@banatie/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Banatie
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,54 @@
+# @banatie/cli
+
+Headless CLI for [Banatie](https://banatie.app) organization authentication and project management. Log in to your organization, create and manage projects, and connect a local repository to a project — all from the terminal, designed to be driven by humans or coding agents.
+
+Requires **Node >= 18** (uses the built-in global `fetch`).
+
+## Usage
+
+No install needed — run it with `npx`:
+
+```bash
+npx @banatie/cli <command>
+```
+
+### Backend selector
+
+Commands talk to `https://api.banatie.app` by default. Point at another backend with `BANATIE_API_BASE_URL`:
+
+```bash
+BANATIE_API_BASE_URL=http://localhost:3000 npx @banatie/cli org acme auth status
+```
+
+## Commands
+
+```
+banatie org <org-slug> login <bnt_boot-token>
+banatie org <org-slug> auth status
+banatie org <org-slug> auth logout
+banatie org <org-slug> auth revoke
+banatie org <org-slug> auth rotate
+banatie org <org-slug> project new <project-slug>
+banatie org <org-slug> project list
+banatie org <org-slug> project connect <project-slug> --project-root <path>
+banatie org <org-slug> project delete <project-slug> [<one-time-token>]
+banatie <project-api-key> connect [--project-root <path>]
+```
+
+- **login** — exchange the one-time `bnt_boot_` token for a permanent organization token and store it locally. The permanent token is never printed.
+- **auth status / logout / revoke / rotate** — inspect local login, remove it locally, revoke it server-side, or rotate the current organization token. Tokens are shown as previews only.
+- **project new / list** — create a project (returns a key preview and a connect command — never a raw key) and list the organization's projects (safe metadata only).
+- **project connect** — materialize the project credential inside the CLI and write it to `.banatie/project.json` under `--project-root`. The raw key is written to the file but never printed. Direct form: `banatie <project-api-key> connect` when you already hold a raw project key.
+- **project delete** — a guarded, two-step destructive flow: without a token it emails a one-time confirmation command (nothing is deleted); with the token it requires an interactive confirmation before deleting. Non-interactive deletion is refused.
+
+There is no `org bootstrap` command — a login link is requested from the Banatie web app / API and the one-time `login` command arrives by email.
+
+## Configuration & security
+
+- Login profiles are stored in `~/.banatie/config.json` (override the directory with `BANATIE_HOME`), scoped by backend URL + organization slug.
+- Permanent organization tokens and raw project keys are stored locally and **never printed** — commands show non-secret previews (`bnt_org_...abcd`) only.
+- `project connect` writes `.banatie/project.json` (holding the project key) and prints a recommendation to add `.banatie/` to your `.gitignore` so the key is never committed. The CLI does not edit `.gitignore` itself.
+
+## License
+
+MIT

