@faable/faable 4.1.0 → 4.3.0

package/README.md

@@ -28,8 +28,10 @@ npm i -g @faable/faable
 | Group | What it does | Docs |
 | --- | --- | --- |
 | `faable login` / `whoami` / `logout` | Session management (device flow; CI uses OIDC, no login needed) | [Authentication](https://faable.com/docs/cli#authentication) |
-| `faable deploy` | `launch` (the default: a bare `faable deploy` deploys the current directory), then `status`, `logs`, `deployments`, `inspect`, `trigger`, `redeploy`, `cancel`, `open`, `list` | [Deployment](https://faable.com/docs/cli#deployment) |
-| `faable deploy secrets` | Environment variables: `list`, `set` (`KEY=VALUE` or `--env-file`), `rm` | [Secrets](https://faable.com/docs/cli#secrets) |
+| `faable project` | The project commands act on: `list`, `use`, `current`, `clear` (or `--project` on any command) | [Projects](https://faable.com/docs/cli#projects) |
+| `faable deploy` | `launch` (the default: a bare `faable deploy` deploys the current directory), then `status`, `logs`, `deployments`, `inspect`, `trigger`, `redeploy`, `cancel`, `traffic`, `usage`, `quota`, `open` | [Deployment](https://faable.com/docs/cli#deployment) |
+| `faable deploy apps` | `list`, `get`, `create` (from a GitHub repository, first deploy included), `set` (branch, root directory, deploy mode) | [Apps](https://faable.com/docs/cli#apps) |
+| `faable deploy secrets` | Environment variables: `list`, `set` (`KEY=VALUE`, `--env-file`, or `-f -` from stdin), `rm` | [Secrets](https://faable.com/docs/cli#secrets) |
 | `faable deploy domains` | Custom domains: `add` (prints the CNAME), `list`, `check`, `rm` | [Domains](https://faable.com/docs/cli#domains) |
 | `faable deploy waf` | Edge rules: `block` (403), `sink` (404 without waking the app), `list`, `rm` | [Edge rules](https://faable.com/docs/cli#edge-rules-waf) |
 | `faable auth users` | `list` (FaableQL filters), `get` (federated identities included), `suspend`, `reinstate` | [Users](https://faable.com/docs/cli#users) |
@@ -37,18 +39,40 @@ npm i -g @faable/faable
 | `faable auth clients` | OAuth clients: `list`, `get --secret`, `create`, `rm` | [OAuth clients](https://faable.com/docs/cli#oauth-clients) |
 | `faable auth logs` | Audit log (read-only): `list` with filters, `get` | [Audit logs](https://faable.com/docs/cli#audit-logs) |
 
-Every command has `--help`; read commands accept `--json` for output you can pipe
-to `jq`. The complete table is in the
+Every command has `--help` and `--json`. `--app` takes an app id, name or slug.
+The complete table is in the
 [command reference](https://faable.com/docs/cli#command-reference).
 
+### Scripting and agents
+
+Data goes to stdout, messages to stderr. With `--json`:
+
+- every listing is `{"object":"list","data":[…],"has_more","next_cursor"}`
+  (`--limit`, `--starting-after`, `--all`);
+- every write returns what it changed, and a write with nothing to do returns
+  `{"result":"noop","reason"}`;
+- a failure exits 1 with `{"error":{"message","code","status","action"}}` on
+  stderr. Codes: `not_logged_in`, `session_expired`, `account_suspended`,
+  `apikey_session`, `forbidden`, `not_found`, `confirmation_required`,
+  `app_required`, `usage`, or the API's own code.
+
+A program driving the CLI should set `FAABLE_NONINTERACTIVE=1` (or pass
+`--non-interactive`): nothing prompts — a confirmation without `--yes` fails
+with `confirmation_required` —, the app is never inferred from the working
+directory, and `faable deploy launch` needs `--app`, `--workdir` and `--yes`.
+Pass secret values on stdin (`faable deploy secrets set -f -`), never as
+arguments.
+
 ### Deploy
 
 ```bash
 faable login
 faable deploy                       # deploy the current directory (= deploy launch)
 faable deploy launch --app app_x    # deploy another app, from anywhere
+faable deploy apps create --repo acme/web   # create, link, first deploy
 faable deploy status                # phase, URL and detected stack
-faable deploy logs --build          # build output (--follow to tail)
+faable deploy logs --build -n 100   # end of the build output (--follow to tail)
+faable deploy traffic --since 7d    # status codes, top and failing paths
 faable deploy secrets set KEY=value
 faable deploy domains add app.example.com
 ```
@@ -65,7 +89,7 @@ faable auth users get user_abc123                   # includes GitHub/… identi
 faable auth users suspend user_abc123 -r "abuse: crypto miner"
 
