@kill-switch/cli 0.1.1 → 0.3.0

package/dist/commands/kill.js

@@ -1,6 +1,6 @@
-import { apiRequest } from "../api-client.js";
-import { outputJson, formatTable, formatObject, outputError } from "../output.js";
-export function registerKillCommands(program) {
+import { outputJson, formatTable, formatObject, handleError, spinner, success, warn, colors as c } from "../output.js";
+import { confirm } from "../prompts.js";
+export function registerKillCommands(program, createClient) {
     const kill = program.command("kill").description("Database kill switch sequences");
     kill
         .command("init")
@@ -8,25 +8,32 @@ export function registerKillCommands(program) {
         .requiredOption("--credential-id <id>", "Stored credential ID")
         .requiredOption("--trigger <reason>", "Kill trigger reason")
         .action(async (opts) => {
-        const json = program.opts().json;
+        const { json, yes } = program.opts();
         try {
-            const data = await apiRequest("/database/kill", {
-                method: "POST",
-                body: { credentialId: opts.credentialId, trigger: opts.trigger },
+            const ok = await confirm(`${c.red("WARNING:")} This will start a database kill sequence. Continue?`, { yes, json });
+            if (!ok) {
+                console.log("Aborted.");
+                return;
+            }
+            const s = json ? null : spinner("Initiating kill sequence...").start();
+            const client = createClient();
+            const data = await client.database.initiate({
+                credentialId: opts.credentialId,
+                trigger: opts.trigger,
             });
+            s?.stop();
             if (json) {
                 outputJson(data);
             }
             else {
-                console.log(`Kill sequence initiated: ${data.sequenceId}`);
-                console.log(`Status: ${data.status}`);
-                console.log(`Steps: ${data.steps?.map((s) => s.action).join(" -> ")}`);
-                console.log(`\nAdvance: kill-switch kill advance ${data.sequenceId} --credential-id ${opts.credentialId}`);
+                warn(`Kill sequence initiated: ${c.bold(data.id)}`);
+                console.log(`  Status: ${data.status}`);
+                console.log(`  Steps: ${data.steps?.map((s) => s.action).join(" → ")}`);
+                console.log(`\n  Advance: ${c.dim(`ks kill advance ${data.id} --credential-id ${opts.credentialId}`)}`);
             }
         }
         catch (err) {
-            outputError(err.message, json);
-            process.exit(1);
+            handleError(err, json);
         }
     });
     kill
@@ -35,8 +42,9 @@ export function registerKillCommands(program) {
         .action(async (id) => {
         const json = program.opts().json;
         try {
+            const client = createClient();
             if (id) {
-                const data = await apiRequest(`/database/kill/${id}`);
+                const data = await client.database.get(id);
                 if (json) {
                     outputJson(data);
                 }
@@ -53,13 +61,12 @@ export function registerKillCommands(program) {
                 }
             }
             else {
-                const data = await apiRequest("/database/kill");
-                const sequences = data.sequences || data;
+                const sequences = await client.database.list();
                 if (json) {
                     outputJson(sequences);
                 }
                 else {
-                    formatTable(Array.isArray(sequences) ? sequences : [], [
+                    formatTable(sequences, [
                         { key: "id", header: "Sequence ID" },
                         { key: "status", header: "Status" },
                         { key: "currentStep", header: "Step" },
@@ -68,8 +75,7 @@ export function registerKillCommands(program) {
             }
         }
         catch (err) {
-            outputError(err.message, json);
-            process.exit(1);
+            handleError(err, json);
         }
     });
     kill
@@ -78,48 +84,57 @@ export function registerKillCommands(program) {
         .requiredOption("--credential-id <credId>", "Stored credential ID")
         .option("--human-approval", "Confirm human approval (required for nuke step)")
         .action(async (id, opts) => {
-        const json = program.opts().json;
+        const { json, yes } = program.opts();
         try {
