@exayard/cli 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Individual subcommand implementations for the exayard CLI.
+ *
+ * Each command takes the parsed args + an `output` sink (defaults to console.log
+ * / console.error) so the dispatch layer can swap in a JSON-mode writer for
+ * `--json` consumers. Every command returns an exit code so `bin.ts` can
+ * propagate a stable exit status up to the shell.
+ */
+interface CommandContext {
+    flags: Record<string, string | boolean | undefined>;
+    positional: string[];
+    json: boolean;
+    write: (line: string) => void;
+    writeErr: (line: string) => void;
+}
+declare const COMMANDS: Record<string, (ctx: CommandContext) => Promise<number>>;
+
+/**
+ * Credential storage for the Exayard CLI.
+ *
+ * Written to ~/.exayard/config.json with mode 600 (readable only by the
+ * owner) — same pattern `gh`, `stripe`, and `vercel` use. Env vars take
+ * precedence so CI runs don't need to persist anything to disk.
+ *
+ * The file is intentionally tiny: api key + last-used org. Richer state
+ * (saved commands, history, etc.) can be added without changing the
+ * precedence rules.
+ */
+interface ExayardConfig {
+    apiKey?: string;
+    organizationId?: string;
+    baseUrl?: string;
+}
+declare const readConfig: () => ExayardConfig;
+declare const writeConfig: (config: ExayardConfig) => void;
+declare const clearConfig: () => void;
+
+export { COMMANDS, type ExayardConfig, clearConfig, readConfig, writeConfig };

package/dist/index.js

@@ -0,0 +1,612 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// ../sdk/dist/error.js
+var require_error = __commonJS({
+  "../sdk/dist/error.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ExayardError = void 0;
+    var ExayardError = class extends Error {
+      type;
+      title;
+      status;
+      detail;
+      instance;
+      code;
+      param;
+      docUrl;
+      requestId;
+      constructor(body) {
+        const title = body.title ?? "error";
+        const status = typeof body.status === "number" ? body.status : 0;
+        const code = body.code ?? `http_${status || "unknown"}`;
+        const detail = body.detail ?? "";
+        const message = detail ? `${title} (${code}): ${detail}` : `HTTP ${status || "unknown"}: ${title}`;
+        super(message);
+        this.name = "ExayardError";
+        this.type = body.type ?? "about:blank";
+        this.title = title;
+        this.status = status;
+        this.detail = detail;
+        this.instance = body.instance;
+        this.code = code;
+        this.param = body.param;
+        this.docUrl = body.doc_url;
+        this.requestId = body.request_id;
+      }
+      // Convenience guards for the most common branching points.
+      isRateLimited() {
+        return this.code === "rate_limited" || this.status === 429;
+      }
+      isUnauthenticated() {
+        return this.code === "unauthenticated" || this.status === 401;
+      }
+      isNotFound() {
+        return this.code === "not_found" || this.status === 404;
+      }
+      isInsufficientScope() {
+        return this.code === "insufficient_scope" || this.status === 403;
+      }
+      isIdempotencyConflict() {
+        return this.code === "idempotency_key_reused";
+      }
+    };
+    exports2.ExayardError = ExayardError;
+  }
+});
+
+// ../sdk/dist/webhooks.js
+var require_webhooks = __commonJS({
+  "../sdk/dist/webhooks.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.constructWebhookEvent = exports2.WebhookSignatureError = void 0;
+    var WebhookSignatureError2 = class extends Error {
+      code;
+      constructor(code, message) {
+        super(message);
+        this.name = "WebhookSignatureError";
+        this.code = code;
+      }
+    };
+    exports2.WebhookSignatureError = WebhookSignatureError2;
+    var REPLAY_WINDOW_SECONDS = 5 * 60;
+    var parseSignatureHeader = (header) => {
+      const parts = header.split(",").map((s) => s.trim());
+      let t;
+      let v1;
+      for (const part of parts) {
+        const eq = part.indexOf("=");
+        if (eq === -1)
+          continue;
+        const k = part.slice(0, eq);
+        const v = part.slice(eq + 1);
+        if (k === "t")
+          t = parseInt(v, 10);
+        if (k === "v1")
+          v1 = v;
+      }
+      if (t === void 0 || Number.isNaN(t) || !v1) {
+        throw new WebhookSignatureError2("malformed_header", `Exayard-Signature must be "t=<unix>,v1=<digest>" \u2014 got "${header}".`);
+      }
+      return { t, v1 };
+    };
+    var hmacSha256Base64 = async (secret, payload) => {
+      const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+      const digest = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
+      const bytes = new Uint8Array(digest);
+      let str = "";
+      for (let i = 0; i < bytes.length; i++)
+        str += String.fromCharCode(bytes[i]);
