@merchbase/cli 1.0.2 → 3.0.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # MerchBase CLI Changelog
 
+## v3.0.0 - 2026-06-15
+
+- Added `merchbase auth status`, `merchbase auth set`, `merchbase auth set --stdin`, and `merchbase auth clear` so local users and desktop agents can use macOS Keychain auth while automation can keep using `MERCHBASE_API_KEY`.
+- Changed missing-auth guidance to point operators at `merchbase auth set` for local setup and `MERCHBASE_API_KEY` for CI, scripts, and agent runtimes.
+- Changed `merchbase config show` to report the active auth source without printing secrets.
+- Changed config management to use explicit key/value commands: `config get`, `config set`, `config unset`, and `config reset`.
+- Removed `config clear`; use `merchbase config reset`.
+
+## v2.0.0 - 2026-06-10
+
+- Product lookup now accepts ASINs copied from sales records, and product marketplace filters match concrete seller marketplaces case-insensitively.
+- Help now includes high-value examples for products, designs, sales, dashboard snapshots, and planner status.
+- Top-level `--help` output now uses the same curated help topics as `merchbase help`, so common command groups are easier to discover.
+- `merchbase health` now verifies auth, resolved account context, and sync readiness.
+- CLI config no longer stores a default account; API keys resolve the account, with marketplace override still available.
+- The CLI is now read-oriented for seller and agent analysis. Server-side mutation commands are no longer exposed for product sync, sales sync, Merch status-count sync, planner enable/disable, design facet updates, or facet classification.
+- `merchbase ingestion planner state` remains available as a read-only planner status command; planner controls and ripcord reset remain dashboard actions.
+- `merchbase setup` commands are no longer exposed; account discovery and metadata setup are handled by the automatic planner.
+- Missing API keys now return an explicit auth error instead of a generic internal error.
+
 ## v1.0.2 - 2026-04-02
 
 - Setup help now adapts to your saved account and current setup status, so `merchbase --help` and sync command help point to the next missing step instead of showing the same static checklist every time.

package/README.md

@@ -11,18 +11,36 @@ npm install -g @merchbase/cli
 ## Setup
 
 ```bash
-export MERCHBASE_API_KEY=mb_live_xxx
+merchbase auth set
 merchbase config set base-url https://app.merchbase.co
-merchbase config set account <accountId> us
+merchbase config set marketplace US # optional
+merchbase health
+```
+
+`merchbase auth set` stores the API key in macOS Keychain. For automation,
+CI, and agent runtimes, `MERCHBASE_API_KEY` overrides the stored key:
+
+```bash
+export MERCHBASE_API_KEY=mb_live_xxx
 ```
 
 ## Usage
 
 ```bash
 merchbase help
+merchbase auth status
+merchbase config show
+merchbase health
 merchbase products list
+merchbase products get B000000001 --marketplace us
+merchbase products metadata --marketplace us
 merchbase sales summary --range 30d
+merchbase ingestion planner state
 merchbase changelog
 ```
 
+Product ASIN lookup accepts ASINs copied from sales records. Product
+marketplace filters are case-insensitive and match concrete seller
+marketplaces.
+
 The CLI reads release notes from the packaged `CHANGELOG.md`, so installed users can inspect the current shipped notes with `merchbase changelog`.

package/dist/auth.d.ts

@@ -0,0 +1,22 @@
+import { type SecureStoreStatus } from "./secure-store.js";
+export declare const API_KEY_ENV_VAR = "MERCHBASE_API_KEY";
+export type AuthSource = "env" | "secure-store" | "missing";
+export interface CliAuthState {
+    apiKey?: string;
+    authenticated: boolean;
+    envVar: typeof API_KEY_ENV_VAR;
+    hasEnvOverride: boolean;
+    hasStoredApiKey: boolean;
+    secureStore: SecureStoreStatus;
+    source: AuthSource;
+}
+export type PublicCliAuthState = Omit<CliAuthState, "apiKey">;
+export declare const resolveAuthState: () => Promise<CliAuthState>;
+export declare const setStoredApiKey: (apiKey: string) => Promise<CliAuthState>;
+export declare const clearStoredApiKey: () => Promise<{
+    auth: CliAuthState;
+    cleared: boolean;
+}>;
+export declare const toPublicAuthState: (state: CliAuthState) => PublicCliAuthState;
+export declare const getMissingAuthMessage: () => string;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAe,MAAM,mBAAmB,CAAC;AAExE,eAAO,MAAM,eAAe,sBAAsB,CAAC;AAEnD,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,cAAc,GAAG,SAAS,CAAC;AAE5D,MAAM,WAAW,YAAY;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,eAAe,CAAC;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,MAAM,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB,QAAa,OAAO,CAAC,YAAY,CAwC7D,CAAC;AAEF,eAAO,MAAM,eAAe,GAAU,QAAQ,MAAM,0BAWnD,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;EAO7B,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,YAAY,KAAG,kBAOtD,CAAC;AAEH,eAAO,MAAM,qBAAqB,cACyG,CAAC"}

