@myapihq/cli 2.2.0 → 2.4.0

package/dist/commands/image.js

@@ -1,7 +1,7 @@
 import { image as sdkImage } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson, banner } from '../output.js';
-import { formatDate, pollJob } from '../utils.js';
+import { formatDate, pollJob, retryFunds } from '../utils.js';
 import { requireOrg, requireArg } from '../helpers.js';
 export const EXPOSES = [
     'POST /image/orgs/{org_id}/generate',
@@ -63,7 +63,10 @@ async function generate(promptArg, flags) {
     // Cost is per-model — see `myapi image models`. Banner shown on stderr so
     // --json output stays clean for piping.
     banner(`› Generating image${payload.model ? ` (${payload.model})` : ''}…`);
-    const job = await sdkImage.generateImage(config.api_key, orgId, payload);
+    const job = await retryFunds(() => sdkImage.generateImage(config.api_key, orgId, payload));
+    // Surface the job id BEFORE polling — the job is already charged, so a
+    // poll timeout must leave the user a handle to recover it.
+    banner(`› Job ${job.job_id} submitted.`);
     const final = await pollJob({
         label: 'Generating image',
         timeoutMs: 90_000,
@@ -72,7 +75,7 @@ async function generate(promptArg, flags) {
         isDone: s => s.status === 'completed',
         isFailed: s => s.status === 'failed',
         failedMessage: 'Image generation failed',
-        timeoutMessage: 'Image generation timed out — re-run "myapi image get <id>" to check later.',
+        timeoutMessage: `Image generation timed out — the job may still complete. Check later with: myapi image get ${job.job_id}`,
     });
     if (flags.json) {
         printJson(final);
@@ -207,7 +210,7 @@ The asset lands in your org's storage and is also visible via "myapi storage lis
         if (usage)
             info(`Usage: ${usage}`);
         else
-            error(`Unknown subcommand: ${subcommand}. Run "myapi image --help" for the list.`);
+            info(`Unknown subcommand: ${subcommand}. Run "myapi image --help" for the list.`);
         return;
     }
     switch (subcommand) {

package/dist/commands/keys-validation.test.js

@@ -48,6 +48,11 @@ describe('_parseGrants', () => {
             expect(typeof r).toBe('string');
             expect(r).toMatch(/Invalid access "admin"/);
         });
+        it('extra colon segments — no silent truncation to the first pair', () => {
+            const r = _parseGrants('email:read:write');
+            expect(typeof r).toBe('string');
+            expect(r).toMatch(/Invalid access "read:write"/);
+        });
         it('an empty string', () => {
             expect(typeof _parseGrants('')).toBe('string');
             expect(_parseGrants('')).toMatch(/--grant was empty/);

package/dist/commands/keys.js

@@ -30,7 +30,11 @@ const KEY_KINDS = ['function', 'manual', 'account'];
 export function _parseGrants(raw) {
     const grants = {};
     for (const part of raw.split(',').map(s => s.trim()).filter(Boolean)) {
-        const [slot, accessRaw] = part.includes(':') ? part.split(':', 2) : [part, 'write'];
+        // Split on the FIRST colon only, keeping the rest intact so malformed
+        // grants like "email:read:write" fail validation instead of silently
+        // truncating to "email:read".
+        const colon = part.indexOf(':');
+        const [slot, accessRaw] = colon >= 0 ? [part.slice(0, colon), part.slice(colon + 1)] : [part, 'write'];
         if (!VALID_GRANT_TARGETS.has(slot)) {
             return `Unknown slot "${slot}" in --grant. Valid slots: ${[...hq.GRANTABLE_SLOTS].join(', ')} (or "*").`;
         }
@@ -87,7 +91,7 @@ function describeKey(k) {
 // ── Subcommands ──────────────────────────────────────────────────────────────
 export async function createNew(flags) {
     const config = requireConfig();
-    let name = flags.name || '';
+    let name = typeof flags.name === 'string' ? flags.name : '';
     if (!name)
         name = await ask('Enter a name for the new key: ');
     if (!name.trim())

