primcli 3.0.0-preview.1 → 3.0.0-preview.2

package/dist/oclif/receiver-heal.js

@@ -1,7 +1,7 @@
 import { N as agentProfileDirectory, P as agentProfileName, R as loadConnectedAgentProfile, j as AGENT_PROFILE_ENV } from "../cli-config-Ms_0vNjq.js";
 import { a as claimBackgroundListenRestart, n as backgroundListenRestartable, r as backgroundListenStatus } from "../listen-background-C0F9gNDD.js";
-import { d as SESSION_UUID, t as notificationScope } from "../notify-session-BN0JTPZ3.js";
-import { St as detectAgentRuntime } from "../api-command-ctHBqTL5.js";
+import { d as SESSION_UUID, t as notificationScope } from "../notify-session-Bo8WgG3q.js";
+import { St as detectAgentRuntime } from "../api-command-B37DPKFA.js";
 import { d as readMailJson } from "../shared-mail-files-BAQSGxxz.js";
 import { join } from "node:path";
 import { spawn } from "node:child_process";

package/dist/{repeats-Dj_o6c-X-Bf9G0xds.js → repeats-Dj_o6c-X-BzXj5ICh.js}

@@ -129,6 +129,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getEmailReadable: () => getEmailReadable,
 	getEmailRule: () => getEmailRule,
 	getEmailRuleRequest: () => getEmailRuleRequest,
+	getEmailRuleScope: () => getEmailRuleScope,
 	getEmailRuleShare: () => getEmailRuleShare,
 	getFunction: () => getFunction,
 	getFunctionDeployment: () => getFunctionDeployment,
@@ -192,8 +193,11 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	listEmailAttachmentArchiveMembers: () => listEmailAttachmentArchiveMembers,
 	listEmailRuleDecisions: () => listEmailRuleDecisions,
 	listEmailRuleRequests: () => listEmailRuleRequests,
+	listEmailRuleResults: () => listEmailRuleResults,
+	listEmailRuleScopeOptions: () => listEmailRuleScopeOptions,
 	listEmailRuleShareEmails: () => listEmailRuleShareEmails,
 	listEmailRuleShares: () => listEmailRuleShares,
+	listEmailRuleVersions: () => listEmailRuleVersions,
 	listEmailRules: () => listEmailRules,
 	listEmails: () => listEmails,
 	listEndpoints: () => listEndpoints,
@@ -3594,7 +3598,7 @@ const compileEmailRule = (options) => (options.client ?? client).post({
 /**
 * Test a rule against received mail
 *
-* Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read, and only what its scope covers. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
 */
 const testEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3641,7 +3645,7 @@ const listEmailRules = (options) => (options?.client ?? client).get({
 /**
 * Create a rule
 *
-* Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. evaluation_scope (author when omitted) chooses whose mail it runs over; scope_selection may name only what you can read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
 */
 const createEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3684,7 +3688,7 @@ const getEmailRule = (options) => (options.client ?? client).get({
 /**
 * Change a rule
 *
-* Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged) or changes its state: draft (disabled), observe or active. Only the rule's author may rename it, add a version or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged), changes its state (draft, disabled; observe; or active) or changes whose mail it runs over (evaluation_scope, with scope_selection when selected). Only the rule's author may rename it, add a version, change its scope or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Omit evaluation_scope to keep the current scope. A scope change saves a new version with the same conditions; what was granted stays. A shared rule keeps its scope. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
 */
 const updateEmailRule = (options) => (options.client ?? client).patch({
 	security: [{
@@ -3712,6 +3716,58 @@ const listEmailRuleDecisions = (options) => (options.client ?? client).get({