-            const data = await apiRequest(`/database/kill/${id}/advance`, {
-                method: "POST",
-                body: {
-                    credentialId: opts.credentialId,
-                    humanApproval: opts.humanApproval || false,
-                },
+            const ok = await confirm(`Execute the next step in kill sequence ${id}?`, { yes, json });
+            if (!ok) {
+                console.log("Aborted.");
+                return;
+            }
+            const s = json ? null : spinner("Executing step...").start();
+            const client = createClient();
+            const data = await client.database.advance(id, {
+                credentialId: opts.credentialId,
+                humanApproval: opts.humanApproval || false,
             });
+            s?.stop();
             if (json) {
                 outputJson(data);
             }
             else {
-                console.log(`Step executed: ${data.steps?.[data.currentStep - 1]?.action || "?"}`);
-                console.log(`Status: ${data.status}`);
+                success(`Step executed: ${data.steps?.[data.currentStep - 1]?.action || "?"}`);
+                console.log(`  Status: ${data.status}`);
                 if (data.status !== "completed") {
-                    console.log(`Next: kill-switch kill advance ${id} --credential-id ${opts.credentialId}`);
+                    console.log(`  Next: ${c.dim(`ks kill advance ${id} --credential-id ${opts.credentialId}`)}`);
                 }
             }
         }
         catch (err) {
-            outputError(err.message, json);
-            process.exit(1);
+            handleError(err, json);
         }
     });
     kill
         .command("abort <id>")
         .description("Abort a kill sequence")
         .action(async (id) => {
-        const json = program.opts().json;
+        const { json, yes } = program.opts();
         try {
-            const data = await apiRequest(`/database/kill/${id}/abort`, { method: "POST" });
+            const ok = await confirm(`Abort kill sequence ${id}?`, { yes, json });
+            if (!ok) {
+                console.log("Aborted.");
+                return;
+            }
+            const client = createClient();
+            await client.database.abort(id);
             if (json) {
-                outputJson(data);
+                outputJson({ aborted: true, id });
             }
             else {
-                console.log(`Kill sequence ${id} aborted.`);
+                success(`Kill sequence ${id} aborted.`);
             }
         }
         catch (err) {
-            outputError(err.message, json);
-            process.exit(1);
+            handleError(err, json);
         }
     });
 }

package/dist/commands/onboard.d.ts

@@ -3,22 +3,7 @@
  *
  * One-command setup for connecting cloud providers, applying protection rules,
  * and configuring alerts. Designed for both human use and AI agent automation.
- *
- * Human use (interactive prompts):
- *   kill-switch onboard
- *
- * AI agent use (non-interactive):
- *   kill-switch onboard \
- *     --provider cloudflare \
- *     --account-id YOUR_CF_ACCOUNT_ID \
- *     --token YOUR_CF_API_TOKEN \
- *     --name "Production" \
- *     --shields cost-runaway,ddos \
- *     --alert-email you@example.com
- *
- * Multi-provider (run multiple times or comma-separate):
- *   kill-switch onboard --provider cloudflare --token ... --account-id ...
- *   kill-switch onboard --provider aws --access-key ... --secret-key ... --region us-east-1
  */
 import { Command } from "commander";
-export declare function registerOnboardCommands(program: Command): void;
+import type { ClientFactory } from "../types.js";
+export declare function registerOnboardCommands(program: Command, createClient: ClientFactory): void;

package/dist/commands/onboard.js

@@ -3,26 +3,9 @@
  *
  * One-command setup for connecting cloud providers, applying protection rules,
  * and configuring alerts. Designed for both human use and AI agent automation.
- *
- * Human use (interactive prompts):
- *   kill-switch onboard
- *
- * AI agent use (non-interactive):
- *   kill-switch onboard \
- *     --provider cloudflare \
- *     --account-id YOUR_CF_ACCOUNT_ID \
- *     --token YOUR_CF_API_TOKEN \
- *     --name "Production" \
- *     --shields cost-runaway,ddos \
- *     --alert-email you@example.com
- *
- * Multi-provider (run multiple times or comma-separate):
- *   kill-switch onboard --provider cloudflare --token ... --account-id ...