package/dist/auth.js

@@ -0,0 +1,76 @@
+import { secureStore } from "./secure-store.js";
+export const API_KEY_ENV_VAR = "MERCHBASE_API_KEY";
+export const resolveAuthState = async () => {
+    const status = await secureStore.getStatus();
+    const envApiKey = resolveEnvApiKey();
+    if (envApiKey) {
+        return {
+            apiKey: envApiKey,
+            authenticated: true,
+            envVar: API_KEY_ENV_VAR,
+            hasEnvOverride: true,
+            hasStoredApiKey: status.configured,
+            secureStore: status,
+            source: "env",
+        };
+    }
+    if (status.available && status.configured) {
+        const storedApiKey = await secureStore.readApiKey();
+        if (storedApiKey) {
+            return {
+                apiKey: storedApiKey,
+                authenticated: true,
+                envVar: API_KEY_ENV_VAR,
+                hasEnvOverride: false,
+                hasStoredApiKey: true,
+                secureStore: status,
+                source: "secure-store",
+            };
+        }
+    }
+    return {
+        authenticated: false,
+        envVar: API_KEY_ENV_VAR,
+        hasEnvOverride: false,
+        hasStoredApiKey: status.configured,
+        secureStore: status,
+        source: "missing",
+    };
+};
+export const setStoredApiKey = async (apiKey) => {
+    const trimmed = apiKey.trim();
+    if (!trimmed) {
+        throw createCliError("BAD_REQUEST", "auth set requires an API key from an argument, prompt, or --stdin.");
+    }
+    await secureStore.writeApiKey(trimmed);
+    return resolveAuthState();
+};
+export const clearStoredApiKey = async () => {
+    const cleared = await secureStore.clearApiKey();
+    return {
+        auth: await resolveAuthState(),
+        cleared,
+    };
+};
+export const toPublicAuthState = (state) => ({
+    authenticated: state.authenticated,
+    envVar: state.envVar,
+    hasEnvOverride: state.hasEnvOverride,
+    hasStoredApiKey: state.hasStoredApiKey,
+    secureStore: state.secureStore,
+    source: state.source,
+});
+export const getMissingAuthMessage = () => `Missing MerchBase auth. Run \`merchbase auth set\` for local use or export ${API_KEY_ENV_VAR} for automation, CI, and agent runtimes.`;
+const resolveEnvApiKey = () => {
+    const apiKey = process.env[API_KEY_ENV_VAR]?.trim();
+    if (!apiKey || apiKey === "null" || apiKey === "undefined") {
+        return undefined;
+    }
+    return apiKey;
+};
+const createCliError = (code, message) => {
+    const error = new Error(message);
+    error.code = code;
+    return error;
+};
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAExE,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAgBnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,IAA2B,EAAE;IAC9D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IAErC,IAAI,SAAS,EAAE,CAAC;QACZ,OAAO;YACH,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,eAAe;YACvB,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,MAAM,CAAC,UAAU;YAClC,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,KAAK;SAChB,CAAC;IACN,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,CAAC;QAEpD,IAAI,YAAY,EAAE,CAAC;YACf,OAAO;gBACH,MAAM,EAAE,YAAY;gBACpB,aAAa,EAAE,IAAI;gBACnB,MAAM,EAAE,eAAe;gBACvB,cAAc,EAAE,KAAK;gBACrB,eAAe,EAAE,IAAI;gBACrB,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,cAAc;aACzB,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO;QACH,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,eAAe;QACvB,cAAc,EAAE,KAAK;QACrB,eAAe,EAAE,MAAM,CAAC,UAAU;QAClC,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,SAAS;KACpB,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,cAAc,CAChB,aAAa,EACb,oEAAoE,CACvE,CAAC;IACN,CAAC;IAED,MAAM,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,gBAAgB,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE;IACxC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC;IAEhD,OAAO;QACH,IAAI,EAAE,MAAM,gBAAgB,EAAE;QAC9B,OAAO;KACV,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAmB,EAAsB,EAAE,CAAC,CAAC;IAC3E,aAAa,EAAE,KAAK,CAAC,aAAa;IAClC,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,cAAc,EAAE,KAAK,CAAC,cAAc;IACpC,eAAe,EAAE,KAAK,CAAC,eAAe;IACtC,WAAW,EAAE,KAAK,CAAC,WAAW;IAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,EAAE,CACtC,8EAA8E,eAAe,0CAA0C,CAAC;AAE5I,MAAM,gBAAgB,GAAG,GAAG,EAAE;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QACzD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAA6B,CAAC;IAC7D,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiCpC,eAAO,MAAM,aAAa,eAwjBzB,CAAC;AAEF,eAAO,MAAM,MAAM,GAAU,eAAmB,kBAS/C,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqDpC,eAAO,MAAM,aAAa,eAyoBzB,CAAC;AAEF,eAAO,MAAM,MAAM,GAAU,eAAmB,kBAS/C,CAAC"}

