@capgo/cli 8.0.0-alpha.4 → 8.0.0

package/dist/src/versionHelpers.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Auto-bump a semver version by incrementing the patch number
+ * @param currentVersion - The current version string (e.g., "1.0.0")
+ * @returns The bumped version or a fallback version if parsing fails
+ */
+export declare function autoBumpVersion(currentVersion: string): string;
+/**
+ * Interactively ask the user how to handle version bumping
+ * @param currentVersion - The current version
+ * @param context - Optional context string (e.g., "upload", "onboarding")
+ * @returns The new version string or null if cancelled
+ */
+export declare function interactiveVersionBump(currentVersion: string, context?: string): Promise<string | null>;
+/**
+ * Get suggestions for alternative versions when a version already exists
+ * @param existingVersion - The version that already exists
+ * @returns Array of suggested alternative versions
+ */
+export declare function getVersionSuggestions(existingVersion: string): string[];

package/package.json

@@ -1,16 +1,18 @@
 {
   "name": "@capgo/cli",
-  "version": "8.0.0-alpha.4",
+  "type": "module",
+  "version": "8.0.0",
   "description": "A CLI to upload to capgo servers",
   "author": "Martin martin@capgo.app",
   "license": "Apache 2.0",
-  "homepage": "https://github.com/Cap-go/CLI#readme",
+  "homepage": "https://github.com/Cap-go/capgo/tree/main/cli#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Cap-go/CLI.git"
+    "url": "git+https://github.com/Cap-go/capgo.git",
+    "directory": "cli"
   },
   "bugs": {
-    "url": "https://github.com/Cap-go/CLI/issues"
+    "url": "https://github.com/Cap-go/capgo/issues"
   },
   "keywords": [
     "appflow alternative",
@@ -22,7 +24,8 @@
     "cli",
     "upload",
     "capgo-cli",
-    "sdk"
+    "sdk",
+    "tanstack-intent"
   ],
   "exports": {
     ".": {
@@ -31,8 +34,7 @@
     },
     "./sdk": {
       "types": "./dist/src/sdk.d.ts",
-      "import": "./dist/src/sdk.js",
-      "require": "./dist/src/sdk.js"
+      "import": "./dist/src/sdk.js"
     }
   },
   "main": "dist/index.js",
@@ -40,18 +42,26 @@
   "bin": {
     "capgo": "dist/index.js"
   },
+  "files": [
+    "!skills/_artifacts",
+    "dist",
+    "skills"
+  ],
   "engines": {
     "npm": ">=8.0.0",
     "node": ">=20.0.0"
   },
   "scripts": {
-    "build": "tsc && node build.mjs",
+    "build": "tsc && bun build.mjs",
     "dev": "NODE_ENV=development ncc build",
     "no-debug": "node dist/index.js",
     "dev-build": "SUPA_DB=development ncc build",
     "pack": "pkg",
-    "types": "npx --yes supabase gen types typescript --project-id=xvwzpoazmxkqosrdewyv > src/types/supabase.types.ts",
-    "lint": "eslint \"src/**/*.ts\" --fix",
+    "types": "bunx --bun supabase gen types typescript --project-id=xvwzpoazmxkqosrdewyv > src/types/supabase.types.ts",
+    "typecheck": "tsgo --project tsconfig.tsgo.json --noEmit",
+    "lint": "bun run lint:ox",
+    "lint:ox": "oxlint --config ../.oxlintrc.json src",
+    "lint:fix": "oxlint --config ../.oxlintrc.json --fix src",
     "check-posix-paths": "node test/check-posix-paths.js",
     "generate-docs": "node dist/index.js generate-docs README.md",
     "test:bundle": "bun test/test-bundle.mjs",
@@ -60,34 +70,115 @@
     "test:version-edge-cases": "bun test/test-version-validation.mjs",
     "test:regex": "bun test/test-regex-validation.mjs",
     "test:upload": "bun test/test-upload-validation.mjs",