- *   kill-switch onboard --provider aws --access-key ... --secret-key ... --region us-east-1
  */
-import { apiRequest } from "../api-client.js";
-import { outputJson, outputError } from "../output.js";
-import { createInterface } from "readline";
+import { outputJson, outputError, handleError, spinner, success, fail } from "../output.js";
+import { ask } from "../prompts.js";
 const PROVIDER_HELP = {
     cloudflare: {
         name: "Cloudflare",
@@ -77,26 +60,134 @@ const PROVIDER_HELP = {
     Run: aws configure get region
     Common values: us-east-1, us-west-2, eu-west-1`,
     },
+    runpod: {
+        name: "RunPod",
+        fields: "--runpod-api-key",
+        howToGet: `How to get this value:
+
+  API Key:
+    1. Go to https://www.runpod.io/console/user/settings
+    2. Scroll to "API Keys" section
+    3. Click "Create API Key" (or copy an existing one)
+    4. The key starts with a long alphanumeric string
+
+  Required permissions:
+    - Read access to pods, serverless endpoints, and network volumes
+    - Write access if you want auto-kill actions (stop/terminate pods, scale endpoints)`,
+    },
+    redis: {
+        name: "Redis",
+        fields: "--redis-url (self-hosted) or --redis-cloud-key + --redis-cloud-secret + --subscription-id",
+        howToGet: `Redis supports three deployment types:
+
+  Self-hosted Redis:
+    Provide a connection URL: --redis-url redis://user:pass@host:6379
+
+  Redis Cloud:
+    1. Go to https://app.redislabs.com/#/account/api-keys
+    2. Create an API key pair (Account Key + Secret Key)
+    3. Find your subscription ID in the console
+    Use: --redis-cloud-key KEY --redis-cloud-secret SECRET --subscription-id ID
+
+  AWS ElastiCache:
+    Use AWS credentials + cluster ID:
+    --access-key AKIA... --secret-key ... --region us-east-1 --cluster-id my-cluster`,
+    },
+    mongodb: {
+        name: "MongoDB",
+        fields: "--mongodb-uri (self-hosted) or --atlas-public-key + --atlas-private-key + --atlas-project-id",
+        howToGet: `MongoDB supports two deployment types:
+
+  MongoDB Atlas:
+    1. Go to Organization > Access Manager > API Keys
+    2. Create a key with "Project Read Only" + "Project Cluster Manager" roles
+    Use: --atlas-public-key PUB --atlas-private-key PRIV --atlas-project-id PROJ --atlas-cluster-name Cluster0
+
+  Self-hosted MongoDB:
+    Provide a URI: --mongodb-uri mongodb+srv://user:pass@host/db`,
+    },
+    openai: {
+        name: "OpenAI",
+        fields: "--openai-api-key",
+        howToGet: `  1. Go to https://platform.openai.com/api-keys
+  2. Create a new API key
+  3. Copy the key (starts with sk-)
+  Optional: --openai-org-id (from Organization Settings)`,
+    },
+    anthropic: {
+        name: "Anthropic",
+        fields: "--anthropic-api-key",
+        howToGet: `  1. Go to https://console.anthropic.com/settings/keys
+  2. Create a new API key
+  3. Copy the key (starts with sk-ant-)
+  Optional: --anthropic-workspace-id`,
+    },
+    xai: {
+        name: "xAI (Grok)",
+        fields: "--xai-api-key",
+        howToGet: `  1. Go to https://console.x.ai/api-keys
+  2. Create a new API key
+  3. Copy the key`,
+    },
+    replicate: {
+        name: "Replicate",
+        fields: "--replicate-api-token",
+        howToGet: `  1. Go to https://replicate.com/account/api-tokens
+  2. Create a new token
+  3. Copy the token (starts with r8_)`,
+    },
+    snowflake: {
+        name: "Snowflake",
+        fields: "--snowflake-account + --snowflake-username + --snowflake-password",
+        howToGet: `  Account: Found in your Snowflake URL (https://<account>.snowflakecomputing.com)
+  Username/Password: Your Snowflake login credentials
+  Optional: --warehouse COMPUTE_WH --role ACCOUNTADMIN`,
+    },
+    vercel: {
+        name: "Vercel",
+        fields: "--vercel-api-token",
+        howToGet: `  1. Go to https://vercel.com/account/tokens
+  2. Create a new token with appropriate scope
+  3. Copy the token
+  Optional: --vercel-team-id (from Team Settings)`,
+    },
+    datadog: {
+        name: "Datadog",
+        fields: "--datadog-api-key + --datadog-application-key",
+        howToGet: `  API Key: Organization Settings > API Keys
+  Application Key: Organization Settings > Application Keys
+  Optional: --datadog-site us|eu (default: us)`,
+    },
+    neo4j: {
+        name: "Neo4j Aura",
+        fields: "--neo4j-client-id + --neo4j-client-secret",
+        howToGet: `How to get these values:
+
+  API Credentials (OAuth2 client credentials):
+    1. Go to https://console.neo4j.io/
+    2. Click your account menu (top-right) > API Credentials
