@myapihq/cli 2.25.1 → 2.26.0

package/dist/commands/init.d.ts

@@ -0,0 +1,7 @@
+import type { Flags } from '../helpers.js';
+import type { FlagSchema } from '../flags.js';
+import type { Exposes } from '../exposes.js';
+export declare const SCHEMA: FlagSchema;
+export declare const EXPOSES: Exposes;
+export declare const HELP = "Usage: myapi init --org <org_id> [--name <label>] [--spend-cap <usd>]\n\nBind THIS DIRECTORY to one org, so commands run here can never target another.\n\nIt mints an API key locked to that org, stores it, and writes .myapi.json\nnaming the org. The file holds the org id and never the key.\n\n  --org <id>          The org this project works in (required)\n  --name <label>      Key name; defaults to the directory name\n  --spend-cap <usd>   Ceiling for this key, e.g. --spend-cap 50\n  --grant <list>      Narrow what it can touch, e.g. --grant crm:write,email:read\n  --force             Re-bind a directory that already names an org\n\nWhy this exists: `myapi config set-org` writes a default into ~/.myapi/config.json,\none file for the whole machine. Two projects on one laptop overwrite each other's,\nand commands then land in the wrong org while still succeeding. A key that the\nserver has locked to one org cannot do that \u2014 a wrong target is refused (403),\nnot silently accepted.";
+export declare function run(_sub: string | undefined, _args: string[], flags: Flags): Promise<void>;