+      return btoa(str);
+    };
+    var safeCompare = (a, b) => {
+      if (a.length !== b.length)
+        return false;
+      let result = 0;
+      for (let i = 0; i < a.length; i++)
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+      return result === 0;
+    };
+    var constructWebhookEvent2 = async (rawBody, signatureHeader, secret, options = {}) => {
+      const { t, v1 } = parseSignatureHeader(signatureHeader);
+      const nowSec = Math.floor((options.now ?? Date.now()) / 1e3);
+      if (Math.abs(nowSec - t) > REPLAY_WINDOW_SECONDS) {
+        throw new WebhookSignatureError2("replay_window_exceeded", `Signature timestamp ${t} is outside the ${REPLAY_WINDOW_SECONDS}-second window (now=${nowSec}).`);
+      }
+      const expected = await hmacSha256Base64(secret, `${t}.${rawBody}`);
+      if (!safeCompare(expected, v1)) {
+        throw new WebhookSignatureError2("invalid_signature", "HMAC digest mismatch. Check the endpoint secret.");
+      }
+      return JSON.parse(rawBody);
+    };
+    exports2.constructWebhookEvent = constructWebhookEvent2;
+  }
+});
+
+// ../sdk/dist/client.js
+var require_client = __commonJS({
+  "../sdk/dist/client.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.Exayard = void 0;
+    var error_1 = require_error();
+    var webhooks_1 = require_webhooks();
+    var UNSAFE_METHODS = /* @__PURE__ */ new Set(["POST", "PATCH", "PUT", "DELETE"]);
+    var randomIdempotencyKey = () => {
+      if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
+        return `idem_${crypto.randomUUID().replace(/-/g, "")}`;
+      }
+      return `idem_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 10)}`;
+    };
+    var Exayard2 = class {
+      apiKey;
+      bearerToken;
+      baseUrl;
+      timeoutMs;
+      fetchImpl;
+      constructor(opts = {}) {
+        if (!opts.apiKey && !opts.bearerToken) {
+          throw new Error("Exayard: pass `apiKey` or `bearerToken` \u2014 see https://developers.exayard.com/api-reference.");
+        }
+        this.apiKey = opts.apiKey;
+        this.bearerToken = opts.bearerToken;
+        this.baseUrl = (opts.baseUrl ?? "https://api.exayard.com/v1").replace(/\/$/, "");
+        this.timeoutMs = opts.timeoutMs ?? 6e4;
+        this.fetchImpl = opts.fetch ?? fetch;
+      }
+      // Internal request primitive. Public resource methods compose this.
+      async request(opts) {
+        const url = new URL(`${this.baseUrl}${opts.path}`);
+        if (opts.query) {
+          for (const [k, v] of Object.entries(opts.query)) {
+            if (v !== void 0)
+              url.searchParams.set(k, String(v));
+          }
+        }
+        const headers = {
+          Accept: "application/json",
+          Authorization: `Bearer ${this.apiKey ?? this.bearerToken}`
+        };
+        if (opts.body !== void 0)
+          headers["Content-Type"] = "application/json";
+        const autoIdem = opts.autoIdempotencyKey ?? UNSAFE_METHODS.has(opts.method);
+        if (opts.idempotencyKey) {
+          headers["Idempotency-Key"] = opts.idempotencyKey;
+        } else if (autoIdem) {
+          headers["Idempotency-Key"] = randomIdempotencyKey();
+        }
+        const ac = new AbortController();
+        const timeout = setTimeout(() => ac.abort(), this.timeoutMs);
+        let res;
+        try {
+          res = await this.fetchImpl(url.toString(), {
+            method: opts.method,
+            headers,
+            body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+            signal: ac.signal
+          });
+        } finally {
+          clearTimeout(timeout);
+        }
+        if (!res.ok) {
+          const ct = res.headers.get("Content-Type") ?? "";
+          if (ct.includes("problem+json") || ct.includes("application/json")) {
+            const body = await res.json();
+            throw new error_1.ExayardError(body);
+          }
+          const text = await res.text().catch(() => "");
+          throw new error_1.ExayardError({
+            type: "https://developers.exayard.com/concepts/errors#transport_error",
+            title: "Transport Error",
+            status: res.status,
+            detail: text.slice(0, 500) || `HTTP ${res.status}`,
+            code: "transport_error",
+            doc_url: "https://developers.exayard.com/concepts/errors#transport_error",
+            request_id: res.headers.get("X-Request-Id") ?? void 0
+          });
+        }
+        if (res.status === 204)
+          return void 0;
+        return await res.json();
+      }
+      // ---------------------------------------------------------------------------
+      // Resource surface — a curated subset covering the flows agents and integrations
+      // most often hit. Full OpenAPI coverage can be layered on via generated code
+      // without changing the public shape of this client.