-    "test": "bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload"
+    "test:fail-on-incompatible": "bun test/test-fail-on-incompatible.mjs",
+    "test:credentials": "bun test/test-credentials.mjs",
+    "test:credentials-validation": "bun test/test-credentials-validation.mjs",
+    "test:android-service-account-validation": "bun test/test-android-service-account-validation.mjs",
+    "test:build-zip-filter": "bun test/test-build-zip-filter.mjs",
+    "test:checksum": "bun test/test-checksum-algorithm.mjs",
+    "test:build-needed": "bun test/test-build-needed.mjs",
+    "test:ci-prompts": "bun test/test-ci-prompts.mjs",
+    "test:ci-secrets": "bun test/test-ci-secrets.mjs",
+    "test:android-onboarding-progress": "bun test/test-android-onboarding-progress.mjs",
+    "test:onboarding-telemetry": "bun test/test-onboarding-telemetry.mjs",
+    "test:v2-event-migration": "bun test/test-v2-event-migration.mjs",
+    "test:analytics": "bun test/test-analytics.mjs",
+    "test:analytics-error-category": "bun test/test-analytics-error-category.mjs",
+    "test:analytics-org-resolver": "bun test/test-analytics-org-resolver.mjs",
+    "test:supabase-perf": "bun test/test-supabase-perf.mjs",
+    "test:mcp-analytics": "bun test/test-mcp-analytics.mjs",
+    "test:app-created-source": "bun test/test-app-created-source.mjs",
+    "test:doctor-analytics": "bun test/test-doctor-analytics.mjs",
+    "test:posthog-exception": "bun test/test-posthog-exception.mjs",
+    "test:onboarding-recovery": "bun test/test-onboarding-recovery.mjs",
+    "test:onboarding-progress": "bun test/test-onboarding-progress.mjs",
+    "test:onboarding-run-targets": "bun test/test-onboarding-run-targets.mjs",
+    "test:run-device-command": "bun test/test-run-device-command.mjs",
+    "test:init-app-conflict": "bun test/test-init-app-conflict.mjs",
+    "test:init-guardrails": "bun test/test-init-guardrails.mjs",
+    "test:prompt-preferences": "bun test/test-prompt-preferences.mjs",
+    "test:esm-sdk": "node test/test-sdk-esm.mjs",
+    "test:mcp": "node test/test-mcp.mjs",
+    "test:version-detection": "node test/test-get-installed-version.mjs",
+    "test:version-detection:setup": "./test/fixtures/setup-test-projects.sh",
+    "test:platform-paths": "bun test/test-platform-paths.mjs",
+    "test:payload-split": "bun test/test-payload-split.mjs",
+    "test:macos-signing": "bun test/test-macos-signing.mjs",
+    "test:apple-api-import-helpers": "bun test/test-apple-api-import-helpers.mjs",
+    "test:bundle-id-detector": "bun test/test-bundle-id-detector.mjs",
+    "test:apple-api-app-list": "bun test/test-apple-api-app-list.mjs",
+    "test:app-verification": "bun test/test-app-verification.mjs",
+    "test:pbxproj-parser": "bun test/test-pbxproj-parser.mjs",
+    "test:manifest-path-encoding": "bun test/test-manifest-path-encoding.mjs",
+    "test": "bun run build && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:fail-on-incompatible && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:android-onboarding-progress && bun run test:onboarding-telemetry && bun run test:v2-event-migration && bun run test:analytics && bun run test:analytics-error-category && bun run test:analytics-org-resolver && bun run test:supabase-perf && bun run test:mcp-analytics && bun run test:app-created-source && bun run test:doctor-analytics && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:version-detection && bun run