 # Bulk: pipe ids from a filtered listing
-faable auth users list --suspended --json | jq -r '.[].id' | faable auth users reinstate -y
+faable auth users list --suspended --json | jq -r '.data[].id' | faable auth users reinstate -y
 
 faable auth actions create -n add-claims -t post-login -f ./claims.js
 faable auth clients create -n my-app --callback https://app.example.com/callback

package/dist/api/FaableApi.js

@@ -90,13 +90,19 @@ class FaableApi {
                     if (res.status === 401) {
                         const expired = new Error('Your Faable session has expired or is invalid. Run `faable login` to sign in again.', { cause: error });
                         expired.status = 401;
+                        expired.code = 'session_expired';
                         throw expired;
                     }
                     const serverMessage = res.data?.message || res.statusText || 'Unknown Error';
                     const wrapped = new Error(`FaableApi ${url} ${res.status}: ${serverMessage}`, { cause: error });
                     wrapped.status = res.status;
+                    // The api's own code wins; a bare 403/404 still gets a stable one.
                     if (res.data?.code)
                         wrapped.code = res.data.code;
+                    else if (res.status === 403)
+                        wrapped.code = 'forbidden';
+                    else if (res.status === 404)
+                        wrapped.code = 'not_found';
                     if (res.data?.action)
                         wrapped.action = res.data.action;
                     throw wrapped;
@@ -254,7 +260,10 @@ class FaableApi {
     // Build and deploy the current head of the deploy branch server-side —
     // the same path a push webhook takes, same-commit dedupe included.
     async deployNow(app_id) {
-        return data(this.client.post(`/app/${app_id}/deploy`));
+        return data(
+        // deployment_id: the build this call started (api ≥ the release that
+        // added it; absent from older ones).
+        this.client.post(`/app/${app_id}/deploy`));
     }
     // Rebuild a failed deployment from its recorded source (CAS manifest or
     // git ref). The API enforces the guards: failed phase only, never older
@@ -296,6 +305,47 @@ class FaableApi {
             headers: projectHeader(team)
         }));
     }
+    // ── apps: create, configure, observe ─────────────────────────────────────
+    // A bare app in a project; `linkRepository` gives it something to build.
+    async createApp(project, params) {
+        return data(this.client.post(`/app`, params, {
+            headers: projectHeader(project)
+        }));
+    }
+    async deleteApp(app_id, team) {
+        return data(this.client.delete(`/app/${app_id}`, { headers: projectHeader(team) }));
+    }
+    async setDeployBranch(app_id, github_branch) {
+        return data(this.client.post(`/app/${app_id}/deploy-branch`, { github_branch }));
+    }
+    // null clears the platform override (faable.json's rootDir applies again).
+    async setRootDir(app_id, root_dir) {
+        return data(this.client.post(`/app/${app_id}/root-dir`, { root_dir }));
+    }
+    // push: every push deploys · ci: deploys once CI tags a release ·
+    // workflow: the repo's own GitHub workflow runs `faable deploy`.
+    async setDeployMode(app_id, mode) {
+        return data(this.client.post(`/app/${app_id}/deploy-mode`, { mode }));
+    }
+    // Edge traffic of one app (ClickHouse, trails reality by up to 15 min).
+    // from/to are unix seconds.
+    async getAppTraffic(app_id, team, params = {}) {
+        return data(this.client.get(`/app/${app_id}/traffic`, {
+            params,
+            headers: projectHeader(team)
+        }));
+    }
+    // The project's usage this billing period. `traffic: false` keeps it to
+    // the database (the Stripe-backed traffic figures are the slow half).
+    async getUsageSummary(project, params = {}) {
+        return data(this.client.get(`/usage/summary`, {
+            params,
+            headers: projectHeader(project)
+        }));
+    }
+    async getDeployQuota(project) {
+        return data(this.client.get(`/deploy-quota`, { headers: projectHeader(project) }));
+    }
     // ── per-app WAF ───────────────────────────────────────────────────────────
     //
     // No `x-faable-project` header on any of these: the routes are scoped by the

package/dist/api/auth.js

@@ -1,6 +1,6 @@
 import { FaableAuthApi, authBearer } from '@faable/auth-sdk';
 import os from 'os';
-import { version } from '../config.js';
+import { CLI_CLIENT } from './client_id.js';
 