package/dist/commands/llm.js

@@ -3,6 +3,7 @@ import { llm as sdkLlm } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { error, info, printTable, printJson } from '../output.js';
 import { requireOrg } from '../helpers.js';
+import { retryFunds } from '../utils.js';
 export const EXPOSES = [
     'POST /llm/orgs/{org_id}/complete',
     'POST /llm/orgs/{org_id}/embed',
@@ -47,6 +48,25 @@ async function defaultChatModel(apiKey, orgId) {
     }
     return chat.id;
 }
+// Resolve the embed model from --model, else the live catalog. Unlike chat
+// we don't silently pick a default when several are served — embedding
+// vectors aren't cross-model compatible, so an ambiguous pick is a footgun.
+// One served embed model → use it; none → catalog-truthful error (not a
+// hardcoded "not available today"); many → make the caller choose.
+async function resolveEmbedModel(apiKey, orgId, flags) {
+    if (typeof flags.model === 'string' && flags.model)
+        return flags.model;
+    const embeds = (await loadModels(apiKey, orgId)).filter(m => m.kind === 'embed');
+    if (embeds.length === 1)
+        return embeds[0].id;
+    if (embeds.length === 0) {
+        error('No embedding model is currently served — the catalog has none. Run "myapi llm models --kind embed" to check.');
+    }
+    else {
+        error(`Multiple embedding models available — pass --model <id>. Options: ${embeds.map(m => m.id).join(', ')}`);
+    }
+    throw new Error('unreachable'); // satisfy the type checker
+}
 function readPromptArg(promptArg, flags) {
     if (typeof flags.file === 'string' && flags.file) {
         return fs.readFileSync(flags.file, 'utf-8');
@@ -123,13 +143,13 @@ async function complete(promptArg, flags) {
     const stop = typeof flags.stop === 'string' && flags.stop
         ? flags.stop.split(',').map(s => s.trim()).filter(Boolean)
         : undefined;
-    const res = await sdkLlm.complete(config.api_key, orgId, {
+    const res = await retryFunds(() => sdkLlm.complete(config.api_key, orgId, {
         model,
         messages,
         max_tokens: typeof flags['max-tokens'] === 'number' ? flags['max-tokens'] : undefined,
         temperature: typeof flags.temperature === 'number' ? flags.temperature : undefined,
         stop,
-    });
+    }));
     if (flags.json) {
         printJson(res);
         return;
@@ -140,14 +160,12 @@ async function complete(promptArg, flags) {
 }
 async function embed(inputArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi llm embed "<text>" --model <id> [--org <id>]');
-    const model = typeof flags.model === 'string' ? flags.model : '';
-    if (!model)
-        error('Missing required flag: --model. Run "myapi llm models" to list embed models.');
+    const orgId = requireOrg(flags, config, 'myapi llm embed "<text>" [--model <id>] [--org <id>]');
+    const model = await resolveEmbedModel(config.api_key, orgId, flags);
     const text = readPromptArg(inputArg, flags);
     if (!text.trim())
         error('Empty input. Pass <text> as an argument, "-" to read stdin, or --file <path>.');
-    const res = await sdkLlm.embed(config.api_key, orgId, { model, input: text });
+    const res = await retryFunds(() => sdkLlm.embed(config.api_key, orgId, { model, input: text }));
     if (flags.json) {
         printJson(res);
         return;
@@ -194,7 +212,7 @@ async function classify(inputArg, flags) {
     if (labels.length === 0)
         error('--labels must contain at least one label');
     const multi = flags.multi === true;
-    const res = await sdkLlm.classify(config.api_key, orgId, { input, labels, multi, tier: tierFromFlag(flags) });
+    const res = await retryFunds(() => sdkLlm.classify(config.api_key, orgId, { input, labels, multi, tier: tierFromFlag(flags) }));
     if (flags.json) {
         printJson(res);
         return;
@@ -219,7 +237,7 @@ async function extract(inputArg, flags) {
         error('Missing required flag: --schema <path|json>');
         return;
     }
-    const res = await sdkLlm.extract(config.api_key, orgId, { input, schema, tier: tierFromFlag(flags) });
+    const res = await retryFunds(() => sdkLlm.extract(config.api_key, orgId, { input, schema, tier: tierFromFlag(flags) }));
     if (flags.json) {
         printJson(res);
         return;
@@ -237,11 +255,11 @@ async function summarize(inputArg, flags) {
     if (style && !['brief', 'exec', 'bullet'].includes(style)) {
         error('--style must be one of: brief, exec, bullet');
     }
-    const res = await sdkLlm.summarize(config.api_key, orgId, {
+    const res = await retryFunds(() => sdkLlm.summarize(config.api_key, orgId, {
         input,
         style: style,
         tier: tierFromFlag(flags),
-    });
+    }));
     if (flags.json) {
         printJson(res);
         return;
@@ -256,19 +274,22 @@ async function draft(inputArg, flags) {
         error('Missing required flag: --kind <email|message|reply|...>');
         return;
     }
+    // Capture the narrowed value — typeof narrowing doesn't survive into the
+    // retryFunds closure below.
+    const kind = flags.kind;
     const input = readPromptArg(inputArg, flags);
     const promptText = typeof flags.prompt === 'string' ? flags.prompt : '';
     const ctx = parseContextFlag(flags);
     if (!input.trim() && !promptText.trim() && (!ctx || Object.keys(ctx).length === 0)) {
         error('draft needs at least one of: <source text> (arg or --file), --prompt, or --context.');
     }
-    const res = await sdkLlm.draft(config.api_key, orgId, {
+    const res = await retryFunds(() => sdkLlm.draft(config.api_key, orgId, {
         input: input || undefined,
-        kind: flags.kind,
+        kind,
         context: ctx,
         prompt: promptText || undefined,
         tier: tierFromFlag(flags),
-    });
+    }));
     if (flags.json) {
         printJson(res);
         return;
@@ -283,8 +304,7 @@ const SUBCOMMAND_USAGE = {
        [--stop <csv>] [--file <path>] [--org <id>] [--json]
 
