primcli 3.0.0-preview.1 → 3.0.0-preview.2

package/README.md

@@ -250,10 +250,18 @@ Against a server without organization switching, and for logins saved by earlier
 
 ```bash
 primitive keys list
-primitive keys list --json
+primitive keys get <id> --json
+primitive keys create --name orders --permission mail:read --rule <rule-id>
+primitive keys update <id> --add mail:send,mail:reply
+primitive keys rotate <id>
+primitive keys revoke <id>
 ```
 
-`keys list` shows each key's id, prefix, name, grant, expiry and last use. It never shows a secret. API keys are created, rotated and revoked in the dashboard for now. CLI commands for this are planned. `keys list` uses the credential inventory, which the server answers only for an owner or admin in a dashboard session, so from the CLI it shows the server's refusal.
+`keys list` shows each key's id, prefix, name, permissions, the mail it reaches, expiry and last use, and `keys get` shows one key in full. Neither shows a secret. You see your own keys, and every key if your role may read them all.
+
+`keys create` needs you to say what the key can do: a `--preset`, or `--permission` with the mail it reaches (`--address`, `--domain`, `--rule`, each repeatable, or `--all-mailboxes`). There is no default, and a super admin key needs `--preset super_admin`. A key never holds more than you do, and your organization's credential policy applies. `keys update` adds or removes permissions (`--add`, `--remove`) or replaces the key's email rules (`--rule`); the key keeps its id and secret. A request already held open with that key, such as a long poll or a wait, ends once when its permissions change.
+
+Creating, rotating and changing a key need your approval in the browser. The command prints the approval link, opens it where it can, and waits for the one-time token the page shows. In a script, approve first and pass the token with `--step-up-token`. The new secret is printed once, alone on stdout (or in the JSON with `--json`), and the CLI never saves it, so store it right away. `keys revoke` asks for confirmation; pass `--yes` in scripts.
 
 `primitive roles list`, `primitive roles groups`, `primitive roles mailbox-access` and `primitive roles access-mode` read roles, groups, mailbox access and the access mode. Where the server has not enabled them, they print `feature_disabled`. The built-in roles are `owner`, `admin`, `operator` and `member`. `operator` has every permission `admin` has except managing members, changing roles, sending invitations and billing. By default, owners, admins and operators may use the CLI. An organization can open it to every member by setting `cli_access` to `all_members` in its credential policy.
 

package/dist/{api-command-ctHBqTL5.js → api-command-B37DPKFA.js}

@@ -1,4 +1,4 @@
-import { $ as AutomatedFilterUnsupportedError, An as sdk_gen_exports, F as assertAwaitingFilterRows, G as WEBHOOK_EVENT_TYPES, I as awaitingRejectedError, It as getEmail, Kt as getThread, L as ensureSearchReportsReplyState, P as ReplyStateUnsupportedError, U as replyStateSurfaceForOperation, V as isAwaitingRejectedError, W as SENT_EMAIL_EVENT_TYPES, et as assertAutomatedVerdict, it as expectedAutomatedVerdicts, nt as automatedSurfaceForOperation, on as listEndpoints, ot as isAutomatedRejectedError, rt as ensureSearchReportsAutomated, tt as automatedRejectedError, v as parseRetryAfter } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
+import { $ as AutomatedFilterUnsupportedError, F as assertAwaitingFilterRows, G as WEBHOOK_EVENT_TYPES, I as awaitingRejectedError, Jt as getThread, L as ensureSearchReportsReplyState, Lt as getEmail, P as ReplyStateUnsupportedError, Pn as sdk_gen_exports, U as replyStateSurfaceForOperation, V as isAwaitingRejectedError, W as SENT_EMAIL_EVENT_TYPES, et as assertAutomatedVerdict, it as expectedAutomatedVerdicts, nt as automatedSurfaceForOperation, ot as isAutomatedRejectedError, rt as ensureSearchReportsAutomated, sn as listEndpoints, tt as automatedRejectedError, v as parseRetryAfter } from "./repeats-Dj_o6c-X-BzXj5ICh.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
 import { d as readMailJson, h as writeMailJson, m as withMailLock, p as syncMailDirectory, u as privateMailPermissions } from "./shared-mail-files-BAQSGxxz.js";
@@ -2735,7 +2735,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-Cp_eQ9t_.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-g-xPd3X0.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)