+    3. Click "Create API Credentials"
+    4. Choose the "Tenant Admin" role for full monitoring + kill switch actions
+    5. Copy both the Client ID and Client Secret
+
+  Instance ID (optional):
+    Found in the console URL or the instance card:
+    https://console.neo4j.io/d/<INSTANCE_ID>/overview
+    Or omit to monitor all instances in your tenant.`,
+    },
 };
 const AVAILABLE_SHIELDS = [
     "cost-runaway", "ddos", "brute-force", "error-storm",
     "exfiltration", "gpu-runaway", "lambda-loop", "aws-cost-runaway",
 ];
-function ask(question) {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    return new Promise((resolve) => {
-        rl.question(question, (answer) => {
-            rl.close();
-            resolve(answer.trim());
-        });
-    });
-}
-export function registerOnboardCommands(program) {
+const ONBOARDABLE_PROVIDERS = ["cloudflare", "gcp", "aws", "runpod", "neo4j", "mongodb"];
+const ONBOARDABLE_LIST = ONBOARDABLE_PROVIDERS.join(", ");
+export function registerOnboardCommands(program, createClient) {
     program
         .command("onboard")
         .alias("setup")
         .description("Quick setup: connect a cloud provider, apply protection, configure alerts")
-        .option("--provider <provider>", "Cloud provider: cloudflare, gcp, aws")
+        .option("--provider <provider>", "Cloud provider: cloudflare, gcp, aws, runpod, neo4j, mongodb")
         .option("--name <name>", "Account name (e.g., Production)")
         .option("--token <token>", "API token (Cloudflare)")
         .option("--account-id <id>", "Account ID (Cloudflare)")
@@ -105,7 +196,19 @@ export function registerOnboardCommands(program) {
         .option("--access-key <key>", "Access Key ID (AWS)")
         .option("--secret-key <key>", "Secret Access Key (AWS)")
         .option("--region <region>", "Region (AWS, default: us-east-1)")
+        .option("--runpod-api-key <key>", "API Key (RunPod)")
+        .option("--neo4j-client-id <id>", "Client ID (Neo4j Aura)")
+        .option("--neo4j-client-secret <secret>", "Client Secret (Neo4j Aura)")
+        .option("--neo4j-instance-id <id>", "Instance ID (Neo4j Aura, optional)")
+        .option("--mongodb-subtype <type>", "MongoDB sub-type: atlas | self-hosted (inferred if omitted)")
+        .option("--atlas-public-key <key>", "Public key (MongoDB Atlas API)")
+        .option("--atlas-private-key <key>", "Private key (MongoDB Atlas API)")
+        .option("--atlas-project-id <id>", "Project ID (MongoDB Atlas)")
+        .option("--atlas-cluster-name <name>", "Cluster name (MongoDB Atlas, optional)")
+        .option("--mongodb-uri <uri>", "Connection URI (self-hosted MongoDB)")
+        .option("--mongodb-database <name>", "Database name (self-hosted MongoDB, optional)")
         .option("--shields <presets>", "Comma-separated shield presets to apply (default: cost-runaway)")
+        .option("--alert-pagerduty <key>", "PagerDuty Events API v2 routing key (recommended)")
         .option("--alert-email <email>", "Email address for alerts")
         .option("--alert-discord <url>", "Discord webhook URL for alerts")
         .option("--alert-slack <url>", "Slack webhook URL for alerts")
@@ -118,14 +221,14 @@ Examples:
   # Interactive onboarding
   kill-switch onboard
 
-  # AI agent / non-interactive: connect Cloudflare
+  # AI agent / non-interactive: connect Cloudflare with PagerDuty
   kill-switch onboard \\
     --provider cloudflare \\
     --account-id 14a6fa23390363382f378b5bd4a0f849 \\
     --token cf-api-token-here \\
     --name "Production" \\
     --shields cost-runaway,ddos \\
-    --alert-email you@example.com
+    --alert-pagerduty YOUR_ROUTING_KEY
 
   # Show how to get Cloudflare credentials
   kill-switch onboard --help-provider cloudflare
@@ -146,7 +249,7 @@ Available shields: ${AVAILABLE_SHIELDS.join(", ")}
         if (opts.helpProvider) {
             const help = PROVIDER_HELP[opts.helpProvider];
             if (!help) {
-                outputError(`Unknown provider: ${opts.helpProvider}. Use: cloudflare, gcp, aws`, json);
+                outputError(`Unknown provider: ${opts.helpProvider}. Use: ${ONBOARDABLE_LIST}`, json);
                 process.exit(1);
             }
             if (json) {
@@ -160,12 +263,13 @@ Available shields: ${AVAILABLE_SHIELDS.join(", ")}
             return;
         }
         try {
+            const client = createClient();
             let provider = opts.provider;
             let name = opts.name;
             // Interactive mode if no provider specified
             if (!provider) {
                 if (json) {
-                    outputError("--provider is required in JSON mode. Use: cloudflare, gcp, aws", json);