 	...options
 });
 /**
+* List every rule's result on an email
+*
+* Every rule the caller can see and what it decided about this email: those that matched, those that did not, and those that have not run on it, with what is known about them. A result names the version of the rule that decided and carries that version's conditions and questions. Only a caller who can read the email gets an answer, and a rule the caller cannot see is left out. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+*/
+const listEmailRuleResults = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}/rule-results",
+	...options
+});
+/**
+* Read versions of a rule
+*
+* The named versions of a rule, as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Numbers that are not versions of the rule are left out. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+*/
+const listEmailRuleVersions = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/{id}/versions",
+	...options
+});
+/**
+* Read what a rule covers
+*
+* Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+*/
+const getEmailRuleScope = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/{id}/scope",
+	...options
+});
+/**
+* List what a rule can cover
+*
+* How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+*/
+const listEmailRuleScopeOptions = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-scope-options",
+	...options
+});
+/**
 * List rule requests
 *
 * Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
@@ -4802,7 +4858,7 @@ const listKeys = (options) => (options?.client ?? client).get({
 /**
 * Create an API key
 *
-* Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope "org", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI's token is refused, even with a step-up: keys are created in the dashboard or by an app the person connected. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).
+* Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope "org", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).
 *
 * Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
@@ -4821,7 +4877,7 @@ const createKey = (options) => (options.client ?? client).post({
 /**
 * Rotate an API key
 *
-* Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
 *
 * Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
@@ -4855,7 +4911,7 @@ const getKey = (options) => (options.client ?? client).get({
 /**
 * Change an API key
 *
-* Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
 *
 * Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
@@ -25280,4 +25336,4 @@ function repeatStopCommand(emailId) {
 	if (!UUID.test(emailId)) throw new TypeError("emailId must be an email UUID");
 	return `primitive repeat stop --id ${emailId.toLowerCase()}`;
 }
-export { AutomatedFilterUnsupportedError as $, __exportAll as $n, listContacts as $t, sleep as A, sdk_gen_exports as An, getAccount as At, hasReplyState as B, startAgentSignup as Bn, getInboxStatus as Bt, collectNewAcceptedEmails as C, putContact as Cn, deleteWakeSchedule as Ct, filtersFromFlags as D, replyToEmail as Dn, downloadSentAttachmentArchiveMember as Dt, fetchEmailSearchPage as E, reorderRoutes as En, downloadEmailAttachmentPart as Et, assertAwaitingFilterRows as F, setFunctionRoute as Fn, getDefaultNetworkAgent as Ft, WEBHOOK_EVENT_TYPES as G, updateDefaultNetworkMember as Gn, getSentEmail as Gt, queryUsesAwaiting as H, stopRepeatFromEmail as Hn, getOrgRoutingTopology as Ht, awaitingRejectedError as I, setFunctionSecret as In, getEmail as It, parseWebhookEvent as J, updateRoute as Jn, inviteAgentConnection as Jt, isEmailReceivedEvent as K, updateFunction as Kn, getThread as Kt, ensureSearchReportsReplyState as L, setMemory as Ln, getFunction as Lt, AWAITING_VALUES as M, searchMemories as Mn, getContact