+      // ---------------------------------------------------------------------------
+      me = {
+        get: () => this.request({ method: "GET", path: "/me" })
+      };
+      projects = {
+        // GET /v1/projects returns a raw array (OpenAPI schema z.array(project));
+        // there is no { items, next_cursor } envelope and the endpoint accepts only
+        // organizationId/status/search (no limit/cursor pagination yet).
+        list: (query) => this.request({ method: "GET", path: "/projects", query }),
+        get: (id, query) => this.request({ method: "GET", path: `/projects/${id}`, query }),
+        create: (body, opts = {}) => this.request({ method: "POST", path: "/projects", body, idempotencyKey: opts.idempotencyKey }),
+        export: (id, query) => this.request({ method: "GET", path: `/projects/${id}/export`, query }),
+        archive: (id, query) => this.request({ method: "POST", path: `/projects/${id}/archive`, query })
+      };
+      help = {
+        search: (body) => this.request({ method: "POST", path: "/help/search", body, autoIdempotencyKey: false })
+      };
+      webhooks = {
+        listEndpoints: (query) => this.request({ method: "GET", path: "/webhook_endpoints", query }),
+        createEndpoint: (body) => this.request({ method: "POST", path: "/webhook_endpoints", body }),
+        deleteEndpoint: (id, query) => this.request({ method: "DELETE", path: `/webhook_endpoints/${id}`, query }),
+        listDeliveries: (id, query) => this.request({ method: "GET", path: `/webhook_endpoints/${id}/deliveries`, query }),
+        /**
+         * Parse + verify an inbound webhook delivery. Throws WebhookSignatureError
+         * on any signature failure — always catch and return 400 to let us retry.
+         */
+        constructEvent: webhooks_1.constructWebhookEvent
+      };
+    };
+    exports2.Exayard = Exayard2;
+  }
+});
+
+// ../sdk/dist/index.js
+var require_dist = __commonJS({
+  "../sdk/dist/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.WebhookSignatureError = exports2.constructWebhookEvent = exports2.ExayardError = exports2.Exayard = void 0;
+    var client_1 = require_client();
+    Object.defineProperty(exports2, "Exayard", { enumerable: true, get: function() {
+      return client_1.Exayard;
+    } });
+    var error_1 = require_error();
+    Object.defineProperty(exports2, "ExayardError", { enumerable: true, get: function() {
+      return error_1.ExayardError;
+    } });
+    var webhooks_1 = require_webhooks();
+    Object.defineProperty(exports2, "constructWebhookEvent", { enumerable: true, get: function() {
+      return webhooks_1.constructWebhookEvent;
+    } });
+    Object.defineProperty(exports2, "WebhookSignatureError", { enumerable: true, get: function() {
+      return webhooks_1.WebhookSignatureError;
+    } });
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  COMMANDS: () => COMMANDS,
+  clearConfig: () => clearConfig,
+  readConfig: () => readConfig,
+  writeConfig: () => writeConfig
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/commands.ts
+var import_sdk = __toESM(require_dist());
+
+// src/config.ts
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var configPath = () => (0, import_node_path.join)((0, import_node_os.homedir)(), ".exayard", "config.json");
+var readConfig = () => {
+  const fromEnv = {
+    apiKey: process.env.EXAYARD_API_KEY,
+    organizationId: process.env.EXAYARD_ORG_ID,
+    baseUrl: process.env.EXAYARD_BASE_URL
+  };
+  const path = configPath();
+  if (!(0, import_node_fs.existsSync)(path)) return fromEnv;
+  try {
+    const raw = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+    return { ...raw, ...Object.fromEntries(Object.entries(fromEnv).filter(([, v]) => v !== void 0 && v !== "")) };