package/dist/cli.js

@@ -1,22 +1,32 @@
 import { createRequire } from "node:module";
 import { createMerchbaseClient, } from "@merchbase/http-client";
 import { Command } from "commander";
+import { clearStoredApiKey, getMissingAuthMessage, resolveAuthState, setStoredApiKey, toPublicAuthState, } from "./auth.js";
 import { normalizeBaseUrl } from "./base-url.js";
 import { loadCliChangelog, loadCliVersion, normalizeChangelogVersion, selectCliChangelogEntry, } from "./changelog.js";
-import { clearConfig, getConfigPath, loadConfig, updateConfig, } from "./config.js";
+import { CONFIG_KEYS, clearConfig, getConfigPath, getConfigValue, loadConfig, parseConfigKey, setConfigValue, unsetConfigValue, } from "./config.js";
 import { renderHelp, resolveHelpTopicKey } from "./help.js";
 import { printError, printSuccess } from "./output.js";
+import { readSecretFromPrompt, readSecretFromStdin } from "./secret-input.js";
 import { buildSetupHelpText } from "./setup-help.js";
-const API_KEY_ENV_VAR = "MERCHBASE_API_KEY";
 const require = createRequire(import.meta.url);
 const CLI_PACKAGE = require("../package.json");
 const CLI_VERSION = CLI_PACKAGE.version ?? "0.0.0";
 const HELP_FLAGS = new Set(["-h", "--help"]);
+const TOP_LEVEL_HELP_TOPICS = new Set([
+    "auth",
+    "changelog",
+    "config",
+    "dashboard",
+    "designs",
+    "health",
+    "ingestion",
+    "merch-account",
+    "products",
+    "sales",
+]);
 const SETUP_TARGETS_BY_COMMAND_PATH = {
     "merch-account get": "merch-account-get",
-    "merch-account sync": "merch-account-sync",
-    "products sync": "products-sync",
-    "sales sync": "sales-sync",
 };
 export const createProgram = () => {
     const program = new Command();
@@ -75,20 +85,99 @@ export const createProgram = () => {
     }));
     const configCommand = program
         .command("config")
-        .description("Manage CLI config");
+        .description("Manage local CLI config")
+        .action(async () => {
+        process.stdout.write(await renderHelp("config"));
+    });
+    const authCommand = program
+        .command("auth")
+        .description("Manage CLI authentication")
+        .action(async () => {
+        process.stdout.write(await renderHelp("auth"));
+    });
+    authCommand
+        .command("status")
+        .description("Show resolved auth source")
+        .action(wrap(async () => toPublicAuthState(await resolveAuthState())));
+    authCommand
+        .command("set [apiKey]")
+        .description("Store an API key in macOS Keychain")
+        .option("--stdin", "Read the API key from stdin")
+        .action(wrap(async (apiKey, options) => {
+        const input = await resolveAuthSetInput({
+            apiKey,
+            stdin: Boolean(options.stdin),
+        });
+        const auth = await setStoredApiKey(input.apiKey);
+        return {
+            inputSource: input.source,
+            stored: true,
+            auth: toPublicAuthState(auth),
+        };
+    }));
+    authCommand
+        .command("clear")
+        .description("Remove stored Keychain auth")
+        .action(wrap(async () => {
+        const result = await clearStoredApiKey();
+        return {
+            auth: toPublicAuthState(result.auth),
+            cleared: result.cleared,
+        };
+    }));
     configCommand
         .command("show")
         .description("Show current config")
         .action(wrap(async () => {
         const config = await loadConfig();
         return {
+            auth: toPublicAuthState(await resolveAuthState()),
             path: getConfigPath(),
             config,
         };
     }));
     configCommand
-        .command("clear")
-        .description("Clear local config")
+        .command("get [key]")
+        .description("Get one config value")
+        .action(wrap(async (keyInput) => {
+        const key = requireConfigKey(keyInput, "get");
+        const config = await loadConfig();
+        return {
+            key,
+            path: getConfigPath(),
+            value: getConfigValue(config, key),
+        };
+    }));
+    configCommand
+        .command("set [key] [value]")
+        .description("Set one config value")
+        .action(wrap(async (keyInput, value) => {
+        const key = requireConfigKey(keyInput, "set");