test:platform-paths && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:apple-api-import-helpers && bun run test:bundle-id-detector && bun run test:apple-api-app-list && bun run test:app-verification && bun run test:pbxproj-parser && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:ai-sse-parser && bun run test:ai-render-markdown && bun run test:ai-stream-markdown && bun run test:ai-onboarding-mode && bun run test:ai-fit && bun run test:platform-layout && bun run test:frame-fit && bun run test:onboarding-min-size && bun run test:min-size-gate && bun run test:shell-size-gate && bun run test:build-log-sanitize && bun run test:build-output-viewport && bun run test:diff-viewer-viewport && bun run test:build-complete-exit && bun run test:ai-analyze-stream",
+    "test:build-platform-selection": "bun test/test-build-platform-selection.mjs",
+    "test:ai-log-capture": "bun test/test-ai-log-capture.mjs",
+    "test:ai-analyze-flow": "bun test/test-ai-analyze-flow.mjs",
+    "test:ai-analyze-stream": "bun test/test-ai-analyze-stream.mjs",
+    "test:ai-sse-parser": "bun test/test-ai-sse-parser.mjs",
+    "test:ai-render-markdown": "bun test/test-ai-render-markdown.mjs",
+    "test:ai-onboarding-mode": "bun test/test-ai-onboarding-mode.mjs",
+    "test:ai-fit": "bun test/test-ai-fit.mjs",
+    "test:platform-layout": "bun test/test-platform-layout.mjs",
+    "test:frame-fit": "bun test/run-frame-fit.mjs",
+    "test:onboarding-min-size": "bun test/test-onboarding-min-size.mjs",
+    "test:min-size-gate": "bun test/test-min-size-gate.mjs",
+    "test:shell-size-gate": "bun test/test-shell-size-gate.mjs",
+    "test:build-log-sanitize": "bun test/test-build-log-sanitize.mjs",
+    "test:build-output-viewport": "bun test/test-build-output-viewport.mjs",
+    "test:diff-viewer-viewport": "bun test/test-diff-viewer-viewport.mjs",
+    "test:build-complete-exit": "bun test/test-build-complete-exit.mjs",
+    "test:ai-stream-markdown": "bun test/test-ai-stream-markdown.mjs"
+  },
+  "dependencies": {
+    "@inkjs/ui": "^2.0.0",
+    "ink": "^7.0.4",
+    "ink-spinner": "^5.0.0",
+    "jsonwebtoken": "^9.0.3",
+    "node-forge": "^1.4.0",
+    "qrcode": "^1.5.4",
+    "react": "^19.2.6",
+    "string-width": "^8.2.1"
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^6.1.0",
-    "@bradenmacdonald/s3-lite-client": "npm:@jsr/bradenmacdonald__s3-lite-client@0.9.4",
-    "@capacitor/cli": "^7.4.4",
+    "@antfu/eslint-config": "^9.0.0",
+    "@bradenmacdonald/s3-lite-client": "npm:@jsr/bradenmacdonald__s3-lite-client@0.9.6",
+    "@capacitor/cli": "^8.3.4",
     "@capgo/find-package-manager": "^0.0.18",
-    "@clack/prompts": "^0.11.0",
+    "@clack/prompts": "^1.4.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@sauber/table": "npm:@jsr/sauber__table",
-    "@std/semver": "npm:@jsr/std__semver@1.0.6",
-    "@supabase/supabase-js": "^2.79.0",
-    "@types/adm-zip": "^0.5.7",
-    "@types/node": "^24.9.1",
+    "@std/semver": "npm:@jsr/std__semver@1.0.8",
+    "@supabase/supabase-js": "^2.106.2",
+    "@tanstack/intent": "^0.0.41",
+    "@types/adm-zip": "^0.5.8",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^25.9.1",
+    "@types/node-forge": "^1.3.14",
     "@types/prettyjson": "^0.0.33",
+    "@types/qrcode": "^1.5.6",
+    "@types/react": "^19.2.15",
     "@types/tmp": "^0.2.6",
+    "@types/ws": "^8.18.1",
+    "@typescript/native-preview": "7.0.0-dev.20260526.1",
     "@vercel/ncc": "^0.38.4",