package/dist/apiClient.d.ts

@@ -0,0 +1,102 @@
+export declare class ApiError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export interface LoginResult {
+    organization: {
+        id: string;
+        slug: string;
+        name?: string;
+        email: string;
+    };
+    token: string;
+    tokenPreview?: string;
+    configPath?: string;
+}
+export interface RotateResult {
+    token: string;
+    tokenPreview?: string;
+    previousTokenPreview?: string;
+}
+export interface RevokeResult {
+    status: string;
+    tokenPreview?: string;
+}
+export interface CreateProjectResult {
+    project: {
+        id: string;
+        slug: string;
+        name: string;
+    };
+    apiKey: {
+        id: string;
+        keyPreview: string;
+    };
+    commands: {
+        connect: string;
+    };
+    nextActions?: Array<{
+        type: string;
+        command?: string;
+    }>;
+}
+export interface CreateProjectApiKeyResult {
+    apiKey: {
+        id: string;
+        key: string;
+        keyPreview: string;
+        expiresAt: string;
+    };
+    nextActions?: Array<{
+        type: string;
+        command?: string;
+    }>;
+}
+export interface ListProjectsResult {
+    projects: Array<{
+        id: string;
+        slug: string;
+        name: string;
+        createdAt: string;
+    }>;
+    nextActions?: Array<{
+        type: string;
+        command?: string;
+    }>;
+}
+export interface ProjectDeleteRequestResult {
+    status: string;
+    message?: string;
+    nextActions?: Array<{
+        type: string;
+        command?: string;
+    }>;
+}
+export interface ProjectDeleteResult {
+    status: string;
+    projectSlug?: string;
+    nextActions?: Array<{
+        type: string;
+        command?: string;
+    }>;
+}
+/**
+ * Thin HTTP client for the Banatie organization API (Node 18+ global fetch).
+ * On failure it throws an ApiError carrying the HTTP status, with a safe,
+ * non-secret message — it never echoes the provider response body or any token.
+ */
+export declare class BanatieApiClient {
+    private readonly baseApiUrl;
+    constructor(baseApiUrl: string);
+    private post;
+    private get;
+    login(organizationSlug: string, bootToken: string): Promise<LoginResult>;
+    rotateCurrentToken(token: string): Promise<RotateResult>;
+    revokeCurrentToken(token: string): Promise<RevokeResult>;
+    createProject(token: string, projectSlug: string): Promise<CreateProjectResult>;
+    listProjects(token: string): Promise<ListProjectsResult>;
+    requestProjectDelete(token: string, projectSlug: string): Promise<ProjectDeleteRequestResult>;
+    confirmProjectDelete(token: string, projectSlug: string, deleteToken: string): Promise<ProjectDeleteResult>;
+    createProjectApiKey(token: string, projectSlug: string): Promise<CreateProjectApiKeyResult>;
+}
+//# sourceMappingURL=apiClient.d.ts.map

package/dist/apiClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AAAA,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK5C;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,UAAU,EAAE,MAAM;YAIhB,IAAI;YAuBJ,GAAG;IAmBX,KAAK,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAQxE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQxD,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAWxD,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAO/E,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAKxD,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,CAAC;IAShC,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC;IASzB,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,CAAC;CAOtC"}

package/dist/apiClient.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BanatieApiClient = exports.ApiError = void 0;
+class ApiError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = 'ApiError';
+        this.status = status;
+    }
+}
+exports.ApiError = ApiError;
+/**
+ * Thin HTTP client for the Banatie organization API (Node 18+ global fetch).
+ * On failure it throws an ApiError carrying the HTTP status, with a safe,
+ * non-secret message — it never echoes the provider response body or any token.
+ */
+class BanatieApiClient {
+    baseApiUrl;
+    constructor(baseApiUrl) {
+        this.baseApiUrl = baseApiUrl;
+    }
+    async post(path, safeErrorLabel, options = {}) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (options.token) {
+            headers['Authorization'] = `Bearer ${options.token}`;
+        }
+        const response = await fetch(`${this.baseApiUrl}${path}`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(options.body ?? {}),
+        });
+        if (!response.ok) {
+            throw new ApiError(`${safeErrorLabel} (HTTP ${response.status}).`, response.status);
+        }
+        return (await response.json());
+    }
+    async get(path, safeErrorLabel, options = {}) {
+        const headers = {};
+        if (options.token) {
+            headers['Authorization'] = `Bearer ${options.token}`;
+        }
+        const response = await fetch(`${this.baseApiUrl}${path}`, { method: 'GET', headers });
+        if (!response.ok) {
+            throw new ApiError(`${safeErrorLabel} (HTTP ${response.status}).`, response.status);
+        }
+        return (await response.json());
+    }
+    async login(organizationSlug, bootToken) {
+        return this.post('/api/v1/org/login', 'Login failed — the login link may be invalid or expired', { body: { organizationSlug, token: bootToken } });
+    }
+    async rotateCurrentToken(token) {
+        return this.post('/api/v1/org/auth/tokens/current/rotate', 'Token rotation failed', { token, body: {} });
+    }
+    async revokeCurrentToken(token) {
+        return this.post('/api/v1/org/auth/tokens/current/revoke', 'Token revoke failed', {
+            token,
+            body: {},
+        });
+    }
+    async createProject(token, projectSlug) {
+        return this.post('/api/v1/org/projects', 'Project creation failed', {
+            token,
+            body: { projectSlug },
+        });
+    }
+    async listProjects(token) {
+        return this.get('/api/v1/org/projects', 'Project list failed', { token });
+    }
+    // Step 1: request deletion — the server emails a one-time delete token, deletes nothing.
+    async requestProjectDelete(token, projectSlug) {
+        return this.post(`/api/v1/org/projects/${encodeURIComponent(projectSlug)}/delete-request`, 'Project delete request failed', { token, body: {} });
+    }
+    // Step 2: confirm deletion with the one-time delete token (distinct from the org Bearer token).
+    async confirmProjectDelete(token, projectSlug, deleteToken) {
+        return this.post(`/api/v1/org/projects/${encodeURIComponent(projectSlug)}/delete`, 'Project delete failed', { token, body: { token: deleteToken } });
+    }
+    // Materialize a raw project key for connect. Returns the plaintext key exactly once.
+    async createProjectApiKey(token, projectSlug) {
+        return this.post(`/api/v1/org/projects/${encodeURIComponent(projectSlug)}/api-keys`, 'Project connect failed', { token, body: {} });
+    }
+}
+exports.BanatieApiClient = BanatieApiClient;