 // The CLI talks to the Faable tenant's auth server through the same SDK the
 // rest of the platform uses. It used to be a bare axios instance, which meant
@@ -18,10 +18,6 @@ import { version } from '../config.js';
 //    whatever `loadLiveCredentials` refreshed is what goes on the wire.
 const AUTH_DOMAIN = "https://faable.auth.faable.link";
 const CLIENT_ID = "c879023b-e34f-4b0c-a262-210e556bc2e4";
-// `<name>/<version>`. No commit: the CLI has no release SHA constant, and a
-// dev build (`0.0.0-development`) is identifiable as such by the version
-// alone. auth caps this segment at 32 chars.
-const CLI_CLIENT = `faable-cli/${version}`;
 // No `x-faable-instance`: the SDK's default is `${HOSTNAME}:${pid}`, which on
 // a laptop is the user's machine name in our audit log. An empty string
 // suppresses the header (the helper drops falsy parts).

package/dist/api/auth_admin.js

@@ -3,7 +3,7 @@ import os from 'os';
 import path__default from 'path';
 import { ContextStore } from '../lib/ContextStore.js';
 import { CredentialsStore } from '../lib/CredentialsStore.js';
-import { log } from '../log.js';
+import { CliError, NOT_LOGGED_IN } from '../lib/errors.js';
 import { FaableApi } from './FaableApi.js';
 import { AUTH_DOMAIN, createAnonymousAuthApi, createBearerAuthApi } from './auth.js';
 import { requireProject } from './project.js';
@@ -17,13 +17,10 @@ const requireSessionToken = async () => {
     const config = await loadLiveCredentials(new CredentialsStore());
     if (config?.apikey && !config.token) {
         // Deploy API keys are not Auth management credentials.
-        log.error("❌ You are logged in with an API key, but `faable auth` needs a browser session. Run 'faable login' (without --apikey) first.");
-        process.exit(1);
-    }
-    if (!config?.token) {
-        log.error("❌ Not logged in. Run 'faable login' first.");
-        process.exit(1);
+        throw new CliError('apikey_session', "You are logged in with an API key, but `faable auth` needs a browser session. Run 'faable login' (without --apikey) first.");
     }
+    if (!config?.token)
+        throw new CliError('not_logged_in', NOT_LOGGED_IN);
     return config.token;
 };
 // Which Auth tenant `faable auth` manages, in precedence order:
@@ -193,10 +190,10 @@ const issueTenantToken = async (session_token, account_id, api = FaableApi.creat
 const hintAuthError = (e) => {
     const status = e?.response?.status;
     if (status === 401) {
-        throw new Error("Unauthorized (401) by the Auth management API. Your session may have expired — run 'faable login' and retry.");
+        throw new CliError('session_expired', "Unauthorized (401) by the Auth management API. Your session may have expired — run 'faable login' and retry.", { status, cause: e });
     }
     if (status === 403) {
-        throw new Error('Forbidden (403): your session is not allowed to manage this tenant. Check the tenant (`faable whoami`, --account, --project), or use credentials with management access for it.');
+        throw new CliError('forbidden', 'Forbidden (403): your session is not allowed to manage this tenant. Check the tenant (`faable whoami`, --account, --project), or use credentials with management access for it.', { status, cause: e });
     }
     throw e;
 };

package/dist/api/base_client.js

@@ -1,4 +1,5 @@
 import axios from 'axios';
+import { CLI_CLIENT } from './client_id.js';
 
 // FAABLE_API_URL: point the CLI at another Deploy API frontend (e.g.
 // https://deploy.staging.faable.com for staging-gated testing). BASE_URL is
@@ -9,7 +10,9 @@ const BASE_URL = process.env.FAABLE_API_URL ||
 const create_base_client = () => {
     return axios.create({
         baseURL: BASE_URL,
-        timeout: 10000
+        timeout: 10000,
+        // Who is calling: the api tags its request log by this name.
+        headers: { "x-faable-client": CLI_CLIENT }
     });
 };
 