-    "adm-zip": "^0.5.16",
-    "ci-info": "^4.3.1",
-    "commander": "^14.0.2",
-    "esbuild": "^0.25.11",
-    "eslint": "^9.38.0",
-    "git-format-staged": "3.1.1",
+    "@xterm/headless": "^6.0.0",
+    "adm-zip": "^0.5.17",
+    "ci-info": "^4.4.0",
+    "commander": "^14.0.3",
+    "eslint": "^10.4.0",
+    "git-format-staged": "4.0.1",
     "husky": "^9.1.7",
-    "is-wsl": "^3.1.0",
-    "open": "^10.1.2",
+    "is-wsl": "^3.1.1",
+    "micromatch": "^4.0.8",
+    "open": "^11.0.0",
+    "oxlint": "^1.67.0",
+    "partysocket": "^1.1.19",
     "prettyjson": "^1.2.5",
-    "tmp": "^0.2.5",
+    "tmp": "^0.2.6",
     "tus-js-client": "^4.3.1",
-    "typescript": "^5.9.3"
+    "typescript": "^6.0.3",
+    "ws": "^8.21.0",
+    "zod": "^4.4.3"
   }
 }

package/skills/native-builds/SKILL.md

@@ -0,0 +1,255 @@
+---
+name: native-builds
+description: Use when working with Capgo Cloud native iOS and Android build requests, onboarding, credential storage, credential updates, and build output upload settings.
+---
+
+# Capgo CLI Native Builds
+
+Use this skill for Capgo Cloud native iOS and Android build workflows.
+
+## Onboarding (automated iOS setup)
+
+### `build init` (alias: `build onboarding`)
+
+- Interactive command that automates iOS certificate and provisioning profile creation.
+- Reduces iOS setup from ~10 manual steps to 1 manual step (creating an API key) + 1 command.
+- Example: `npx @capgo/cli@latest build init`
+- Backward compatibility: `npx @capgo/cli@latest build onboarding` still works.
+- Options:
+  - `-a, --apikey <apikey>` — Capgo API key to authenticate with (alternative to the `CAPGO_TOKEN` env var or `~/.capgo` / local `.capgo` file). Takes precedence over a saved key when both are present. Lets the SaaS onboarding wizard render a single copy-pasteable command across bash, zsh, fish, PowerShell, and cmd.exe.
+  - Example: `npx @capgo/cli@latest build init -a cap_xxx`
+- Notes:
+  - Uses Ink (React for terminal) for the interactive UI, alongside the main `init` onboarding flow.
+  - Requires running inside a Capacitor project directory with an `ios/` folder.
+  - The user creates ONE App Store Connect API key (.p8 file), then the CLI handles everything else.
+  - On macOS, offers a native file picker dialog for .p8 selection.
+  - Auto-detects Key ID from .p8 filename (e.g. `AuthKey_XXXX.p8`).
+  - Progress persists in `~/.capgo-credentials/onboarding/<appId>.json` — safe to interrupt and resume.
+  - Saves credentials to the same `~/.capgo-credentials/credentials.json` used by `build request`.
+  - Optionally kicks off the first build at the end.
+  - If the native `ios/` folder is missing, onboarding can offer to run `cap add ios` automatically instead of exiting immediately.
+  - Unexpected failures now keep the user inside the recovery screen, show package-manager-aware commands, and save a support bundle under `~/.capgo-credentials/support/`.
+
+#### What it automates (iOS)
+
+1. Verifies the API key with Apple
+2. Generates CSR + creates an `IOS_DISTRIBUTION` certificate via the App Store Connect API
+3. Registers or reuses the bundle ID
+4. Creates an `IOS_APP_STORE` provisioning profile
+5. Saves all credentials (certificate as .p12, profile, API key, team ID)
+6. Requests the first cloud build
+
+#### Conflict resolution
+
+- **Certificate limit reached**: lists existing certs, tags ones created by Capgo onboarding, lets the user pick one to revoke, then retries.