package/dist/baseUrl.d.ts

@@ -0,0 +1,2 @@
+export declare const resolveBaseUrl: () => string;
+//# sourceMappingURL=baseUrl.d.ts.map

package/dist/baseUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseUrl.d.ts","sourceRoot":"","sources":["../src/baseUrl.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,QAAO,MAC6C,CAAC"}

package/dist/baseUrl.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBaseUrl = void 0;
+const DEFAULT_BASE_URL = 'https://api.banatie.app';
+// The backend is selected by BANATIE_API_BASE_URL; defaults to production.
+const resolveBaseUrl = () => (process.env['BANATIE_API_BASE_URL'] || DEFAULT_BASE_URL).replace(/\/+$/, '');
+exports.resolveBaseUrl = resolveBaseUrl;

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const dispatch_1 = require("./dispatch");
+(0, dispatch_1.run)(process.argv.slice(2))
+    .then((result) => {
+    for (const line of result.lines) {
+        console.log(line);
+    }
+    process.exit(result.exitCode);
+})
+    .catch((error) => {
+    console.error(error instanceof Error ? error.message : 'Command failed.');
+    process.exit(1);
+});

package/dist/commands/connectDirect.d.ts

@@ -0,0 +1,3 @@
+import type { CommandResult } from './types';
+export declare const connectDirectCommand: (projectApiKey: string, projectRoot: string) => CommandResult;
+//# sourceMappingURL=connectDirect.d.ts.map

package/dist/commands/connectDirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectDirect.d.ts","sourceRoot":"","sources":["../../src/commands/connectDirect.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAQ7C,eAAO,MAAM,oBAAoB,GAAI,eAAe,MAAM,EAAE,aAAa,MAAM,KAAG,aAyBjF,CAAC"}

package/dist/commands/connectDirect.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectDirectCommand = void 0;
+const baseUrl_1 = require("../baseUrl");
+const projectConfig_1 = require("../projectConfig");
+// A raw project key looks like `bnt_...` and is neither an org nor a bootstrap token.
+const isProjectKey = (key) => key.startsWith('bnt_') && !key.startsWith('bnt_org_') && !key.startsWith('bnt_boot_');
+// `<project-api-key> connect [--project-root <path>]`: write .banatie/project.json
+// from a raw key the caller already holds. Never re-prints the key.
+const connectDirectCommand = (projectApiKey, projectRoot) => {
+    if (!isProjectKey(projectApiKey)) {
+        return {
+            exitCode: 1,
+            lines: ['Invalid project API key. Expected a project key starting with "bnt_".'],
+        };
+    }
+    const baseApiUrl = (0, baseUrl_1.resolveBaseUrl)();
+    const configPath = (0, projectConfig_1.writeProjectConfig)(projectRoot, {
+        version: 1,
+        baseApiUrl,
+        apiKey: projectApiKey,
+        connectedAt: new Date().toISOString(),
+    });
+    return {
+        exitCode: 0,
+        lines: [
+            'Connected this repo to a Banatie project.',
+            `Wrote: ${configPath}`,
+            `Backend: ${baseApiUrl}`,
+            projectConfig_1.GITIGNORE_HINT,
+        ],
+    };
+};
+exports.connectDirectCommand = connectDirectCommand;