package/dist/api/client_id.js

@@ -0,0 +1,22 @@
+import { version } from '../config.js';
+
+// What the CLI says it is, in `x-faable-client` on every request — to the
+// Deploy API (base_client.ts) and to the auth server (auth.ts) alike. The api
+// tags its request log by the name before the `/`, so traffic from the CLI —
+// and from the MCP server driving it — can be counted apart.
+//
+// `<name>/<version>`. No commit: the CLI has no release SHA constant, and a
+// dev build (`0.0.0-development`) is identifiable as such by the version
+// alone. A `+suffix` would be read as a commit sha, so the driver is told by
+// the name, not by a suffix. auth caps the version segment at 32 chars.
+//
+// FAABLE_CLIENT_NAME: who drives this CLI when it isn't a person. The Faable
+// MCP server sets `faable-mcp`. Only `faable-*` names: anything else is
+// ignored rather than letting an environment impersonate another client.
+const client_name = (env = process.env) => {
+    const name = env.FAABLE_CLIENT_NAME?.trim().toLowerCase() ?? '';
+    return /^faable-[a-z0-9-]{1,24}$/.test(name) ? name : 'faable-cli';
+};
+const CLI_CLIENT = `${client_name()}/${version}`;
+
+export { CLI_CLIENT, client_name };

package/dist/api/context.js

@@ -5,8 +5,8 @@ import { oidc_strategy } from './strategies/oidc.strategy.js';
 import { bearer_strategy } from './strategies/bearer.strategy.js';
 import { CredentialsStore } from '../lib/CredentialsStore.js';
 import { loadLiveCredentials } from './session.js';
-import { log } from '../log.js';
 import { configuredProject, resolveProjectRef } from './project.js';
+import { CliError, NOT_LOGGED_IN } from '../lib/errors.js';
 
 const context = async (targetAppId) => {
     let api;
@@ -70,10 +70,8 @@ const context = async (targetAppId) => {
 // whose first call returns 401 — FaableApi maps that to the same re-login hint.
 const requireApi = async (targetAppId) => {
     const ctx = await context(targetAppId);
-    if (!ctx.api) {
-        log.error("❌ Not logged in. Run 'faable login' first.");
-        process.exit(1);
-    }
+    if (!ctx.api)
+        throw new CliError("not_logged_in", NOT_LOGGED_IN);
     return ctx;
 };
 

package/dist/api/session.js

@@ -1,6 +1,7 @@
 import { CredentialsStore } from '../lib/CredentialsStore.js';
 import { refreshToken } from './auth.js';
 import { log } from '../log.js';
+import { CliError } from '../lib/errors.js';
 
 // True when a stored JWT access token is still valid (has a future `exp`).
 // Anything we can't decode, or without `exp`, counts as NOT live — callers then
@@ -54,8 +55,7 @@ const loadLiveCredentials = async (store = new CredentialsStore()) => {
             const body = e
                 ?.response?.data;
             if (body?.error_code === "user_suspended") {
-                log.error("❌ Your account has been suspended. Contact support@faable.com.");
-                process.exit(1);
+                throw new CliError("account_suspended", "Your account has been suspended. Contact support@faable.com.");
             }
             // Refresh failed — keep the stale config; the API call's 401 (or
             // requireApi) will tell the user to run `faable login` again.

package/dist/commands/auth/actions/rm.js

@@ -1,13 +1,14 @@
-import prompts from 'prompts';
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
+import { json_option, print_json } from '../../../lib/listing.js';
 import { formatTriggers } from './triggers.js';
 import { tenant_options } from '../options.js';
+import { confirm } from '../../../lib/interactive.js';
 
 const actions_rm = {
     command: 'rm <action_id>',
     describe: 'Delete an action',
-    builder: yargs => tenant_options(yargs)
+    builder: yargs => json_option(tenant_options(yargs))
         .positional('action_id', {
         type: 'string',
         demandOption: true,
@@ -24,21 +25,17 @@ const actions_rm = {
         const api = await requireAuthAdmin(args);
         // Fetch first: shows WHAT will be deleted and 404s before the prompt.
         const action = await api.actionGet(args.action_id);
-        if (!args.yes) {
-            const { confirm } = await prompts({
-                type: 'toggle',
-                name: 'confirm',
-                message: `Delete action "${action.name}" (${action.id}, triggers ${formatTriggers(action)})?`,
-                initial: false,
-                active: 'yes',
-                inactive: 'no'
-            });
-            if (!confirm) {
-                log.info('Cancelled.');
-                return;
-            }
+        const go = await confirm({
+            message: `Delete action "${action.name}" (${action.id}, triggers ${formatTriggers(action)})?`,
+            yes: args.yes
+        });
+        if (!go) {
+            log.info('Cancelled.');
+            return;
         }
         await api.actionDelete(args.action_id);
+        if (args.json)
+            return print_json({ deleted: true, id: args.action_id });
         log.info(`🗑️ Deleted action ${args.action_id}.`);
     })
 };