+        const nextValue = requireConfigValue(value, key);
+        const config = await setConfigValue(key, key === "base-url" ? normalizeBaseUrl(nextValue) : nextValue);
+        return {
+            config,
+            key,
+            path: getConfigPath(),
+            saved: true,
+        };
+    }));
+    configCommand
+        .command("unset [key]")
+        .description("Unset one config value")
+        .action(wrap(async (keyInput) => {
+        const key = requireConfigKey(keyInput, "unset");
+        const config = await unsetConfigValue(key);
+        return {
+            config,
+            key,
+            path: getConfigPath(),
+            saved: true,
+        };
+    }));
+    configCommand
+        .command("reset")
+        .description("Reset local config")
         .action(wrap(async () => {
         const config = await clearConfig();
         return {
@@ -96,28 +185,41 @@ export const createProgram = () => {
             config,
         };
     }));
-    const configSet = configCommand
-        .command("set")
-        .description("Set config values");
-    configSet
-        .command("base-url <value>")
-        .description("Set API base URL")
-        .action(wrap(async (value) => updateConfig({ baseUrl: normalizeBaseUrl(value) })));
-    configSet
-        .command("account <accountId> [marketplace]")
-        .description("Set default account and optional marketplace")
-        .action(wrap(async (accountId, marketplace) => updateConfig({ account: accountId, marketplace })));
-    configSet
-        .command("range <value>")
-        .description("Set default range alias or date interval")
-        .action(wrap(async (value) => updateConfig({ range: value })));
-    const accountsCommand = program
-        .command("accounts")
-        .description("Accounts API commands");
-    accountsCommand
-        .command("get")
-        .description("Get account details")
-        .action(wrapWithClient(async (client) => client.accounts.get.query()));
+    program
+        .command("health")
+        .description("Check auth, account context, and sync readiness")
+        .action(wrapWithClient(async (client, config) => {
+        const [account, readiness, planner] = await Promise.all([
+            client.accounts.get.query(),
+            client.setup.status.query(),
+            client.ingestion.planner.state.query(),
+        ]);
+        const missingReadiness = readiness.steps
+            .filter((step) => !step.ready)
+            .map((step) => step.key);
+        return {
+            ok: true,
+            baseUrl: config.baseUrl,
+            marketplace: config.marketplace ?? account.marketplace,
+            account,
+            readiness: {
+                ready: missingReadiness.length === 0,
+                missing: missingReadiness,
+                steps: readiness.steps,
+                ingestionClient: planner.ingestionClient,
+                planner: {
+                    enabled: planner.state.enabled,
+                    updatedAt: planner.state.updatedAt,
+                    due: planner.work.due,
+                    dispatchable: planner.work.dispatchable,
+                    active: planner.work.active,
+                    blockedBy: planner.work.blockedBy,
+                    nextAction: planner.work.nextAction,
+                },
+                storedData: planner.storedData,
+            },
+        };
+    }));
     const merchAccountCommand = program
         .command("merch-account")
         .description("Amazon Merch account API commands");
@@ -129,12 +231,25 @@ export const createProgram = () => {
         if (merchAccount) {
             return merchAccount;
         }
-        throw createCliError("PRECONDITION_FAILED", "Merch account metadata is not available for this account. Run `merchbase merch-account sync` first.");
+        throw createCliError("PRECONDITION_FAILED", "Merch account metadata is not available for this account. Keep the ingestion client connected and enable automatic planning.");
     }));
-    merchAccountCommand
-        .command("sync")
-        .description("Start an Amazon Merch account metadata sync")
-        .action(wrapWithClient(async (client) => client.merchAccount.sync.mutate()));