as Mt, REPLY_STATE_UNSUPPORTED_CODE as N, semanticSearch as Nn, getConversation as Nt, quoteDslValue as O, resendAgentSignupVerification as On, downloadSentAttachmentByFilename as Ot, ReplyStateUnsupportedError as P, sendEmail as Pn, getCreditBalance as Pt, AUTOMATED_VALUES as Q, verifyAgentSignup as Qn, listAgentNetworks as Qt, formatAwaitingCell as R, simulateRoute as Rn, getFunctionRouting as Rt, transientFailure as S, putAgentContactPolicy as Sn, deleteWakeAuthorization as St, encodeReceivedAtSearchCursor as T, removeDefaultNetworkMember as Tn, downloadEmailAttachmentByFilename as Tt, replyStateSurfaceForOperation as U, testFunction as Un, getOwnGrant as Ut, isAwaitingRejectedError as V, startCliLogin as Vn, getMemory as Vt, SENT_EMAIL_EVENT_TYPES as W, unsetFunctionRoute as Wn, getRepeatingSend as Wt, AUTOMATED_FILTER_UNSUPPORTED_CODE as X, updateWakeSchedule as Xn, listAgentConnections as Xt, parseFromHeader as Y, updateWakeAuthorization as Yn, leaveOrganization as Yt, AUTOMATED_FLAG_DESCRIPTION as Z, verifyAgentClaim as Zn, listAgentContacts as Zt, describeApiFailure as _, listWakeDispatches as _n, createWakeSchedule as _t, REPEAT_IDLE_MAX_MINUTES as a, listEmails as an, hasAutomatedVerdict as at, retryTransient as b, pullWebhookEvent as bn, deleteMemory as bt, classifySignalContent as c, listFunctions as cn, cancelSentEmail as ct, parseRepeatTick as d, listRepeatingSends as dn, cliLogout as dt, listCredentials as en, assertAutomatedVerdict as et, preparePresenceAliveEmail as f, listRoles as fn, completeWebhookEvent as ft, WaitDeadlineReached as g, listWakeAuthorizations as gn, createWakeAuthorization as gt, sendPreparedSignal as h, listSentEmails as hn, createRoute as ht, REPEAT_EVERY_MAX_MINUTES as i, listEmailAttachmentArchiveMembers as in, expectedAutomatedVerdicts as it, AWAITING_FLAG_DESCRIPTION as j, searchEmails as jn, getAgentContactPolicy as jt, sinceFromFlags as k, runWakeSchedule as kn, getAccessMode as kt, parseInteractionEnvelope as l, listGroups as ln, cancelSentEmailByIdempotencyKey as lt, repeatStopCommand as m, listSentAttachmentArchiveMembers as mn, createFunction as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, listDefaultNetworkMembers as nn, automatedSurfaceForOperation as nt, REPEAT_MAX_SENDS_MAX as o, listEndpoints as on, isAutomatedRejectedError as ot, prepareSignalEmail as p, listRoutes as pn, createEndpoint as pt, isTrustedSender as q, updateRepeatingSend as qn, getWakeSchedule as qt, PRESENCE_PROBE_TEXT as r, listDomains as rn, ensureSearchReportsAutomated as rt, buildRepeatStopBody as s, listFunctionLogs as sn, addDefaultNetworkMember as st, MAX_INTERACTION_BYTES as t, listDefaultNetworkAgents as tn, automatedRejectedError as tt, parsePresenceEnvelope as u, listMailboxAccess as un, checkDefaultNetworkContactAdmission as ut, parseRetryAfter as v, listWakeSchedules as vn, deleteAgentContact as vt, cursorFromAcceptedRows as w, redeemCreditCode as wn, downloadEmailAttachmentArchiveMember as wt, retryingOperation as x, putAgentContact as xn, deleteRoute as xt, pauseForTransientFailure as y, pollCliLogin as yn, deleteContact as yt, formatRepliesCell as z, startAgentClaim as zn, getFunctionTestRunTrace as zt };
