview.10",
   "publishConfig": {
     "tag": "preview"
   },
@@ -42,6 +42,9 @@
       "identifier": "COMMANDS"
     },
     "dirname": "primitive",
+    "hooks": {
+      "command_not_found": "./dist/oclif/command-not-found.js"
+    },
     "plugins": [
       "@oclif/plugin-help",
       "@oclif/plugin-autocomplete",
@@ -92,7 +95,7 @@
         "description": "Check inbound email setup and readiness, and work through mail awaiting your reply. Prefer `primitive inbox setup` for a guided setup path, `primitive inbox status` for the readiness table, and `primitive inbox next` for the oldest email awaiting your reply."
       },
       "emails": {
-        "description": "List, inspect, and wait for received emails. Prefer task aliases like `primitive emails list`, `primitive emails get`, `primitive emails latest`, `primitive emails wait`, and `primitive emails watch`; generated API names remain available for compatibility."
+        "description": "List, inspect, and wait for received emails, and see what the classifier read from one. Prefer task aliases like `primitive emails list`, `primitive emails get`, `primitive emails latest`, `primitive emails facts`, `primitive emails wait`, and `primitive emails watch`; generated API names remain available for compatibility."
       },
       "search": {
         "description": "Cross-corpus semantic search. Prefer `primitive search <query>` for lexical inbound search and `primitive semantic-search <query>` for meaning-aware ranking across inbound and outbound.",
@@ -102,10 +105,10 @@
         "description": "Send outbound emails. Prefer `primitive send` for fresh sends and `primitive reply --id <inbound-id>` for replies. Use `primitive domains list` or `primitive inbox status` to find usable sender domains for --from; `primitive sending permissions` lists recipient-scope destinations you may send to."
       },
       "signin": {
-        "description": "Sign in to an existing Primitive account"
+        "description": "Sign in with browser approval or an emailed code"
       },
       "login": {
-        "description": "Log in to an existing Primitive account"
+        "description": "Log in with browser approval or an emailed code"
       },
       "otp": {
         "description": "Authenticate with an emailed one-time code"
@@ -144,10 +147,10 @@
         "description": "Global secrets shared across every function. Use `primitive org secrets list|set|remove`. Changes land in a function on its next redeploy; a function secret of the same name overrides the global."
       },
       "keys": {
-        "description": "List organization API keys (metadata only, never secrets) with `primitive keys list`. API keys are created, rotated and revoked in the dashboard for now. CLI commands for this are planned."
+        "description": "Organization API keys: list and show them (metadata only, never secrets), create, rotate and change them (with browser approval where your organization requires it), and revoke them."
       },
       "roles": {
-        "description": "Read roles, groups, mailbox access and the access mode. Use `primitive roles list|groups|mailbox-access|access-mode`; generated API names remain available."
+        "description": "Read roles, members, groups, mailbox access and the access mode. Use `primitive roles list|members|groups|mailbox-access|access-mode`; generated API names remain available."
       },
       "projects": {
         "description": "Organization people, shared projects and project invitations"
@@ -164,6 +167,9 @@
       "organization-settings": {
         "description": "Your connected apps and CLI logins, the organization's connected apps, name, logo, search settings and billing"
       },
+      "members": {
+        "description": "List the organization's members and their roles. Use `primitive members list` (the same as `primitive roles members`)."
+      },
       "roles-and-members": {
         "description": "Roles, member roles and removal, the mailbox access mode, break-glass, transfers and suspensions, and leaving the organization"
       },
@@ -179,9 +185,15 @@
       "stats": {
         "description": "Received and sent mail per hour, and how webhook deliveries ended"
       },
+      "activity": {
+        "description": "What you created, and what other members asked of you, with where each stands now (ids, names and states only)"
+      },
       "email-rules": {
         "description": "Rules written in plain English that pick out received mail"
       },
+      "email-rule-oversight": {
+        "description": "The email rules that reach your own mailboxes, whoever wrote them, read-only, and objections asking a rule's author to turn it off"
+      },
       "routes": {
         "description": "Manage recipient routes. Bind an address pattern to an endpoint or function: `primitive routes add alice@d --function <id>`, `primitive routes list`, `primitive routes test <recipient>`, `primitive routes remove <id>`."
       },