+    const merchAccountStatusCountsCommand = merchAccountCommand
+        .command("status-counts")
+        .description("Amazon Merch status counts commands");
+    merchAccountStatusCountsCommand
+        .command("get")
+        .description("Get saved Amazon Merch status counts")
+        .action(wrapWithClient(async (client) => client.merchAccount.statusCounts.get.query()));
+    const ingestionCommand = program
+        .command("ingestion")
+        .description("Ingestion operator state commands");
+    const plannerCommand = ingestionCommand
+        .command("planner")
+        .description("Automatic planner commands");
+    plannerCommand
+        .command("state")
+        .description("Get automatic planner state")
+        .action(wrapWithClient(async (client) => client.ingestion.planner.state.query()));
     const productsCommand = program
         .command("products")
         .description("Products API commands");
@@ -171,7 +286,7 @@ export const createProgram = () => {
     productsCommand
         .command("get <asin>")
         .description("Get product details")
-        .option("--marketplace <marketplace>")
+        .requiredOption("--marketplace <marketplace>")
         .action(wrapWithClient(async (client, _config, asin, options) => client.products.get.query({
         asin,
         marketplace: options.marketplace,
@@ -180,10 +295,8 @@ export const createProgram = () => {
         .command("metadata")
         .description("Get product dataset metadata")
         .option("--marketplace <marketplace>")
-        .option("--asin <asin>")
         .action(wrapWithClient(async (client, _config, options) => client.products.metadata.query({
         marketplace: options.marketplace,
-        asin: options.asin,
     })));
     const productCatalogCommand = productsCommand
         .command("catalog")
@@ -205,13 +318,6 @@ export const createProgram = () => {
         .action(wrapWithClient(async (client, _config, productType) => client.products.catalog.product.query({
         productType,
     })));
-    productsCommand
-        .command("sync")
-        .description("Start a products sync")
-        .option("--range <range>", "1d|3d|7d|30d|90d", "7d")
-        .action(wrapWithClient(async (client, _config, options) => client.products.sync.mutate({
-        rangePreset: options.range,
-    })));
     const designsCommand = program
         .command("designs")
         .description("Designs API commands");
@@ -241,21 +347,6 @@ export const createProgram = () => {
         .command("get <designId>")
         .description("Get design facets")
         .action(wrapWithClient(async (client, _config, designId) => client.designs.facets.get.query({ designId })));
-    designFacetsCommand
-        .command("update <designId>")
-        .description("Replace design facets")
-        .requiredOption("--facet <facetValue...>", "Facet value in the form facet:name. Repeat flag for multiple values.")
-        .action(wrapWithClient(async (client, _config, designId, options) => client.designs.facets.update.mutate({
-        designId,
-        facets: options.facet.map(parseFacetValue),
-    })));
-    designFacetsCommand
-        .command("classify")
-        .description("Queue facet classification")
-        .requiredOption("--design-id <designIds...>")
-        .action(wrapWithClient(async (client, _config, options) => client.designs.facets.classify.mutate({
-        designIds: options.designId,
-    })));
     designFacetsCommand
         .command("status <jobId>")
         .description("Get classify job status")
@@ -263,13 +354,6 @@ export const createProgram = () => {
     const salesCommand = program
         .command("sales")
         .description("Sales API commands");
-    salesCommand
-        .command("sync")
-        .description("Start a sales sync")
-        .option("--range <range>", "1d|3d|7d|30d|90d", "7d")
-        .action(wrapWithClient(async (client, _config, options) => client.sales.sync.mutate({
-        rangePreset: options.range,
-    })));
     salesCommand
         .command("summary")
         .description("Get sales summary")
@@ -444,54 +528,72 @@ function wrap(handler) {
 function wrapWithClient(handler) {
     return wrap(async (...args) => {
         const config = await loadConfig();