+export { AutomatedFilterUnsupportedError as $, updateRoute as $n, listAgentContacts as $t, sleep as A, resendAgentSignupVerification as An, getAccessMode as At, hasReplyState as B, setFunctionSecret as Bn, getFunctionTestRunTrace as Bt, collectNewAcceptedEmails as C, putAgentContact as Cn, deleteWakeAuthorization as Ct, filtersFromFlags as D, removeDefaultNetworkMember as Dn, downloadEmailAttachmentPart as Dt, fetchEmailSearchPage as E, redeemCreditCode as En, downloadEmailAttachmentByFilename as Et, assertAwaitingFilterRows as F, searchEmails as Fn, getCreditBalance as Ft, WEBHOOK_EVENT_TYPES as G, startCliLogin as Gn, getOwnGrant as Gt, queryUsesAwaiting as H, simulateRoute as Hn, getKey as Ht, awaitingRejectedError as I, searchMemories as In, getDefaultNetworkAgent as It, parseWebhookEvent as J, unsetFunctionRoute as Jn, getThread as Jt, isEmailReceivedEvent as K, stopRepeatFromEmail as Kn, getRepeatingSend as Kt, ensureSearchReportsReplyState as L, semanticSearch as Ln, getEmail as Lt, AWAITING_VALUES as M, rotateKey as Mn, getAgentContactPolicy as Mt, REPLY_STATE_UNSUPPORTED_CODE as N, runWakeSchedule as Nn, getContact as Nt, quoteDslValue as O, reorderRoutes as On, downloadSentAttachmentArchiveMember as Ot, ReplyStateUnsupportedError as P, sdk_gen_exports as Pn, getConversation as Pt, AUTOMATED_VALUES as Q, updateRepeatingSend as Qn, listAgentConnections as Qt, formatAwaitingCell as R, sendEmail as Rn, getFunction as Rt, transientFailure as S, pullWebhookEvent as Sn, deleteRoute as St, encodeReceivedAtSearchCursor as T, putContact as Tn, downloadEmailAttachmentArchiveMember as Tt, replyStateSurfaceForOperation as U, startAgentClaim as Un, getMemory as Ut, isAwaitingRejectedError as V, setMemory as Vn, getInboxStatus as Vt, SENT_EMAIL_EVENT_TYPES as W, startAgentSignup as Wn, getOrgRoutingTopology as Wt, AUTOMATED_FILTER_UNSUPPORTED_CODE as X, updateFunction as Xn, inviteAgentConnection as Xt, parseFromHeader as Y, updateDefaultNetworkMember as Yn, getWakeSchedule as Yt, AUTOMATED_FLAG_DESCRIPTION as Z, updateKey as Zn, leaveOrganization as Zt, describeApiFailure as _, listSentEmails as _n, createWakeAuthorization as _t, REPEAT_IDLE_MAX_MINUTES as a, listEmailAttachmentArchiveMembers as an, hasAutomatedVerdict as at, retryTransient as b, listWakeSchedules as bn, deleteContact as bt, classifySignalContent as c, listFunctionLogs as cn, cancelSentEmail as ct, parseRepeatTick as d, listKeys as dn, cliLogout as dt, listAgentNetworks as en, updateWakeAuthorization as er, assertAutomatedVerdict as et, preparePresenceAliveEmail as f, listMailboxAccess as fn, completeWebhookEvent as ft, WaitDeadlineReached as g, listSentAttachmentArchiveMembers as gn, createRoute as gt, sendPreparedSignal as h, listRoutes as hn, createKey as ht, REPEAT_EVERY_MAX_MINUTES as i, listDomains as in, __exportAll as ir, expectedAutomatedVerdicts as it, AWAITING_FLAG_DESCRIPTION as j, revokeCredential as jn, getAccount as jt, sinceFromFlags as k, replyToEmail as kn, downloadSentAttachmentByFilename as kt, parseInteractionEnvelope as l, listFunctions as ln, cancelSentEmailByIdempotencyKey as lt, repeatStopCommand as m, listRoles as mn, createFunction as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, listDefaultNetworkAgents as nn, verifyAgentClaim as nr, automatedSurfaceForOperation as nt, REPEAT_MAX_SENDS_MAX as o, listEmails as on, isAutomatedRejectedError as ot, prepareSignalEmail as p, listRepeatingSends as pn, createEndpoint as pt, isTrustedSender as q, testFunction as qn, getSentEmail as qt, PRESENCE_PROBE_TEXT as r, listDefaultNetworkMembers as rn, verifyAgentSignup as rr, ensureSearchReportsAutomated as rt, buildRepeatStopBody as s, listEndpoints as sn, addDefaultNetworkMember as st, MAX_INTERACTION_BYTES as t, listContacts as tn, updateWakeSchedule as tr, automatedRejectedError as tt, parsePresenceEnvelope as u, listGroups as un, checkDefaultNetworkContactAdmission as ut, parseRetryAfter as v, listWakeAuthorizations as vn, createWakeSchedule as vt, cursorFromAcceptedRows as w, putAgentContactPolicy as wn, deleteWakeSchedule as wt, retryingOperation as x, pollCliLogin as xn, deleteMemory as xt, pauseForTransientFailure as y, listWakeDispatches as yn, deleteAgentContact as yt, formatRepliesCell as z, setFunctionRoute as zn, getFunctionRouting as zt };