package/dist/commands/init.js

@@ -0,0 +1,134 @@
+import { hq } from '@myapihq/sdk';
+import { requireConfig, saveConfig, accountLockedTo, loadConfig } from '../config.js';
+import { success, error, info, printJson } from '../output.js';
+import { writeProjectOrg, findProjectOrg, PROJECT_FILE } from '../project.js';
+import { _parseGrants, _dollarsToCents } from './keys.js';
+export const SCHEMA = {
+    org: 'string',
+    name: 'string',
+    // string + _dollarsToCents, matching `keys create` exactly.
+    'spend-cap': 'string',
+    grant: 'string',
+    force: 'boolean',
+};
+export const EXPOSES = ['POST /hq/account/create/key', 'GET /hq/orgs/{id}'];
+export const HELP = `Usage: myapi init --org <org_id> [--name <label>] [--spend-cap <usd>]
+
+Bind THIS DIRECTORY to one org, so commands run here can never target another.
+
+It mints an API key locked to that org, stores it, and writes ${PROJECT_FILE}
+naming the org. The file holds the org id and never the key.
+
+  --org <id>          The org this project works in (required)
+  --name <label>      Key name; defaults to the directory name
+  --spend-cap <usd>   Ceiling for this key, e.g. --spend-cap 50
+  --grant <list>      Narrow what it can touch, e.g. --grant crm:write,email:read
+  --force             Re-bind a directory that already names an org
+
+Why this exists: \`myapi config set-org\` writes a default into ~/.myapi/config.json,
+one file for the whole machine. Two projects on one laptop overwrite each other's,
+and commands then land in the wrong org while still succeeding. A key that the
+server has locked to one org cannot do that — a wrong target is refused (403),
+not silently accepted.`;
+// keys.ts owns the grant syntax; this reuses its pure parser rather than
+// writing a second one. Two parsers for one flag is exactly how `--org` and
+// the campaign source flags drifted into disagreeing.
+function centsOrDie(raw) {
+    const parsed = _dollarsToCents(raw);
+    if (typeof parsed === 'string')
+        error(parsed);
+    return parsed;
+}
+function grantsOrDie(raw) {
+    const parsed = _parseGrants(raw);
+    if (typeof parsed === 'string')
+        error(parsed);
+    return parsed;
+}
+export async function run(_sub, _args, flags) {
+    if (flags.help) {
+        info(HELP);
+        return;
+    }
+    const config = requireConfig();
+    const orgId = typeof flags.org === 'string' ? flags.org : '';
+    if (!orgId) {
+        error('Missing --org <org_id>.\nWhich org does this project work in? List them with: myapi org list\n\n' + HELP);
+    }
+    const existing = findProjectOrg();
+    if (existing && !flags.force) {
+        if (existing.org === orgId) {
+            info(`Already bound: ${existing.file} names org ${orgId}.`);
+            return;
+        }
+        error(`${existing.file} already binds this directory to org ${existing.org}.\n` +
+            `Re-bind to ${orgId} with --force, or edit the file directly.`);
+    }
+    // Name the org before touching anything, so a mistyped id fails here rather
+    // than after a key has been minted. It also puts the NAME in front of the
+    // user: a wrong UUID is unverifiable at a glance, a wrong name is obvious.
+    let orgName;
+    try {
+        orgName = (await hq.getOrg(config.api_key, orgId))?.name;
+    }
+    catch {
+        error(`Could not read org ${orgId}. Check the id with: myapi org list`);
+    }
+    // Reuse a key already locked to this org rather than minting another. Keys
+    // are a revocation surface; one per project per org is enough, and silently
+    // accumulating them makes the list unreadable exactly when someone is trying
+    // to revoke the right one in a hurry.
+    const already = accountLockedTo(orgId);
+    if (already) {
+        const file = writeProjectOrg(process.cwd(), orgId);
+        success(`Bound this directory to ${orgName ?? orgId}`);
+        info(`  ${file}`);
+        info(`  using the key already locked to this org (${already.email ?? already.account_id})`);
+        if (flags.json)
+            printJson({ org_id: orgId, org_name: orgName, project_file: file, minted: false });
+        return;
+    }
+    const label = typeof flags.name === 'string' && flags.name
+        ? flags.name
+        : (process.cwd().split('/').filter(Boolean).pop() ?? 'project');
+    // Same type and same parser as `keys create --spend-cap`. When one command
+    // declares a flag a string and another a number, the merged schema silently
+    // picks one and the loser is parsed wrong — that is how `--ttl` broke.
+    const capUsd = typeof flags['spend-cap'] === 'string' && flags['spend-cap']
+        ? centsOrDie(flags['spend-cap'])
+        : undefined;
+    const grant = typeof flags.grant === 'string' ? flags.grant : undefined;
+    const minted = await hq.createApiKey(config.api_key, label, {
+        orgId,
+        ...(capUsd !== undefined ? { spendCapCents: capUsd } : {}),
+        ...(grant ? { grants: grantsOrDie(grant) } : {}),
+    });
+    const value = minted.api_key
+        ?? minted.key;
+    if (!value) {
+        error('The API was asked for a key and returned none. Nothing was written; no project file was created.');
+    }
+    // Stored as its own account entry — saveConfig upserts by api_key, and
+    // deliberately does NOT make it active. A project credential must not become
+    // the identity every other terminal on this machine signs in as.
+    saveConfig({
+        ...(loadConfig() ?? { api_key: value, account_id: config.account_id }),
+        api_key: value,
+        account_id: config.account_id,
+        email: config.email,
+        key_org_id: orgId,
+        default_org: orgId,
+        org_names: { ...(config.org_names ?? {}), ...(orgName ? { [orgId]: orgName } : {}) },
+    });
+    const file = writeProjectOrg(process.cwd(), orgId);
+    if (flags.json) {
+        printJson({ org_id: orgId, org_name: orgName, project_file: file, key_id: minted.id, minted: true });
+        return;
+    }
+    success(`Bound this directory to ${orgName ?? orgId}`);
+    info(`  ${file}          names the org (no key in it — safe to commit)`);
+    info(`  key "${label}"   locked to this org${capUsd !== undefined ? `, capped at $${(capUsd / 100).toFixed(2)}` : ''}`);
+    info('');
+    info('Commands run here now target this org without --org, and a command that');
+    info('names a different one is refused before it is sent.');
+}

package/dist/commands/org-delete-confirm.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/org-delete-confirm.test.js