-        const apiKey = resolveApiKey();
-        if (!apiKey) {
-            throw new Error(`Missing API key. Set ${API_KEY_ENV_VAR} in your environment.`);
+        const auth = await resolveAuthState();
+        if (!auth.apiKey) {
+            throw createCliError("UNAUTHORIZED", getMissingAuthMessage());
         }
         const headers = {};
-        if (config.account) {
-            headers["x-merchbase-account"] = config.account;
-        }
         if (config.marketplace) {
             headers["x-merchbase-marketplace"] = config.marketplace;
         }
         const client = createMerchbaseClient({
             baseUrl: config.baseUrl,
-            apiKey,
+            apiKey: auth.apiKey,
             headers,
         });
         return handler(client, config, ...args);
     });
 }
-function parseFacetValue(value) {
-    const separator = value.indexOf(":");
-    if (separator < 1 || separator === value.length - 1) {
-        throw new Error(`Invalid facet value "${value}". Expected <facet>:<name>.`);
-    }
-    return {
-        facet: value.slice(0, separator),
-        name: value.slice(separator + 1),
-    };
-}
 function resolveRange(config, range) {
     return range ?? config.range;
 }
-function resolveApiKey() {
-    const apiKey = process.env[API_KEY_ENV_VAR]?.trim();
-    if (!apiKey || apiKey === "null" || apiKey === "undefined") {
-        return undefined;
-    }
-    return apiKey;
-}
 const createCliError = (code, message) => {
     const error = new Error(message);
     error.code = code;
     return error;
 };
-const maybeRenderHelp = (program, argv) => {
+const resolveAuthSetInput = async (input) => {
+    if (input.apiKey && input.stdin) {
+        throw createCliError("BAD_REQUEST", "Use either an API-key argument or --stdin, not both.");
+    }
+    if (input.apiKey) {
+        return {
+            apiKey: input.apiKey,
+            source: "argument",
+        };
+    }
+    if (input.stdin) {
+        return {
+            apiKey: await readSecretFromStdin(),
+            source: "stdin",
+        };
+    }
+    return {
+        apiKey: await readSecretFromPrompt("MerchBase API key: "),
+        source: "prompt",
+    };
+};
+const requireConfigKey = (value, command) => {
+    const key = parseConfigKey(value);
+    if (key) {
+        return key;
+    }
+    if (!value) {
+        throw createCliError("BAD_REQUEST", `Missing config key. Usage: merchbase config ${command} <key>${command === "set" ? " <value>" : ""}. Expected: ${CONFIG_KEYS.join(", ")}.`);
+    }
+    throw createCliError("BAD_REQUEST", `Unknown config key "${value}". Expected: ${CONFIG_KEYS.join(", ")}.`);
+};
+const requireConfigValue = (value, key) => {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+        throw createCliError("BAD_REQUEST", `Missing value for config key "${key}". Usage: merchbase config set ${key} <value>.`);
+    }
+    return trimmed;
+};
+const maybeRenderHelp = async (program, argv) => {
     const args = argv.slice(2);
     if (args.length === 0) {
-        return renderCommandHelp(program, []);
+        return await renderHelp("global");
     }
     if (args[0] === "help") {
         return null;
@@ -501,7 +603,11 @@ const maybeRenderHelp = (program, argv) => {
         return null;
     }
     const commandPath = getCommandPath(args.slice(0, helpFlagIndex));
-    return renderCommandHelp(program, commandPath);
+    const topicKey = getTopLevelHelpTopic(commandPath);
+    if (topicKey) {
+        return await renderHelp(topicKey);
+    }
+    return await renderCommandHelp(program, commandPath);
 };
 const renderCommandHelp = async (program, commandPath) => {
     const command = findCommand(program, commandPath) ?? program;
@@ -544,4 +650,16 @@ const findCommand = (program, commandPath) => {
 const getSetupHelpTarget = (commandPath) => {
     return SETUP_TARGETS_BY_COMMAND_PATH[commandPath.join(" ")] ?? null;
 };
+const getTopLevelHelpTopic = (commandPath) => {
+    if (commandPath.length === 0) {
+        return "global";
+    }
+    if (commandPath.length > 1) {
+        return null;
+    }
+    if (!TOP_LEVEL_HELP_TOPICS.has(commandPath[0] ?? "")) {
+        return null;
+    }
+    return resolveHelpTopicKey(commandPath);
+};
 //# sourceMappingURL=cli.js.map