package/dist/commands/login.d.ts

@@ -0,0 +1,3 @@
+import type { CommandResult } from './types';
+export declare const loginCommand: (orgSlug: string, bootToken: string) => Promise<CommandResult>;
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAI7C,eAAO,MAAM,YAAY,GAAU,SAAS,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,aAAa,CA8B5F,CAAC"}

package/dist/commands/login.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loginCommand = void 0;
+const apiClient_1 = require("../apiClient");
+const baseUrl_1 = require("../baseUrl");
+const preview_1 = require("../preview");
+const config_1 = require("../config");
+// `org <slug> login <bnt_boot-token>`: exchange the one-time token for a permanent
+// org token and store it locally. The raw token is never printed — only a preview.
+const loginCommand = async (orgSlug, bootToken) => {
+    const baseApiUrl = (0, baseUrl_1.resolveBaseUrl)();
+    const client = new apiClient_1.BanatieApiClient(baseApiUrl);
+    try {
+        const result = await client.login(orgSlug, bootToken);
+        (0, config_1.upsertProfile)({
+            baseApiUrl,
+            orgSlug,
+            token: result.token,
+            ...(result.organization.id ? { orgId: result.organization.id } : {}),
+            ...(result.organization.email ? { email: result.organization.email } : {}),
+        });
+        const preview = result.tokenPreview ?? (0, preview_1.previewToken)(result.token);
+        return {
+            exitCode: 0,
+            lines: [
+                `Logged in to organization "${orgSlug}" (${result.organization.email ?? 'unknown email'}).`,
+                `Backend: ${baseApiUrl}`,
+                `Token: ${preview}`,
+                `Config: ${(0, config_1.getConfigPath)()}`,
+            ],
+        };
+    }
+    catch (error) {
+        return {
+            exitCode: 1,
+            lines: [error instanceof Error ? error.message : 'Login failed.'],
+        };
+    }
+};
+exports.loginCommand = loginCommand;

package/dist/commands/logout.d.ts

@@ -0,0 +1,3 @@
+import type { CommandResult } from './types';
+export declare const logoutCommand: (orgSlug: string) => CommandResult;
+//# sourceMappingURL=logout.d.ts.map

package/dist/commands/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/commands/logout.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAG7C,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,KAAG,aAe/C,CAAC"}

package/dist/commands/logout.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logoutCommand = void 0;
+const baseUrl_1 = require("../baseUrl");
+const config_1 = require("../config");
+// `org <slug> auth logout`: remove only the local profile; the server token stays valid.
+const logoutCommand = (orgSlug) => {
+    const baseApiUrl = (0, baseUrl_1.resolveBaseUrl)();
+    if (!(0, config_1.getProfile)(baseApiUrl, orgSlug)) {
+        return { exitCode: 0, lines: [`Not logged in to "${orgSlug}" on ${baseApiUrl}.`] };
+    }
+    (0, config_1.removeProfile)(baseApiUrl, orgSlug);
+    return {
+        exitCode: 0,
+        lines: [
+            `Logged out of "${orgSlug}" locally.`,
+            'Note: the organization token is still valid on the server. Run "auth revoke" to invalidate it.',
+        ],
+    };
+};
+exports.logoutCommand = logoutCommand;

package/dist/commands/projectConnect.d.ts

@@ -0,0 +1,3 @@
+import type { CommandResult } from './types';
+export declare const projectConnectCommand: (orgSlug: string, projectSlug: string, projectRoot: string) => Promise<CommandResult>;
+//# sourceMappingURL=projectConnect.d.ts.map