+- **Duplicate provisioning profiles**: detects profiles matching the `Capgo <appId> AppStore` naming pattern, deletes them, and retries.
+- **Existing credentials**: offers to backup existing credentials before proceeding, or exit onboarding.
+
+#### Architecture
+
+- `src/build/onboarding/command.ts` — entry point, launches Ink
+- `src/build/onboarding/apple-api.ts` — JWT auth + App Store Connect API (verify, create cert, create profile, revoke, delete)
+- `src/build/onboarding/csr.ts` — CSR generation + P12 creation via `node-forge`
+- `src/build/onboarding/progress.ts` — per-app progress persistence
+- `src/build/onboarding/file-picker.ts` — macOS native file picker via `osascript`
+- `src/build/onboarding/ui/app.tsx` — Ink app (state machine)
+- `src/build/onboarding/ui/components.tsx` — reusable UI components
+
+#### BuildLogger callback interface
+
+`requestBuildInternal` accepts an optional `BuildLogger` to receive log output via callbacks instead of writing directly to stdout. This enables clean integration with the Ink UI:
+
+```typescript
+interface BuildLogger {
+  info: (msg: string) => void
+  error: (msg: string) => void
+  warn: (msg: string) => void
+  success: (msg: string) => void
+  buildLog: (msg: string) => void
+  uploadProgress: (percent: number) => void
+}
+```
+
+---
+
+## Core build request
+
+### `build needed [appId]`
+
+- Example: `npx @capgo/cli@latest build needed com.example.app --channel production --verbose`
+- Prints `yes` or `no` and exits with code `1` only when local native dependency metadata requires a new native build.
+- If `--channel` is omitted, it uses `plugins.CapacitorUpdater.defaultChannel` from local config, then the public default channel in Capgo Cloud.
+- Key options:
+  - `-c, --channel <channel>`
+  - `--verbose`
+  - `--package-json <packageJson>`
+  - `--node-modules <nodeModules>`
+
+### `build request [appId]`
+
+- Example: `npx @capgo/cli@latest build request com.example.app --platform ios --path .`
+- Notes:
+  - Zips the current project directory and uploads it to Capgo for building.
+  - Builds are processed for store distribution.
+  - Credentials are never stored permanently on Capgo servers.
+  - Build outputs can be uploaded for time-limited download links.
+  - Before requesting a build, save credentials with `build credentials save`.
+- Core options:
+  - `--path <path>`
+  - `--node-modules <nodeModules>`: paths to `node_modules` directories for monorepos, comma-separated.
+  - `--platform <platform>`: `ios` or `android`. If omitted in an interactive terminal, the CLI prompts for the platform; non-interactive runs must pass it explicitly.
+  - `--build-mode <buildMode>`: `debug` or `release`.
+  - `-a, --apikey <apikey>`
+  - `--verbose`
+
+#### iOS request options
+
+- `--build-certificate-base64 <cert>`
+- `--p12-password <password>`
+- `--apple-id <email>`
+- `--apple-app-specific-password <password>`
+- `--apple-key-id <id>`
+- `--apple-issuer-id <id>`
+- `--apple-key-content <content>`
+- `--app-store-connect-team-id <id>`
+- `--ios-scheme <scheme>`
+- `--ios-target <target>`
+- `--ios-distribution <mode>`: `app_store` or `ad_hoc`
+- `--ios-provisioning-profile <mapping>`: repeatable path or `bundleId=path`
+
+#### Android request options
+
+- `--android-keystore-file <keystore>`
+- `--keystore-key-alias <alias>`
+- `--keystore-key-password <password>`
+- `--keystore-store-password <password>`
+- `--play-config-json <json>`
+- `--android-flavor <flavor>`
+- `--in-app-update-priority <0-5>`: Google Play in-app update priority (higher = more urgent)
+
+#### Output behavior options
+
+- `--no-playstore-upload`: skip Play Store upload for the build, requires `--output-upload`
+- `--output-upload`
+- `--no-output-upload`
+- `--output-retention <duration>`: `1h` to `7d`
+- `--skip-build-number-bump`
+- `--no-skip-build-number-bump`
+
+## Local credential management
+
+Credentials are stored locally, either globally in `~/.capgo-credentials/credentials.json` or locally in `.capgo-credentials.json`.