package/dist/{machine-session-Cp_eQ9t_.js → machine-session-g-xPd3X0.js}

@@ -1,12 +1,12 @@
 import { B as parseOwnerMemberAddress, F as agentProfilesDirectory, I as connectedAgentIdentity, L as connectedApiBaseUrl, M as AgentConnectionSetupError, N as agentProfileDirectory, P as agentProfileName, R as loadConnectedAgentProfile, U as saveConnectedAgentProfile, V as profileAlreadyConnectedMessage, W as PrimitiveApiClient, b as loadCliCredentials, j as AGENT_PROFILE_ENV, z as parseConnectedAgentProfile } from "./cli-config-Ms_0vNjq.js";
-import { $n as __exportAll, $t as listContacts, Cn as putContact, It as getEmail, Jt as inviteAgentConnection, Mt as getContact, Pn as sendEmail, Sn as putAgentContactPolicy, Xt as listAgentConnections, Zt as listAgentContacts, hn as listSentEmails, jn as searchEmails, jt as getAgentContactPolicy, rn as listDomains, vt as deleteAgentContact, xn as putAgentContact, yt as deleteContact } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
-import { Ft as refuseOrgSelectionForProfile, Pt as refreshStoredCliCredentials, St as detectAgentRuntime, _t as defaultConnectionName, ht as cliInvocation } from "./api-command-ctHBqTL5.js";
+import { $t as listAgentContacts, Cn as putAgentContact, Fn as searchEmails, Lt as getEmail, Mt as getAgentContactPolicy, Nt as getContact, Qt as listAgentConnections, Rn as sendEmail, Tn as putContact, Xt as inviteAgentConnection, _n as listSentEmails, bt as deleteContact, in as listDomains, ir as __exportAll, tn as listContacts, wn as putAgentContactPolicy, yt as deleteAgentContact } from "./repeats-Dj_o6c-X-BzXj5ICh.js";
+import { Ft as refuseOrgSelectionForProfile, Pt as refreshStoredCliCredentials, St as detectAgentRuntime, _t as defaultConnectionName, ht as cliInvocation } from "./api-command-B37DPKFA.js";
 import { _ as acquireListenLock, b as listenLockHeld, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString } from "./shared-mail-files-BAQSGxxz.js";
-import { S as readBundledConnectSkill, a as NotificationRetryError, d as SESSION_UUID, f as connectNativeSession, m as NativeSessionDisconnectedError, p as defaultSessionSocket, t as notificationScope, y as installConnectSkill } from "./notify-session-BN0JTPZ3.js";
+import { S as readBundledConnectSkill, a as NotificationRetryError, d as SESSION_UUID, f as connectNativeSession, m as NativeSessionDisconnectedError, p as defaultSessionSocket, t as notificationScope, y as installConnectSkill } from "./notify-session-Bo8WgG3q.js";
 import { l as stopBackgroundListen, r as backgroundListenStatus } from "./listen-background-C0F9gNDD.js";
 import { t as readSharedMailOwner } from "./shared-mail-watch-BAPMsFNv.js";
 import { withoutOrgSelection } from "./oclif/global-org-flag.js";
-import { o as scopedChatSenderTrust } from "./scoped-chat-DZ42V3jq.js";
+import { o as scopedChatSenderTrust } from "./scoped-chat-TJlyUTi7.js";
 import { accessSync, chmodSync, closeSync, constants, copyFileSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";

package/dist/{notify-session-BN0JTPZ3.js → notify-session-Bo8WgG3q.js}

@@ -1,5 +1,5 @@
-import { Et as downloadEmailAttachmentPart, J as parseWebhookEvent, K as isEmailReceivedEvent, c as classifySignalContent, q as isTrustedSender } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
-import { E as wakeReadCommand, T as skillFirstLine, V as wakeInteractionSentence } from "./api-command-ctHBqTL5.js";
+import { Dt as downloadEmailAttachmentPart, J as parseWebhookEvent, K as isEmailReceivedEvent, c as classifySignalContent, q as isTrustedSender } from "./repeats-Dj_o6c-X-BzXj5ICh.js";
+import { E as wakeReadCommand, T as skillFirstLine, V as wakeInteractionSentence } from "./api-command-B37DPKFA.js";
 import { _ as acquireListenLock, g as ListenStateError, y as listenIdentity } from "./shared-mail-files-BAQSGxxz.js";
 import { closeSync, copyFileSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, opendirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";

package/dist/oclif/auto-signal-worker.js

@@ -1,8 +1,8 @@
-import { Gt as getSentEmail } from "../repeats-Dj_o6c-X-Bf9G0xds.js";
-import { Mt as createAuthenticatedCliApiClient, x as readThreadContext } from "../api-command-ctHBqTL5.js";
+import { qt as getSentEmail } from "../repeats-Dj_o6c-X-BzXj5ICh.js";
+import { Mt as createAuthenticatedCliApiClient, x as readThreadContext } from "../api-command-B37DPKFA.js";
 import { AUTO_SIGNAL_KIND_ENV, AUTO_WORKING_RENEW_MS, autoSignalsDisabled, clearWorkingSending, markWorkingSending, readAutoClaim, readWorkingLease, recordRenewer, stopWorkingLease, writeWorkingLease } from "./auto-signals.js";
 import { _ as acquireListenLock } from "../shared-mail-files-BAQSGxxz.js";
-import { t as sendSignal } from "../signal-command-CRUMUCNa.js";
+import { t as sendSignal } from "../signal-command-BO93dM2Q.js";
 import { join } from "node:path";
 import { homedir } from "node:os";
 // src/oclif/auto-signal-worker.ts

package/dist/oclif/auto-signals.js

@@ -1,4 +1,4 @@
-import { n as isPlainChatReply, o as scopedChatSenderTrust } from "../scoped-chat-DZ42V3jq.js";
+import { n as isPlainChatReply, o as scopedChatSenderTrust } from "../scoped-chat-TJlyUTi7.js";
 import { d as readMailJson, h as writeMailJson, i as mailId, l as privateMailDirectory, r as mailAddress } from "../shared-mail-files-BAQSGxxz.js";
 import { existsSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";