+                    outputError(`--provider is required in JSON mode. Use: ${ONBOARDABLE_LIST}`, json);
                     process.exit(1);
                 }
                 console.log("\n\u26a1 Kill Switch Onboarding\n");
@@ -174,12 +278,15 @@ Available shields: ${AVAILABLE_SHIELDS.join(", ")}
                 console.log("  1. cloudflare  — Workers, R2, D1, Queues, Stream");
                 console.log("  2. gcp         — Cloud Run, Compute, GKE, BigQuery");
                 console.log("  3. aws         — EC2, Lambda, RDS, ECS, S3");
+                console.log("  4. runpod      — GPU Pods, Serverless Endpoints, Network Volumes");
+                console.log("  5. neo4j       — Neo4j Aura graph databases");
+                console.log("  6. mongodb     — MongoDB Atlas, self-hosted MongoDB");
                 console.log();
-                const choice = await ask("Choose a provider (1/2/3 or name): ");
-                provider = { "1": "cloudflare", "2": "gcp", "3": "aws" }[choice] || choice;
+                const choice = await ask("Choose a provider (1-6 or name): ");
+                provider = { "1": "cloudflare", "2": "gcp", "3": "aws", "4": "runpod", "5": "neo4j", "6": "mongodb" }[choice] || choice;
             }
             if (!PROVIDER_HELP[provider]) {
-                outputError(`Unknown provider: ${provider}. Use: cloudflare, gcp, aws`, json);
+                outputError(`Unknown provider: ${provider}. Use: ${ONBOARDABLE_LIST}`, json);
                 process.exit(1);
             }
             if (!name && !json) {
@@ -248,15 +355,115 @@ Available shields: ${AVAILABLE_SHIELDS.join(", ")}
                 credential.awsSecretAccessKey = secretKey;
                 credential.awsRegion = region || "us-east-1";
             }
+            else if (provider === "runpod") {
+                let apiKey = opts.runpodApiKey;
+                if (!apiKey && !json) {
+                    console.log("\n  Tip: Create an API Key at https://www.runpod.io/console/user/settings");
+                    apiKey = await ask("  RunPod API Key: ");
+                }
+                if (!apiKey) {
+                    outputError(`RunPod requires ${PROVIDER_HELP.runpod.fields}`, json);
+                    process.exit(1);
+                }
+                credential.runpodApiKey = apiKey;
+            }
+            else if (provider === "neo4j") {
+                let neo4jClientId = opts.neo4jClientId || process.env.NEO4J_CLIENT_ID;
+                let neo4jClientSecret = opts.neo4jClientSecret || process.env.NEO4J_CLIENT_SECRET;
+                let neo4jInstanceId = opts.neo4jInstanceId || process.env.NEO4J_INSTANCE_ID;
+                if (!neo4jClientId && !json) {
+                    console.log("\n  Tip: Create API Credentials at https://console.neo4j.io/ > Account > API Credentials");
+                    neo4jClientId = await ask("  Neo4j Client ID: ");
+                }
+                if (!neo4jClientSecret && !json) {
+                    neo4jClientSecret = await ask("  Neo4j Client Secret: ");
+                }
+                if (!neo4jInstanceId && !json) {
+                    neo4jInstanceId = await ask("  Instance ID (Enter to monitor all): ");
+                }
+                if (!neo4jClientId || !neo4jClientSecret) {
+                    outputError(`Neo4j requires ${PROVIDER_HELP.neo4j.fields}`, json);
+                    process.exit(1);
+                }
+                credential.neo4jClientId = neo4jClientId;
+                credential.neo4jClientSecret = neo4jClientSecret;
+                if (neo4jInstanceId)
+                    credential.neo4jInstanceId = neo4jInstanceId;
+            }
+            else if (provider === "mongodb") {
+                const hasAtlasFlags = !!(opts.atlasPublicKey || opts.atlasPrivateKey || opts.atlasProjectId);
+                const hasSelfHostedFlag = !!opts.mongodbUri;
+                if (hasAtlasFlags && hasSelfHostedFlag) {
+                    outputError("MongoDB: pass either Atlas keys (--atlas-public-key/--atlas-private-key/--atlas-project-id) or --mongodb-uri, not both.", json);
+                    process.exit(1);
+                }
+                let subType = opts.mongodbSubtype === "atlas" || opts.mongodbSubtype === "self-hosted"
+                    ? opts.mongodbSubtype
+                    : hasAtlasFlags ? "atlas" : hasSelfHostedFlag ? "self-hosted" : undefined;
+                if (!subType && !json) {
+                    const answer = (await ask("MongoDB type — [a]tlas or [s]elf-hosted? ")).toLowerCase();