package/dist/{scoped-chat-DZ42V3jq.js → scoped-chat-TJlyUTi7.js}

@@ -1,4 +1,4 @@
-import { b as retryTransient, c as classifySignalContent, q as isTrustedSender } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
+import { b as retryTransient, c as classifySignalContent, q as isTrustedSender } from "./repeats-Dj_o6c-X-BzXj5ICh.js";
 // src/oclif/presence-provenance.ts
 function readPresenceProjection(detail) {
 	if (!detail || typeof detail !== "object") return null;

package/dist/{signal-command-CRUMUCNa.js → signal-command-BO93dM2Q.js}

@@ -1,15 +1,15 @@
-import { It as getEmail, Pn as sendEmail, _ as describeApiFailure, h as sendPreparedSignal, hn as listSentEmails, p as prepareSignalEmail, pt as createEndpoint } from "./repeats-Dj_o6c-X-Bf9G0xds.js";
-import { X as classifySendError, ft as successfulSendOutcome, g as bareAddress, o as extractErrorPayload } from "./api-command-ctHBqTL5.js";
+import { Lt as getEmail, Rn as sendEmail, _ as describeApiFailure, _n as listSentEmails, h as sendPreparedSignal, p as prepareSignalEmail, pt as createEndpoint } from "./repeats-Dj_o6c-X-BzXj5ICh.js";
+import { X as classifySendError, ft as successfulSendOutcome, g as bareAddress, o as extractErrorPayload } from "./api-command-B37DPKFA.js";
 import { recordSentSignal } from "./oclif/auto-signals.js";
 import { _ as acquireListenLock, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, x as listenProcessIdentity, y as listenIdentity } from "./shared-mail-files-BAQSGxxz.js";
-import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-DZ42V3jq.js";
+import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-TJlyUTi7.js";
 import { n as tryOwnSharedMail, r as waitForSharedMailChange, t as readSharedMailOwner } from "./shared-mail-watch-BAPMsFNv.js";
 import { Errors } from "@oclif/core";
 import { opendirSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
 import { dirname, join } from "node:path";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-// ../sdk-node/dist/api-BKmwTTyX.js
+// ../sdk-node/dist/api-DWJSxvRV.js
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
 	let lastEventId;

package/man/primitive.1

@@ -207,9 +207,18 @@ profile are bound to one organization and refuse a different one.
 .PP
 Run
 .B primitive keys list
-to list API key metadata; it never shows a secret. API keys are created,
-rotated and revoked in the dashboard for now. CLI commands for this are
-planned.
+or
+.B primitive keys get ID
+to see API keys and their permissions; neither shows a secret.
+.BR "primitive keys create" ,
+.B rotate
+and
+.B update
+need your approval in the browser: the command prints the approval link and
+waits for the one-time token the page shows. A new secret is printed once and
+never saved.
+.B primitive keys revoke ID
+revokes a key.
 .B primitive whoami --check PERMISSION
 reports whether the current credential may use a permission.
 .PP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "3.0.0-preview.1",
+  "version": "3.0.0-preview.2",
   "publishConfig": {
     "tag": "preview"
   },
@@ -144,7 +144,7 @@
         "description": "Global secrets shared across every function. Use `primitive org secrets list|set|remove`. Changes land in a function on its next redeploy; a function secret of the same name overrides the global."
       },
       "keys": {
-        "description": "List organization API keys (metadata only, never secrets) with `primitive keys list`. API keys are created, rotated and revoked in the dashboard for now. CLI commands for this are planned."
+        "description": "Organization API keys: list and show them (metadata only, never secrets), create, rotate and change them after you approve each request in your browser, and revoke them."
       },
       "roles": {
         "description": "Read roles, groups, mailbox access and the access mode. Use `primitive roles list|groups|mailbox-access|access-mode`; generated API names remain available."