package/dist/commands/projectConnect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectConnect.d.ts","sourceRoot":"","sources":["../../src/commands/projectConnect.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAK7C,eAAO,MAAM,qBAAqB,GAChC,SAAS,MAAM,EACf,aAAa,MAAM,EACnB,aAAa,MAAM,KAClB,OAAO,CAAC,aAAa,CAuDvB,CAAC"}

package/dist/commands/projectConnect.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectConnectCommand = void 0;
+const apiClient_1 = require("../apiClient");
+const baseUrl_1 = require("../baseUrl");
+const config_1 = require("../config");
+const projectConfig_1 = require("../projectConfig");
+// `org <slug> project connect <project-slug> --project-root <path>`: use the saved
+// org token to materialize a project key inside the process, write it to
+// .banatie/project.json, and print only a preview — never the raw key or org token.
+const projectConnectCommand = async (orgSlug, projectSlug, projectRoot) => {
+    const baseApiUrl = (0, baseUrl_1.resolveBaseUrl)();
+    const profile = (0, config_1.getProfile)(baseApiUrl, orgSlug);
+    if (!profile) {
+        return {
+            exitCode: 1,
+            lines: [
+                `Not logged in to "${orgSlug}" on ${baseApiUrl}.`,
+                `Run: banatie org ${orgSlug} login <bnt_boot-token>`,
+            ],
+        };
+    }
+    const client = new apiClient_1.BanatieApiClient(baseApiUrl);
+    try {
+        const result = await client.createProjectApiKey(profile.token, projectSlug);
+        const configPath = (0, projectConfig_1.writeProjectConfig)(projectRoot, {
+            version: 1,
+            baseApiUrl,
+            apiKey: result.apiKey.key,
+            orgSlug,
+            projectSlug,
+            connectedAt: new Date().toISOString(),
+        });
+        return {
+            exitCode: 0,
+            lines: [
+                `Connected project "${projectSlug}" in "${orgSlug}" to Banatie.`,
+                `Wrote: ${configPath}`,
+                `Backend: ${baseApiUrl}`,
+                `Key: ${result.apiKey.keyPreview}`,
+                projectConfig_1.GITIGNORE_HINT,
+            ],
+        };
+    }
+    catch (error) {
+        if (error instanceof apiClient_1.ApiError) {
+            if (error.status === 404) {
+                return {
+                    exitCode: 1,
+                    lines: [`Project "${projectSlug}" not found in "${orgSlug}".`],
+                };
+            }
+            if (error.status === 401) {
+                return {
+                    exitCode: 1,
+                    lines: [`Your login has expired. Run: banatie org ${orgSlug} login <bnt_boot-token>`],
+                };
+            }
+        }
+        return {
+            exitCode: 1,
+            lines: [error instanceof Error ? error.message : 'Project connect failed.'],
+        };
+    }
+};
+exports.projectConnectCommand = projectConnectCommand;

package/dist/commands/projectDelete.d.ts

@@ -0,0 +1,7 @@
+import type { CommandResult } from './types';
+export interface ProjectDeleteDeps {
+    isTTY?: boolean;
+    confirm?: (projectSlug: string) => Promise<boolean>;
+}
+export declare const projectDeleteCommand: (orgSlug: string, projectSlug: string, deleteToken?: string, deps?: ProjectDeleteDeps) => Promise<CommandResult>;
+//# sourceMappingURL=projectDelete.d.ts.map

package/dist/commands/projectDelete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectDelete.d.ts","sourceRoot":"","sources":["../../src/commands/projectDelete.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD;AAMD,eAAO,MAAM,oBAAoB,GAC/B,SAAS,MAAM,EACf,aAAa,MAAM,EACnB,cAAc,MAAM,EACpB,OAAM,iBAAsB,KAC3B,OAAO,CAAC,aAAa,CAyFvB,CAAC"}