+                    subType = answer.startsWith("s") ? "self-hosted" : "atlas";
+                }
+                if (!subType) {
+                    outputError("MongoDB requires --mongodb-subtype atlas|self-hosted (or provide credentials inferring the type)", json);
+                    process.exit(1);
+                }
+                credential.mongodbSubType = subType;
+                if (subType === "atlas") {
+                    let publicKey = opts.atlasPublicKey;
+                    let privateKey = opts.atlasPrivateKey;
+                    let projectId = opts.atlasProjectId;
+                    let clusterName = opts.atlasClusterName;
+                    if (!publicKey && !json) {
+                        console.log("\n  Tip: Create at Atlas > Access Manager > API Keys (Project-level)");
+                        console.log("  Roles: Project Read Only + Project Cluster Manager");
+                        publicKey = await ask("  Atlas Public Key: ");
+                    }
+                    if (!privateKey && !json) {
+                        privateKey = await ask("  Atlas Private Key: ");
+                    }
+                    if (!projectId && !json) {
+                        console.log("\n  Tip: Project ID is in the URL: cloud.mongodb.com/v2/<PROJECT_ID>");
+                        projectId = await ask("  Atlas Project ID: ");
+                    }
+                    if (!clusterName && !json) {
+                        clusterName = await ask("  Cluster name (Enter to monitor first cluster in project): ");
+                    }
+                    if (!publicKey || !privateKey || !projectId) {
+                        outputError(`MongoDB Atlas requires ${PROVIDER_HELP.mongodb.fields}`, json);
+                        process.exit(1);
+                    }
+                    credential.atlasPublicKey = publicKey;
+                    credential.atlasPrivateKey = privateKey;
+                    credential.atlasProjectId = projectId;
+                    if (clusterName)
+                        credential.atlasClusterName = clusterName;
+                }
+                else {
+                    let uri = opts.mongodbUri;
+                    if (!uri && !json) {
+                        console.log("\n  Tip: Format mongodb+srv://user:pass@host/db or mongodb://...");
+                        uri = await ask("  MongoDB Connection URI: ");
+                    }
+                    if (!uri) {
+                        outputError("MongoDB self-hosted requires --mongodb-uri", json);
+                        process.exit(1);
+                    }
+                    credential.mongodbUri = uri;
+                    if (opts.mongodbDatabase)
+                        credential.mongodbDatabaseName = opts.mongodbDatabase;
+                }
+            }
             // 1. Connect cloud account
-            if (!json)
-                console.log(`\nConnecting ${PROVIDER_HELP[provider].name}...`);
-            const account = await apiRequest("/cloud-accounts", {
-                method: "POST",
-                body: { provider, name, credential },
+            const s = json ? null : spinner(`Connecting ${PROVIDER_HELP[provider].name}...`).start();
+            const account = await client.accounts.create({
+                provider: provider,
+                name,
+                credential: credential,
             });
+            s?.stop();
             if (!json)
-                console.log(`\u2713 Connected: ${account.name || account._id}`);
+                success(`Connected: ${account.name || account.id}`);
             // 2. Apply shields
             if (!opts.skipShields) {
                 const shieldList = opts.shields
@@ -266,19 +473,22 @@ Available shields: ${AVAILABLE_SHIELDS.join(", ")}
                     console.log(`\nApplying ${shieldList.length} shield(s)...`);
                 for (const shield of shieldList) {
                     try {
-                        await apiRequest(`/rules/presets/${shield}`, { method: "POST", body: {} });
+                        await client.rules.applyPreset(shield);
                         if (!json)
-                            console.log(`  \u2713 ${shield}`);
+                            success(`  ${shield}`);
                     }
                     catch (err) {
                         if (!json)
-                            console.log(`  \u2717 ${shield}: ${err.message}`);
+                            fail(`  ${shield}: ${err.message}`);
                     }
                 }
             }
             // 3. Set up alerts
             if (!opts.skipAlerts) {