package/dist/commands/auth/clients/rm.js

@@ -1,13 +1,14 @@
-import prompts from 'prompts';
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
+import { json_option, print_json } from '../../../lib/listing.js';
 import { tenant_options } from '../options.js';
 import { resolve_client } from './resolve.js';
+import { confirm } from '../../../lib/interactive.js';
 
 const clients_rm = {
     command: 'rm <client_id>',
     describe: 'Delete an OAuth client',
-    builder: yargs => tenant_options(yargs)
+    builder: yargs => json_option(tenant_options(yargs))
         .positional('client_id', {
         type: 'string',
         demandOption: true,
@@ -23,21 +24,22 @@ const clients_rm = {
     handler: withAuthHints(async (args) => {
         const api = await requireAuthAdmin(args);
         const client = await resolve_client(api, args.client_id);
-        if (!args.yes) {
-            const { confirm } = await prompts({
-                type: 'toggle',
-                name: 'confirm',
-                message: `Delete client "${client.name}" (${client.client_id})? Apps using it will stop authenticating.`,
-                initial: false,
-                active: 'yes',
-                inactive: 'no'
-            });
-            if (!confirm) {
-                log.info('Cancelled.');
-                return;
-            }
+        const go = await confirm({
+            message: `Delete client "${client.name}" (${client.client_id})? Apps using it will stop authenticating.`,
+            yes: args.yes
+        });
+        if (!go) {
+            log.info('Cancelled.');
+            return;
         }
         await api.clientDelete(client.id);
+        if (args.json) {
+            return print_json({
+                deleted: true,
+                id: client.id,
+                client_id: client.client_id
+            });
+        }
         log.info(`🗑️ Deleted client ${client.client_id} (${client.id}).`);
     })
 };

package/dist/commands/auth/users/export.js

@@ -1,8 +1,8 @@
 import { openSync, fchmodSync, writeSync, closeSync } from 'node:fs';
-import prompts from 'prompts';
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
 import { tenant_options } from '../options.js';
+import { confirm } from '../../../lib/interactive.js';
 
 // GET /user/export pages at most this many users.
 const PAGE_SIZE = 500;
@@ -45,18 +45,12 @@ const users_export = {
         if (hashes && to_stdout && process.stdout.isTTY && !args.force) {
             throw new Error('Refusing to print password hashes to a terminal: pass a file, pipe stdout, or add --force');
         }
-        if (hashes && !args.yes) {
-            // The prompt goes to stderr so a piped stdout stays pure NDJSON.
-            const { confirm } = await prompts({
-                type: 'toggle',
-                name: 'confirm',
+        if (hashes) {
+            const go = await confirm({
                 message: 'Export password hashes? Anyone holding the file can attack every password offline. The export is audited and notifies the tenant subscribers.',
-                initial: false,
-                active: 'yes',
-                inactive: 'no',
-                stdout: process.stderr
-            }, { onCancel: () => false });
-            if (!confirm) {
+                yes: args.yes
+            });
+            if (!go) {
                 process.stderr.write('Cancelled.\n');
                 return;
             }

package/dist/commands/auth/users/import.js

@@ -1,11 +1,11 @@
 import { readFile } from 'node:fs/promises';
-import prompts from 'prompts';
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
 import { tenant_options } from '../options.js';
 import { json_option, print_json } from '../../../lib/listing.js';
 import { SOURCES, ADAPTERS, SOURCE_FORMAT } from './import/adapters.js';
 import { parse_records } from './import/records.js';
+import { confirm } from '../../../lib/interactive.js';
 
 // The server takes at most this many rows per request (POST /user/import).
 const BATCH_SIZE = 500;
@@ -119,16 +119,12 @@ const users_import = {
             throw new Error(`No importable users in ${args.file} (${total} record(s) read)`);
         }
         const dry_run = !!args['dry-run'];
-        if (!args.yes && !dry_run) {
-            const { confirm } = await prompts({
-                type: 'toggle',
-                name: 'confirm',
+        if (!dry_run) {
+            const go = await confirm({
                 message: `Import ${rows.length} user(s) from ${args.from}?`,
-                initial: false,
-                active: 'yes',
-                inactive: 'no'
+                yes: args.yes
             });
-            if (!confirm) {
+            if (!go) {
                 log.info('Cancelled.');
                 return;
             }