+  } catch {
+    return fromEnv;
+  }
+};
+var writeConfig = (config) => {
+  const path = configPath();
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true });
+  (0, import_node_fs.writeFileSync)(path, JSON.stringify(config, null, 2));
+  try {
+    (0, import_node_fs.chmodSync)(path, 384);
+  } catch {
+  }
+};
+var clearConfig = () => {
+  try {
+    (0, import_node_fs.writeFileSync)(configPath(), JSON.stringify({}));
+  } catch {
+  }
+};
+
+// src/commands.ts
+var makeClient = (ctx) => {
+  const cfg = readConfig();
+  const apiKey = (typeof ctx.flags["api-key"] === "string" ? ctx.flags["api-key"] : void 0) ?? cfg.apiKey;
+  if (!apiKey) {
+    throw new Error("No API key. Run `exayard login` or set EXAYARD_API_KEY.");
+  }
+  return new import_sdk.Exayard({ apiKey, baseUrl: cfg.baseUrl });
+};
+var renderProject = (p) => {
+  const id = String(p._id ?? p.id ?? "???");
+  const name = String(p.name ?? "");
+  const status = String(p.status ?? "");
+  return `${id}	${status.padEnd(10)}	${name}`;
+};
+var loginCommand = async (ctx) => {
+  const pasted = typeof ctx.flags["api-key"] === "string" ? ctx.flags["api-key"] : void 0;
+  if (!pasted) {
+    ctx.writeErr("Paste an API key from https://exayard.com/settings/api-keys:");
+    ctx.writeErr("  exayard login --api-key sk_live_...");
+    return 2;
+  }
+  const orgId = typeof ctx.flags.org === "string" ? ctx.flags.org : void 0;
+  const baseUrl = (typeof ctx.flags["base-url"] === "string" ? ctx.flags["base-url"] : void 0) ?? readConfig().baseUrl;
+  writeConfig({ apiKey: pasted, organizationId: orgId, baseUrl });
+  const exa = new import_sdk.Exayard({ apiKey: pasted, baseUrl });
+  await exa.me.get();
+  ctx.write(ctx.json ? JSON.stringify({ ok: true }) : "Logged in. Token saved to ~/.exayard/config.json.");
+  return 0;
+};
+var projectsListCommand = async (ctx) => {
+  const exa = makeClient(ctx);
+  const cfg = readConfig();
+  const organizationId = (typeof ctx.flags.org === "string" ? ctx.flags.org : void 0) ?? cfg.organizationId;
+  if (!organizationId) {
+    ctx.writeErr("--org <organizationId> required (or set EXAYARD_ORG_ID).");
+    return 2;
+  }
+  const res = await exa.projects.list({ organizationId });
+  if (ctx.json) {
+    ctx.write(JSON.stringify(res, null, 2));
+  } else {
+    for (const item of res) {
+      ctx.write(renderProject(item));
+    }
+  }
+  return 0;
+};
+var webhooksListenCommand = async (ctx) => {
+  if (process.env.EXAYARD_EXPERIMENTAL !== "1") {
+    ctx.writeErr(
+      [
+        "exayard listen is not yet implemented.",
+        "",
+        "The tunnel implementation is still in progress. To preview the command",
+        "surface, set EXAYARD_EXPERIMENTAL=1 \u2014 but note the tunnel itself will not",
+        "forward events yet.",
+        "",
+        "For now, register a webhook endpoint pointing at a public tunnel",
+        "(ngrok, cloudflared) and verify signatures locally with:",
+        "",
+        '  echo "$RAW_BODY" | exayard webhooks verify --signature "$EXAYARD_SIGNATURE" --secret whsec_...'
+      ].join("\n")
+    );
+    return 2;
+  }
+  const forwardTo = typeof ctx.flags["forward-to"] === "string" ? ctx.flags["forward-to"] : void 0;
+  if (!forwardTo) {
+    ctx.writeErr("Usage: exayard listen --forward-to http://localhost:3000/webhook [--secret whsec_...]");
+    return 2;
+  }
+  ctx.writeErr(
+    [
+      `exayard listen \u2192 ${forwardTo}`,
+      "",
+      "[experimental] Tunnel implementation pending; command surface is stable but",
+      "no events will be forwarded. Track progress at https://developers.exayard.com."
