@primitivedotdev/cli - npm Package Compare versions

Comparing version 1.5.0 to 1.6.0

package.json

 {
   "name": "@primitivedotdev/cli",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
@@ -106,2 +106,5 @@ "type": "module",
         "description": "Global secrets shared across every function. Use `primitive org secrets list|set|remove`. Changes land in a function on its next redeploy; a function secret of the same name overrides the global."
+      },
+      "payments": {
+        "description": "Collect and pay x402 stablecoin (USDC) payments. Start with `primitive payments register-payout-address`, then `primitive payments create-challenge` to request a payment and `primitive payments pay` to settle one. Settlement is non-custodial; signing happens locally with your wallet key. Manage caps with `primitive payments get-policy|update-spend-policy`."
       }
@@ -147,3 +150,4 @@ },
     "@oclif/plugin-help": "^6.2.44",
-    "@oclif/plugin-warn-if-update-available": "^3.1.65"
+    "@oclif/plugin-warn-if-update-available": "^3.1.65",
+    "viem": "^2.21.0"
   },
@@ -153,2 +157,3 @@ "devDependencies": {
     "@primitivedotdev/api-core": "workspace:*",
+    "@primitivedotdev/sdk": "workspace:*",
     "@types/node": "^22.10.2",
@@ -155,0 +160,0 @@ "@vitest/coverage-v8": "^4.1.4",

README.md

@@ -19,3 +19,3 @@ # @primitivedotdev/cli
 
-The same CLI is also published unscoped as [`primcli`](https://www.npmjs.com/package/primcli) — `npm install -g primcli` installs an identical build with the same `primitive`/`prim` commands. Use whichever name you prefer; they track the same version.
+The same CLI is also published unscoped as [`primcli`](https://www.npmjs.com/package/primcli). `npm install -g primcli` installs an identical build with the same `primitive`/`prim` commands. Use whichever name you prefer; they track the same version.
 
@@ -77,2 +77,41 @@ Or with no install:
 
+## x402 payments
+
+The `primitive payments` command group drives non-custodial x402 USDC payments. One agent registers a payout address and requests a payment; the paying agent signs locally with its own wallet key and settles. The key never leaves your machine. Networks are `base` and `base-sepolia`. Amounts take a human USDC value (`--amount-usdc 0.01`) or token base units (`--amount 10000`, since USDC has 6 decimals). Your org is resolved automatically from your API key, so payout registration takes no org flag.
+
+```bash
+# Payee, one time: register the default address your org is paid at. Signs an
+# ownership message locally with your wallet key. Org is auto-resolved.
+primitive payments register-payout-address --network base-sepolia --label treasury
+
+# Payee: request a payment with a human USDC amount. Prints a summary by default.
+primitive payments charge --network base-sepolia --amount-usdc 0.01
+# Capture the raw challenge JSON to hand to the payer.
+primitive payments charge --network base-sepolia --amount-usdc 0.01 --json > challenge.json
+
+# Payer: sign and settle the challenge locally. Reads the challenge inline,
+# from a file, or piped on stdin.
+primitive payments pay --challenge-file challenge.json
+cat challenge.json | primitive payments pay
+
+# Inspect a challenge by id, or list your registered payout addresses.
+primitive payments get-challenge --id <challenge-id>
+primitive payments list-payout-addresses
+
+# Read and update the org spend policy (kill-switch, per-payment and daily caps,
+# payee allowlist). The update merges: omitted fields keep their value.
+primitive payments get-spend-policy
+primitive payments update-spend-policy --max-per-payment 5000000
+```
+
+`charge` is the friendly verb that matches the SDK `charge` and accepts `--amount-usdc`; `create-challenge` is the lower-level command that takes base-unit `--amount`. Either creates a challenge. The signing commands print a human-readable summary by default; pass `--json` for raw JSON suitable for piping.
+
+The two signing commands (`register-payout-address` and `pay`) need your wallet key. Set it in `PRIMITIVE_X402_PRIVATE_KEY` (a `0x`-prefixed hex private key) so it never lands in shell history or the process list:
+
+```bash
+export PRIMITIVE_X402_PRIVATE_KEY=0x...
+```
+
+A hidden `--private-key` flag is available as an escape hatch for scripted use, but the environment variable is preferred. The non-signing commands (`charge`, `get-challenge`, `list-payout-addresses`, `get-spend-policy`, `update-spend-policy`) need only your Primitive API key. Run `primitive payments <command> --help` for the full flag list of any command.
+
 ## Migrating from `@primitivedotdev/sdk` CLI
@@ -79,0 +118,0 @@

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1048820

7.43%

Lines of code

28095

7.84%

Number of lines in readme file

129

43.33%

Worsened metrics

Dependency count

5

25%

Dev dependency count

11

10%

Dependency changes

• + Added

  viem@^2.21.0

• + Added

  @adraffy/ens-normalize@1.11.1
  (transitive)

• + Added

  @noble/ciphers@1.3.0
  (transitive)

• + Added

  @noble/curves@1.9.1
  (transitive)

• + Added

  @noble/hashes@1.8.0
  (transitive)

• + Added

  @oclif/core@4.11.13
  (transitive)

• + Added

  @scure/base@1.2.6
  (transitive)

• + Added

  @scure/bip32@1.7.0
  (transitive)

• + Added

  @scure/bip39@1.6.0
  (transitive)

• + Added

  abitype@1.2.3
  (transitive)

• + Added

  eventemitter3@5.0.1
  (transitive)

• + Added

  isows@1.0.7
  (transitive)

• + Added

  ox@0.14.29
  (transitive)

• + Added

  viem@2.54.1
  (transitive)

• + Added

  ws@8.20.1
  (transitive)

• - Removed

  @oclif/core@4.11.11
  (transitive)