+
+### `build credentials save`
+
+- Required before build requests.
+- Supports global storage by default and local storage with `--local`.
+- Example iOS flow:
+
+```bash
+npx @capgo/cli build credentials save --platform ios \
+  --certificate ./cert.p12 --p12-password "password" \
+  --ios-provisioning-profile ./profile.mobileprovision \
+  --apple-key ./AuthKey.p8 --apple-key-id "KEY123" \
+  --apple-issuer-id "issuer-uuid" --apple-team-id "team-id"
+```
+
+- Example multi-target iOS flow:
+
+```bash
+npx @capgo/cli build credentials save --platform ios \
+  --ios-provisioning-profile ./App.mobileprovision \
+  --ios-provisioning-profile com.example.widget=./Widget.mobileprovision
+```
+
+- Example Android flow:
+
+```bash
+npx @capgo/cli build credentials save --platform android \
+  --keystore ./release.keystore --keystore-alias "my-key" \
+  --keystore-key-password "key-pass" \
+  --play-config ./service-account.json
+```
+
+- Core options:
+  - `--appId <appId>`
+  - `--platform <platform>`
+  - `--local`
+  - `--output-upload`, `--no-output-upload`
+  - `--output-retention <duration>`
+  - `--skip-build-number-bump`, `--no-skip-build-number-bump`
+
+#### iOS credential save options
+
+- `--certificate <path>`
+- `--ios-provisioning-profile <mapping>`
+- `--p12-password <password>`
+- `--apple-key <path>`
+- `--apple-key-id <id>`
+- `--apple-issuer-id <id>`
+- `--apple-team-id <id>`
+- `--ios-distribution <mode>`
+- `--apple-id <email>`
+- `--apple-app-password <password>`
+
+#### Android credential save options
+
+- `--keystore <path>`
+- `--keystore-alias <alias>`
+- `--keystore-key-password <password>`
+- `--keystore-store-password <password>`
+- `--play-config <path>`
+- `--android-flavor <flavor>`
+
+### `build credentials list`
+
+- Examples:
+  - `npx @capgo/cli build credentials list`
+  - `npx @capgo/cli build credentials list --appId com.example.app`
+- Options:
+  - `--appId <appId>`
+  - `--local`
+
+### `build credentials clear`
+
+- Examples:
+  - `npx @capgo/cli build credentials clear`
+  - `npx @capgo/cli build credentials clear --local`
+  - `npx @capgo/cli build credentials clear --appId com.example.app --platform ios`
+- Options:
+  - `--appId <appId>`
+  - `--platform <platform>`
+  - `--local`
+
+### `build credentials update`
+
+- Use to update specific credential fields without re-entering all data.
+- Platform is auto-detected from the supplied options.
+- Examples:
+  - `npx @capgo/cli build credentials update --ios-provisioning-profile ./new-profile.mobileprovision`
+  - `npx @capgo/cli build credentials update --local --keystore ./new-keystore.jks`
+- Core options:
+  - `--appId <appId>`
+  - `--platform <platform>`
+  - `--local`
+  - `--overwrite-ios-provisioning-map`
+  - `--output-upload`, `--no-output-upload`
+  - `--output-retention <duration>`
+  - `--skip-build-number-bump`, `--no-skip-build-number-bump`
+- Supports the same iOS and Android credential fields as `build credentials save`.