   Raw chat completion against a self-hosted catalog model. Without --model,
-  picks the first chat model from "myapi llm models" (today:
-  Qwen/Qwen3-Coder-30B-A3B-Instruct).
+  picks the first chat model from "myapi llm models".
 
   Pass "-" as the prompt to read from stdin. The reply goes to stdout; a
   one-line usage footer (tokens + cost in cents) goes to stderr so it
@@ -293,10 +313,11 @@ const SUBCOMMAND_USAGE = {
   Examples:
     myapi llm complete "summarize: $(cat README.md)"
     cat draft.md | myapi llm complete - --system "You are an editor" --max-tokens 200`,
-    embed: `myapi llm embed "<text>" --model <id> [--file <path>] [--org <id>] [--json]
+    embed: `myapi llm embed "<text>" [--model <id>] [--file <path>] [--org <id>] [--json]
 
-  No embedding model is served on the raw catalog today — this returns
-  EMBED_NOT_AVAILABLE until one is. Use a dedicated embedding API for now.`,
+  Embed text into a dense vector. --model is optional when the catalog serves
+  exactly one embedding model; otherwise pass one from "myapi llm models
+  --kind embed". Returns EMBED_NOT_AVAILABLE if no embedding model is served.`,
     models: `myapi llm models [--kind chat|embed] [--org <id>] [--json]
 