package/dist/commands/auth/users/reinstate.js

@@ -1,9 +1,9 @@
-import prompts from 'prompts';
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
 import { tenant_options } from '../options.js';
 import { json_option, print_json } from '../../../lib/listing.js';
 import { wants_stdin, read_stdin, parse_user_ids } from './ids.js';
+import { confirm } from '../../../lib/interactive.js';
 
 const users_reinstate = {
     command: 'reinstate [user_ids..]',
@@ -21,7 +21,7 @@ const users_reinstate = {
         description: 'Skip the confirmation prompt'
     })
         .example('$0 auth users reinstate user_abc123', 'Reinstate one user')
-        .example('faable auth users list --suspended --json | jq -r ".[].id" | $0 auth users reinstate -y', 'Bulk-reinstate ids piped from a filtered listing')
+        .example('faable auth users list --suspended --json | jq -r ".data[].id" | $0 auth users reinstate -y', 'Bulk-reinstate ids piped from a filtered listing')
         .showHelpOnFail(false),
     handler: withAuthHints(async (args) => {
         const argv_ids = args.user_ids ?? [];
@@ -29,21 +29,14 @@ const users_reinstate = {
             ? await read_stdin()
             : null;
         const ids = parse_user_ids(argv_ids, stdin);
-        if (!args.yes) {
-            const preview = ids.slice(0, 5).join(', ') + (ids.length > 5 ? ', …' : '');
-            // In a non-TTY run without --yes, prompts resolves undefined → cancel.
-            const { confirm } = await prompts({
-                type: 'toggle',
-                name: 'confirm',
-                message: `Reinstate ${ids.length} user(s) (${preview})?`,
-                initial: false,
-                active: 'yes',
-                inactive: 'no'
-            });
-            if (!confirm) {
-                log.info('Cancelled.');
-                return;
-            }
+        const preview = ids.slice(0, 5).join(', ') + (ids.length > 5 ? ', …' : '');
+        const go = await confirm({
+            message: `Reinstate ${ids.length} user(s) (${preview})?`,
+            yes: args.yes
+        });
+        if (!go) {
+            log.info('Cancelled.');
+            return;
         }
         const api = await requireAuthAdmin(args);
         const results = [];

package/dist/commands/auth/users/suspend.js

@@ -1,9 +1,9 @@
-import prompts from 'prompts';
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
 import { tenant_options } from '../options.js';
 import { json_option, print_json } from '../../../lib/listing.js';
 import { wants_stdin, read_stdin, parse_user_ids } from './ids.js';
+import { confirm } from '../../../lib/interactive.js';
 
 const users_suspend = {
     command: 'suspend [user_ids..]',
@@ -27,7 +27,7 @@ const users_suspend = {
     })
         .example('$0 auth users suspend user_abc123 --reason "abuse: proxy payload"', 'Suspend one user')
         .example('$0 auth users suspend user_a user_b user_c -y -r "abuse wave"', 'Suspend several users without prompting')
-        .example('faable auth users list --query email_verified:false --json | jq -r ".[].id" | $0 auth users suspend -y', 'Bulk-suspend ids piped from a filtered listing')
+        .example('faable auth users list --query email_verified:false --json | jq -r ".data[].id" | $0 auth users suspend -y', 'Bulk-suspend ids piped from a filtered listing')
         .showHelpOnFail(false),
     handler: withAuthHints(async (args) => {
         const argv_ids = args.user_ids ?? [];
@@ -35,21 +35,14 @@ const users_suspend = {
             ? await read_stdin()
             : null;
         const ids = parse_user_ids(argv_ids, stdin);
-        if (!args.yes) {
-            const preview = ids.slice(0, 5).join(', ') + (ids.length > 5 ? ', …' : '');
-            // In a non-TTY run without --yes, prompts resolves undefined → cancel.
-            const { confirm } = await prompts({
-                type: 'toggle',
-                name: 'confirm',
-                message: `Suspend ${ids.length} user(s) (${preview})?`,
-                initial: false,
-                active: 'yes',
-                inactive: 'no'
-            });
-            if (!confirm) {
-                log.info('Cancelled.');
-                return;
-            }
+        const preview = ids.slice(0, 5).join(', ') + (ids.length > 5 ? ', …' : '');
+        const go = await confirm({
+            message: `Suspend ${ids.length} user(s) (${preview})?`,
+            yes: args.yes
+        });
+        if (!go) {
+            log.info('Cancelled.');
+            return;
         }
         const api = await requireAuthAdmin(args);
         const results = [];