+
+### `build credentials migrate`
+
+- Example: `npx @capgo/cli build credentials migrate --platform ios`
+- Notes:
+  - Converts `BUILD_PROVISION_PROFILE_BASE64` to `CAPGO_IOS_PROVISIONING_MAP`.
+  - Discovers the main bundle ID from the Xcode project automatically.
+- Options:
+  - `--appId <appId>`
+  - `--platform <platform>`: only `ios`
+  - `--local`
+
+## Supporting docs
+
+- iOS setup: `https://capgo.app/docs/cli/cloud-build/ios/`
+- Android setup: `https://capgo.app/docs/cli/cloud-build/android/`

package/skills/organization-management/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: organization-management
+description: Use when working with Capgo account lookup, organization administration, member security settings, and deprecated organisation aliases.
+---
+
+# Capgo CLI Organization Management
+
+Use this skill for account and organization administration commands.
+
+## Account command
+
+### `account id`
+
+- Example: `npx @capgo/cli@latest account id`
+- Use to retrieve an account ID that is safe to share for collaboration or support.
+- Key option:
+  - `-a, --apikey <apikey>`
+
+## Organization commands
+
+### `organization list`
+
+- Alias: `l`
+- Example: `npx @capgo/cli@latest organization list`
+- Lists all organizations the current user can access.
+
+### `organization add`
+
+- Alias: `a`
+- Example: `npx @capgo/cli@latest organization add --name "My Company" --email admin@mycompany.com`
+- Key options:
+  - `-n, --name <name>`
+  - `-e, --email <email>`
+
+### `organization members [orgId]`
+
+- Alias: `m`
+- Example: `npx @capgo/cli@latest organization members ORG_ID`
+- Notes:
+  - Lists members, roles, and 2FA status.
+  - Useful before enabling 2FA enforcement.
+  - Viewing 2FA status requires `super_admin` rights.
+
+### `organization set [orgId]`
+
+- Alias: `s`
+- Example: `npx @capgo/cli@latest organization set ORG_ID --name "New Name"`
+- Security examples:
+  - `npx @capgo/cli@latest organization set ORG_ID --enforce-2fa`
+  - `npx @capgo/cli@latest organization set ORG_ID --password-policy --min-length 12`
+  - `npx @capgo/cli@latest organization set ORG_ID --require-apikey-expiration --max-apikey-expiration-days 90`
+  - `npx @capgo/cli@latest organization set ORG_ID --enforce-hashed-api-keys`
+- Notes:
+  - Security settings require `super_admin` role.
+- Key options:
+  - `-n, --name <name>`
+  - `-e, --email <email>`
+  - `--enforce-2fa`, `--no-enforce-2fa`
+  - `--password-policy`, `--no-password-policy`
+  - `--min-length <minLength>`
+  - `--require-uppercase`, `--no-require-uppercase`
+  - `--require-number`, `--no-require-number`
+  - `--require-special`, `--no-require-special`
+  - `--require-apikey-expiration`, `--no-require-apikey-expiration`
+  - `--max-apikey-expiration-days <days>`
+  - `--enforce-hashed-api-keys`, `--no-enforce-hashed-api-keys`
+
+### `organization delete [orgId]`
+
+- Alias: `d`
+- Example: `npx @capgo/cli@latest organization delete ORG_ID`
+- Notes:
+  - This action cannot be undone.
+  - Only organization owners can delete organizations.
+
+## Deprecated aliases
+
+The `organisation` command group is deprecated in favor of `organization` and will be removed in a future version.
+
+### Deprecated commands
+
+- `organisation list`
+- `organisation add`
+- `organisation set [orgId]`
+- `organisation delete [orgId]`
+
+Use the `organization` equivalents for all new documentation and examples.
+
+## Shared options
+
+Most account and organization commands support:
+
+- `-a, --apikey <apikey>`