+    ].join("\n")
+  );
+  return 0;
+};
+var webhooksVerifyCommand = async (ctx) => {
+  const signature = typeof ctx.flags.signature === "string" ? ctx.flags.signature : void 0;
+  const secret = typeof ctx.flags.secret === "string" ? ctx.flags.secret : process.env.EXAYARD_WEBHOOK_SECRET;
+  if (!signature || !secret) {
+    ctx.writeErr('Usage: cat body.json | exayard webhooks verify --signature "t=...,v1=..." --secret whsec_...');
+    return 2;
+  }
+  const body = await readAllStdin();
+  try {
+    const event = await (0, import_sdk.constructWebhookEvent)(body, signature, secret);
+    ctx.write(ctx.json ? JSON.stringify(event, null, 2) : `verified: ${event.type} (${event.id})`);
+    return 0;
+  } catch (err) {
+    if (err instanceof import_sdk.WebhookSignatureError) {
+      ctx.writeErr(`Signature invalid (${err.code}): ${err.message}`);
+    } else {
+      ctx.writeErr(`Verify failed: ${err.message}`);
+    }
+    return 1;
+  }
+};
+var readAllStdin = async () => {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  return await new Promise((resolve, reject) => {
+    process.stdin.on("data", (chunk) => chunks.push(chunk));
+    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    process.stdin.on("error", reject);
+  });
+};
+var helpSearchCommand = async (ctx) => {
+  const query = ctx.positional.join(" ").trim();
+  if (!query) {
+    ctx.writeErr('Usage: exayard help-search "<query>"');
+    return 2;
+  }
+  const exa = makeClient(ctx);
+  const res = await exa.help.search({ query, limit: Number(ctx.flags.limit) || void 0 });
+  if (ctx.json) {
+    ctx.write(JSON.stringify(res, null, 2));
+  } else {
+    for (const r of res.results) ctx.write(`${r.url}
+  ${r.title} \u2014 ${r.description}`);
+  }
+  return 0;
+};
+var resolveOrgId = (ctx) => {
+  const fromFlag = typeof ctx.flags.org === "string" ? ctx.flags.org : void 0;
+  return fromFlag ?? readConfig().organizationId ?? null;
+};
+var projectsCreateCommand = async (ctx) => {
+  const name = typeof ctx.flags.name === "string" ? ctx.flags.name : ctx.positional[0];
+  if (!name) {
+    ctx.writeErr('Usage: exayard projects create --name "<project name>" [--org org_...]');
+    return 2;
+  }
+  const organizationId = resolveOrgId(ctx);
+  if (!organizationId) {
+    ctx.writeErr("--org <organizationId> required (or set EXAYARD_ORG_ID).");
+    return 2;
+  }
+  const exa = makeClient(ctx);
+  const res = await exa.projects.create({ organizationId, name });
+  ctx.write(ctx.json ? JSON.stringify(res, null, 2) : `created	${res._id ?? res.id}	${name}`);
+  return 0;
+};
+var projectsArchiveCommand = async (ctx) => {
+  const id = typeof ctx.flags.id === "string" ? ctx.flags.id : ctx.positional[0];
+  if (!id) {
+    ctx.writeErr("Usage: exayard projects archive <project_id> [--org org_...]");
+    return 2;
+  }
+  const organizationId = resolveOrgId(ctx);
+  if (!organizationId) {
+    ctx.writeErr("--org <organizationId> required (or set EXAYARD_ORG_ID).");
+    return 2;
+  }
+  const exa = makeClient(ctx);
+  await exa.projects.archive(id, { organizationId });
+  ctx.write(ctx.json ? JSON.stringify({ ok: true, archived: id }) : `archived	${id}`);
+  return 0;
+};
+var webhooksListCommand = async (ctx) => {
+  const organizationId = resolveOrgId(ctx);
+  if (!organizationId) {
+    ctx.writeErr("--org <organizationId> required (or set EXAYARD_ORG_ID).");
+    return 2;
+  }
+  const exa = makeClient(ctx);
+  const res = await exa.webhooks.listEndpoints({ organizationId });
+  if (ctx.json) {
+    ctx.write(JSON.stringify(res, null, 2));
+  } else {
+    for (const ep of res) {
+      const id = String(ep.id ?? ep._id ?? "???");