package/dist/commands/projectDelete.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectDeleteCommand = void 0;
+const apiClient_1 = require("../apiClient");
+const baseUrl_1 = require("../baseUrl");
+const config_1 = require("../config");
+const confirmPrompt_1 = require("../confirmPrompt");
+// `org <slug> project delete <project-slug> [<one-time-token>]`: two-step destructive delete.
+// Without a token, triggers the confirmation email. With a token, requires an explicit
+// interactive confirmation before deleting; non-interactive invocation is refused.
+// Neither the org token nor the raw delete token is ever echoed back.
+const projectDeleteCommand = async (orgSlug, projectSlug, deleteToken, deps = {}) => {
+    const baseApiUrl = (0, baseUrl_1.resolveBaseUrl)();
+    const profile = (0, config_1.getProfile)(baseApiUrl, orgSlug);
+    if (!profile) {
+        return {
+            exitCode: 1,
+            lines: [
+                `Not logged in to "${orgSlug}" on ${baseApiUrl}.`,
+                `Run: banatie org ${orgSlug} login <bnt_boot-token>`,
+            ],
+        };
+    }
+    const client = new apiClient_1.BanatieApiClient(baseApiUrl);
+    // Step 1: no token -> trigger the confirmation email, delete nothing.
+    if (!deleteToken) {
+        try {
+            await client.requestProjectDelete(profile.token, projectSlug);
+            return {
+                exitCode: 0,
+                lines: [
+                    `A one-time delete confirmation for "${projectSlug}" was emailed to the organization owner.`,
+                    'Nothing has been deleted yet. Run the one-time command from that email to confirm.',
+                ],
+            };
+        }
+        catch (error) {
+            if (error instanceof apiClient_1.ApiError) {
+                if (error.status === 404) {
+                    return { exitCode: 1, lines: [`Project "${projectSlug}" not found in "${orgSlug}".`] };
+                }
+                if (error.status === 401) {
+                    return {
+                        exitCode: 1,
+                        lines: [`Your login has expired. Run: banatie org ${orgSlug} login <bnt_boot-token>`],
+                    };
+                }
+            }
+            return {
+                exitCode: 1,
+                lines: [error instanceof Error ? error.message : 'Project delete request failed.'],
+            };
+        }
+    }
+    // Step 2: token present -> require explicit interactive confirmation before deleting.
+    const isTTY = deps.isTTY ?? Boolean(process.stdin.isTTY);
+    if (!isTTY) {
+        return {
+            exitCode: 1,
+            lines: [
+                'Refusing to delete non-interactively.',
+                `Run this in a terminal to confirm: banatie org ${orgSlug} project delete ${projectSlug} <one-time-token>`,
+            ],
+        };
+    }
+    const confirm = deps.confirm ?? confirmPrompt_1.promptDeleteConfirmation;
+    const confirmed = await confirm(projectSlug);
+    if (!confirmed) {
+        return { exitCode: 1, lines: ['Aborted. Nothing was deleted.'] };
+    }
+    try {
+        await client.confirmProjectDelete(profile.token, projectSlug, deleteToken);
+        return {
+            exitCode: 0,
+            lines: [`Deleted project "${projectSlug}" in "${orgSlug}".`],
+        };
+    }
+    catch (error) {
+        if (error instanceof apiClient_1.ApiError) {
+            if (error.status === 401) {
+                return {
+                    exitCode: 1,
+                    lines: [
+                        'The delete token is invalid or has expired.',
+                        `Request a new one: banatie org ${orgSlug} project delete ${projectSlug}`,
+                    ],
+                };
+            }
+            if (error.status === 404) {
+                return { exitCode: 1, lines: [`Project "${projectSlug}" not found in "${orgSlug}".`] };
+            }
+        }
+        return {
+            exitCode: 1,
+            lines: [error instanceof Error ? error.message : 'Project delete failed.'],
+        };
+    }
+};
+exports.projectDeleteCommand = projectDeleteCommand;

package/dist/commands/projectList.d.ts

@@ -0,0 +1,3 @@
+import type { CommandResult } from './types';
+export declare const projectListCommand: (orgSlug: string) => Promise<CommandResult>;
+//# sourceMappingURL=projectList.d.ts.map

package/dist/commands/projectList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectList.d.ts","sourceRoot":"","sources":["../../src/commands/projectList.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAI7C,eAAO,MAAM,kBAAkB,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,aAAa,CA4C/E,CAAC"}