@exayard/cli 0.2.0 → 0.5.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Exayard
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -15,21 +15,36 @@ npx @exayard/cli --help
 
 ## Authenticate
 
-Generate an API key with the minimum scopes you need at
-[exayard.com/settings/developer](https://exayard.com/settings/developer), then:
+Sign in in the browser:
 
 ```bash
-exayard login --api-key sk_live_...
+exayard login
 ```
 
-Credentials are saved to `~/.exayard/config.json`. You can also pass
-`--api-key` / `--org` per call, or set `EXAYARD_API_KEY`.
+The CLI opens the sign-in page (and prints its address, in case no browser
+opens), then saves the session. Calls are made as you, in your companies. If
+you belong to one company it is saved; otherwise pass `--org <id>` to `login`
+or to each call.
+
+Or use an API key made in an app at
+[exayard.com/settings/developer](https://exayard.com/settings/developer):
+
+```bash
+exayard login --api-key exa_live_...
+```
+
+A key made for a company acts in that company, so no `--org` is needed.
+
+Credentials are saved to `~/.exayard/config.json`, readable only by you. A
+saved session renews itself; run `exayard login` again if it ends. You can also
+pass `--api-key` / `--org` per call, or set `EXAYARD_API_KEY` and
+`EXAYARD_ORG_ID` (a key always wins over a browser session).
 
 ## Commands
 
 ```
 Projects:
-  exayard projects list --org org_...
+  exayard projects list
   exayard projects create --name "<name>"
   exayard projects archive <project_id>
 
@@ -38,20 +53,57 @@ Webhooks:
   exayard webhooks create --url <https://...> --events "project.created,bid.generated"
   exayard webhooks delete <endpoint_id>
   exayard webhooks verify --signature ... --secret ... < body.json
-  exayard listen --forward-to http://localhost:...   (experimental)
+  exayard listen --forward-to http://localhost:3000/webhooks [--events a,b]
 
 Help / misc:
   exayard help-search "how do I run a takeoff"
   exayard init                                       Drop agents.md into the cwd
 ```
 
+### Receive webhooks on your computer
+
+`exayard listen` forwards your company's webhook events to a local address,
+so you can build a webhook handler without a public URL:
+
+```bash
+exayard listen --forward-to http://localhost:3000/webhooks --events bid.won,project.created
+```
+
+It prints a signing secret (`whsec_...`) when it starts. Each event is POSTed
+to your address with the same body and `Exayard-Signature` header a real
+delivery has, signed with that secret, so your handler verifies it with
+`await constructWebhookEvent(rawBody, signature, secret)` from
+[`@exayard/sdk`](https://www.npmjs.com/package/@exayard/sdk). Without `--events` every event
+is forwarded; without `--forward-to` each event body is printed. Press Ctrl-C
+to stop. Needs a company admin or a company key with `write:webhooks` and
+`read:webhooks`.
+
+### Every API operation
+
+Every operation in the API is also a command, named after the operation
+(`list_vendor_quotes` becomes `exayard list-vendor-quotes`). `exayard api` lists
+them all and `exayard <command> --help` shows one command's fields.
+
+```
+exayard list-vendor-quotes <project_id> --status received
+exayard create-vendor-quote <project_id> --vendorId <id> --quoteNumber Q-7
+exayard update-labor-rate <rate_id> --input '{"hourlyRate": 85}'
+```
+
+Positional arguments fill the path and every other field is a flag. No
+command needs a company with a company key. When you do name one, `--org`
+(or `EXAYARD_ORG_ID`, or the company saved by `login`) fills
+`organizationId`; a sign-in that belongs to several companies needs it. A command that
+deletes, uses AI usage, sends or buys runs only with `--yes`.
+
 ### Global flags
 
 | Flag | Description |
 |------|-------------|
 | `--json` | Emit machine-readable JSON and suppress prose |
 | `--api-key <key>` | Override saved credentials for this call |
-| `--org <id>` | Override the saved organization ID |
+| `--org <id>` | The company to act in (a company key needs none) |
+| `--yes` | Run a command that deletes, uses AI usage, sends or buys |
 
 ### Exit codes