                 const channels = [];
+                if (opts.alertPagerduty) {
+                    channels.push({ type: "pagerduty", name: "PagerDuty", config: { routingKey: opts.alertPagerduty }, enabled: true });
+                }
                 if (opts.alertEmail) {
                     channels.push({ type: "email", name: "Email", config: { email: opts.alertEmail }, enabled: true });
                 }
@@ -289,28 +499,30 @@ Available shields: ${AVAILABLE_SHIELDS.join(", ")}
                     channels.push({ type: "slack", name: "Slack", config: { webhookUrl: opts.alertSlack }, enabled: true });
                 }
                 if (channels.length === 0 && !json) {
-                    const email = await ask("\nAlert email (or Enter to skip): ");
-                    if (email) {
-                        channels.push({ type: "email", name: "Email", config: { email }, enabled: true });
+                    const pdKey = await ask("\nPagerDuty routing key (or Enter to skip): ");
+                    if (pdKey) {
+                        channels.push({ type: "pagerduty", name: "PagerDuty", config: { routingKey: pdKey }, enabled: true });
                     }
                 }
                 if (channels.length > 0) {
                     if (!json)
                         console.log("Setting up alerts...");
                     try {
-                        await apiRequest("/alerts/channels", { method: "PUT", body: { channels } });
+                        // Append to existing channels — re-running onboard must not wipe prior integrations.
+                        const existing = await client.alerts.channels().catch(() => []);
+                        await client.alerts.updateChannels([...existing, ...channels]);
                         if (!json)
-                            console.log(`  \u2713 ${channels.length} alert channel(s) configured`);
+                            success(`  ${channels.length} alert channel(s) configured`);
                     }
                     catch (err) {
                         if (!json)
-                            console.log(`  \u2717 Alerts: ${err.message}`);
+                            fail(`  Alerts: ${err.message}`);
                     }
                 }
             }
             // 4. Complete onboarding
             try {
-                await apiRequest("/accounts/me", { method: "PATCH", body: { onboardingCompleted: true } });
+                await client.account.update({ onboardingCompleted: true });
             }
             catch {
                 // Non-critical
@@ -319,22 +531,22 @@ Available shields: ${AVAILABLE_SHIELDS.join(", ")}
                 outputJson({
                     success: true,
                     provider,
-                    accountId: account._id || account.id,
+                    accountId: account.id,
                     accountName: account.name,
                 });
             }
             else {
-                console.log(`\n\u2705 Setup complete! Kill Switch is monitoring your ${PROVIDER_HELP[provider].name} account.`);
+                console.log(`\nSetup complete! Kill Switch is monitoring your ${PROVIDER_HELP[provider].name} account.`);
                 console.log("\nNext steps:");
-                console.log("  kill-switch accounts list      — view connected accounts");
-                console.log("  kill-switch check               — run a monitoring check");
-                console.log("  kill-switch shield --list       — see all available shields");
-                console.log("  kill-switch onboard --provider  — add another provider\n");
+                console.log("  kill-switch check                                         — run a monitoring check");
+                console.log("  kill-switch alerts add --type pagerduty --routing-key KEY — set up on-call alerts");
+                console.log("  kill-switch alerts test                                   — verify alerts work");
+                console.log("  kill-switch accounts list                                 — view connected accounts");
+                console.log("  kill-switch onboard --provider <p>                        — add another provider\n");
             }
         }
         catch (err) {
-            outputError(err.message, json);
-            process.exit(1);
+            handleError(err, json);
         }
     });
 }

package/dist/commands/orgs.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+import type { ClientFactory } from "../types.js";
+export declare function registerOrgCommands(program: Command, createClient: ClientFactory): void;