+      const url = String(ep.url ?? "");
+      const events = Array.isArray(ep.events) ? ep.events.join(",") : "";
+      ctx.write(`${id}	${url}	${events}`);
+    }
+  }
+  return 0;
+};
+var webhooksCreateCommand = async (ctx) => {
+  const url = typeof ctx.flags.url === "string" ? ctx.flags.url : void 0;
+  const eventsFlag = typeof ctx.flags.events === "string" ? ctx.flags.events : void 0;
+  const description = typeof ctx.flags.description === "string" ? ctx.flags.description : void 0;
+  if (!url || !eventsFlag) {
+    ctx.writeErr('Usage: exayard webhooks create --url <https://...> --events "project.created,bid.generated" [--description "..."]');
+    return 2;
+  }
+  const organizationId = resolveOrgId(ctx);
+  if (!organizationId) {
+    ctx.writeErr("--org <organizationId> required (or set EXAYARD_ORG_ID).");
+    return 2;
+  }
+  const events = eventsFlag.split(",").map((s) => s.trim()).filter(Boolean);
+  const exa = makeClient(ctx);
+  const res = await exa.webhooks.createEndpoint({ organizationId, url, events, description });
+  if (ctx.json) {
+    ctx.write(JSON.stringify(res, null, 2));
+  } else {
+    ctx.write(`created	${res.id}	${url}`);
+    ctx.writeErr(`secret: ${res.secret}  (shown once \u2014 save it now)`);
+  }
+  return 0;
+};
+var webhooksDeleteCommand = async (ctx) => {
+  const id = typeof ctx.flags.id === "string" ? ctx.flags.id : ctx.positional[0];
+  if (!id) {
+    ctx.writeErr("Usage: exayard webhooks delete <endpoint_id> [--org org_...]");
+    return 2;
+  }
+  const organizationId = resolveOrgId(ctx);
+  if (!organizationId) {
+    ctx.writeErr("--org <organizationId> required (or set EXAYARD_ORG_ID).");
+    return 2;
+  }
+  const exa = makeClient(ctx);
+  await exa.webhooks.deleteEndpoint(id, { organizationId });
+  ctx.write(ctx.json ? JSON.stringify({ ok: true, deleted: id }) : `deleted	${id}`);
+  return 0;
+};
+var initCommand = async (ctx) => {
+  const { existsSync: existsSync2, writeFileSync: writeFileSync2 } = await import("fs");
+  const force = Boolean(ctx.flags.force);
+  if (existsSync2("agents.md") && !force) {
+    ctx.writeErr("agents.md already exists \u2014 pass --force to overwrite");
+    return 1;
+  }
+  const res = await fetch("https://exayard.com/agents.md");
+  if (!res.ok) {
+    ctx.writeErr(`Failed to fetch agents.md: ${res.status}`);
+    return 1;
+  }
+  const body = await res.text();
+  writeFileSync2("agents.md", body);
+  ctx.write(ctx.json ? JSON.stringify({ wrote: "agents.md", bytes: body.length }) : "Wrote agents.md");
+  return 0;
+};
+var COMMANDS = {
+  login: loginCommand,
+  "projects:list": projectsListCommand,
+  "projects:create": projectsCreateCommand,
+  "projects:archive": projectsArchiveCommand,
+  "webhooks:list": webhooksListCommand,
+  "webhooks:create": webhooksCreateCommand,
+  "webhooks:delete": webhooksDeleteCommand,
+  listen: webhooksListenCommand,
+  "webhooks:verify": webhooksVerifyCommand,
+  "help-search": helpSearchCommand,
+  init: initCommand
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  COMMANDS,
+  clearConfig,
+  readConfig,
+  writeConfig
+});

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@exayard/cli",
+  "version": "0.1.0",
+  "description": "Official CLI for the Exayard API",
+  "bin": {
+    "exayard": "./dist/bin.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup && chmod +x ./dist/bin.js",
+    "prepublishOnly": "yarn build",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@exayard/config-typescript": "*",
+    "@exayard/sdk": "workspace:*",
+    "@types/node": "22.19.0",
+    "tsup": "^8.4.0",
+    "typescript": "5.9.3"
+  }
+}