   Lists the live model catalog with per-1M-token pricing in cents.
@@ -358,7 +379,7 @@ Subcommands:
   classify    Pick a label from a set
   complete    Raw chat completion against a catalog model
   draft       Write something (email | reply | message | …)
-  embed       Raw embeddings (no model served on raw today)
+  embed       Raw embeddings against a catalog embed model
   extract     Pull structured data conforming to a JSON Schema
   models      List the live model catalog (id, kind, context, cents/1M)
   summarize   Summarize text (brief | exec | bullet)

package/dist/commands/login-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/login-validation.test.js

@@ -0,0 +1,43 @@
+// Unit tests for the login command's pure PKCE/URL helpers.
+import { describe, it, expect } from 'vitest';
+import * as crypto from 'crypto';
+import { generatePkce, buildAuthorizeUrl } from './login.js';
+describe('generatePkce', () => {
+    it('challenge is base64url(sha256(verifier)) — S256', () => {
+        const { verifier, challenge } = generatePkce();
+        const expected = crypto.createHash('sha256').update(verifier).digest('base64url');
+        expect(challenge).toBe(expected);
+    });
+    it('verifier and state are base64url with sufficient entropy', () => {
+        const { verifier, state } = generatePkce();
+        // 32 random bytes → 43 base64url chars; 16 → 22. No padding, URL-safe.
+        expect(verifier).toMatch(/^[A-Za-z0-9_-]{43}$/);
+        expect(state).toMatch(/^[A-Za-z0-9_-]{22}$/);
+    });
+    it('never repeats across calls', () => {
+        const a = generatePkce();
+        const b = generatePkce();
+        expect(a.verifier).not.toBe(b.verifier);
+        expect(a.state).not.toBe(b.state);
+    });
+});
+describe('buildAuthorizeUrl', () => {
+    it('carries the full OIDC + PKCE parameter set', () => {
+        const pkce = generatePkce();
+        const redirect = 'http://127.0.0.1:49152/callback';
+        const u = new URL(buildAuthorizeUrl('http://127.0.0.1:9999/authorize', redirect, pkce));
+        expect(u.pathname).toBe('/authorize');
+        expect(u.searchParams.get('client_id')).toBe('cl_operator_cli');
+        expect(u.searchParams.get('response_type')).toBe('code');
+        expect(u.searchParams.get('redirect_uri')).toBe(redirect);
+        expect(u.searchParams.get('state')).toBe(pkce.state);
+        expect(u.searchParams.get('code_challenge')).toBe(pkce.challenge);
+        expect(u.searchParams.get('code_challenge_method')).toBe('S256');
+        expect(u.searchParams.get('scope')).toBe('openid email profile');
+    });
+    it('preserves the loopback port in redirect_uri (RFC 8252 any-port)', () => {
+        const pkce = generatePkce();
+        const u = new URL(buildAuthorizeUrl('http://127.0.0.1:1234/authorize', 'http://127.0.0.1:65530/callback', pkce));
+        expect(u.searchParams.get('redirect_uri')).toContain(':65530');
+    });
+});

package/dist/commands/login.d.ts

@@ -0,0 +1,14 @@
+import type { FlagSchema } from '../flags.js';
+import type { Flags } from '../helpers.js';
+import type { Exposes } from '../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare const SCHEMA: FlagSchema;
+export declare const HELP = "Usage: myapi login [--no-browser] [--mock]\n\nSigns in to MyAPI in your browser \u2014 Google, or an email code \u2014 and stores the\nsession in ~/.myapi/config.json. The account created/linked here is the same\naccount model as `myapi account setup`; anonymous setup stays available and\nunchanged.\n\nFlags:\n  --no-browser  Print the sign-in URL instead of opening a browser\n  --mock        Run the flow against an in-process mock (offline UX preview;\n                nothing is saved, no network calls leave your machine)";
+export interface Pkce {
+    verifier: string;
+    challenge: string;
+    state: string;
+}
+export declare function generatePkce(): Pkce;
+export declare function buildAuthorizeUrl(base: string, redirectUri: string, pkce: Pkce): string;
+export declare function login(flags?: Flags): Promise<void>;