@@ -0,0 +1,121 @@
+// `myapi org delete --yes` could not delete any org that owned anything.
+//
+// The API hard-deletes an org across 36 tables with no undo, so it refuses one
+// that still owns resources unless the caller names it back: `?confirm=<id>`.
+// That design is right. The SDK never sent the parameter, and the CLI's `--yes`
+// only skipped its own local prompt — so the call came back 409 CONFIRM_REQUIRED
+// with a message telling the user to "repeat the call with ?confirm=", which is
+// HTTP-shaped advice a CLI user cannot act on.
+//
+// Creating an org provisions a funnel, so an org is non-empty from birth. This
+// was not an edge case: the verb could not delete anything, while its own help
+// said `--yes` was all a non-interactive run needed.
+//
+// Found by the probe, on its own cleanup step, on its first run — which is the
+// argument for having a probe. It is invisible to the reverse request-field
+// linter because `confirm` is a query parameter, and that linter reads request
+// BODIES only; it says so in its own limits.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const ORG = '11111111-1111-4111-8111-111111111111';
+const sdk = vi.hoisted(() => ({
+    hq: { getOrg: vi.fn(), deleteOrg: vi.fn() },
+    MyApiError: class MyApiError extends Error {
+        code = '';
+        status = 0;
+    },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+// Non-interactive, so `--yes` is the only way through and no prompt can hang.
+vi.mock('../prompt.js', () => ({
+    confirm: vi.fn(async () => false),
+    isNonInteractive: () => true,
+}));
+function confirmRequired(owns) {
+    const e = new Error('CONFIRM_REQUIRED');
+    e.code = 'CONFIRM_REQUIRED';
+    e.status = 409;
+    e.body = { code: 'CONFIRM_REQUIRED', owns };
+    return e;
+}
+let printed;
+let exitError;
+beforeEach(async () => {
+    printed = [];
+    exitError = null;
+    // resetAllMocks, not clearAllMocks: `clear` resets call counts but leaves
+    // queued mockRejectedValueOnce values in place. The "refuses without --yes"
+    // case never consumes its queued rejection — it stops at the local guard —
+    // so with `clear` that rejection leaked into the next test and made it see a
+    // retry that its own setup never asked for.
+    vi.resetAllMocks();
+    sdk.hq.getOrg.mockResolvedValue({ id: ORG, name: 'Probe' });
+    const output = await import('../output.js');
+    vi.spyOn(output, 'info').mockImplementation(((m) => { printed.push(String(m)); }));
+    vi.spyOn(output, 'success').mockImplementation(((m) => { printed.push(String(m)); }));
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        exitError = String(m);
+        throw new Error('__EXIT__');
+    }));
+});
+afterEach(() => vi.restoreAllMocks());
+async function run(fn) {
+    try {
+        await fn();
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('org delete — the confirm gate', () => {
+    it('retries with confirm when the API asks, so --yes can actually delete', async () => {
+        sdk.hq.deleteOrg
+            .mockRejectedValueOnce(confirmRequired(['1 funnel', '1 CRM contact']))
+            .mockResolvedValueOnce(undefined);
+        const { del } = await import('./org.js');
+        await run(() => del(ORG, { yes: true }));
+        expect(sdk.hq.deleteOrg).toHaveBeenCalledTimes(2);
+        expect(sdk.hq.deleteOrg).toHaveBeenNthCalledWith(1, 'hq_live_test', ORG);
+        expect(sdk.hq.deleteOrg).toHaveBeenNthCalledWith(2, 'hq_live_test', ORG, { confirm: true });
+        expect(printed.join('\n')).toMatch(/Org .*deleted/);
+    });
+    it('shows what would be destroyed before destroying it', async () => {
+        // The refusal carries the inventory, and it is the ONLY place it can be
+        // seen — after the delete there is nothing left to look at.
+        sdk.hq.deleteOrg
+            .mockRejectedValueOnce(confirmRequired(['3 containers', '1 domain']))
+            .mockResolvedValueOnce(undefined);
+        const { del } = await import('./org.js');
+        await run(() => del(ORG, { yes: true }));
+        expect(printed.join('\n')).toContain('3 containers, 1 domain');
+    });
+    it('does not send confirm on the first attempt', async () => {
+        // An empty org deletes without ceremony; sending confirm unconditionally
+        // would turn the gate into decoration for every org.
+        sdk.hq.deleteOrg.mockResolvedValueOnce(undefined);
+        const { del } = await import('./org.js');
+        await run(() => del(ORG, { yes: true }));
+        expect(sdk.hq.deleteOrg).toHaveBeenCalledTimes(1);
+        expect(sdk.hq.deleteOrg).toHaveBeenCalledWith('hq_live_test', ORG);
+    });
+    it('refuses without --yes rather than confirming on the user behalf', async () => {
+        sdk.hq.deleteOrg.mockRejectedValueOnce(confirmRequired(['1 funnel']));
+        const { del } = await import('./org.js');
+        await run(() => del(ORG, {}));
+        // Non-interactive without --yes stops at the local guard, before any call.
+        expect(exitError).toMatch(/--yes/);
+    });
+    it('passes other errors through instead of retrying blind', async () => {
+        const boom = new Error('NOT_FOUND');
+        boom.code = 'NOT_FOUND';
+        sdk.hq.deleteOrg.mockRejectedValueOnce(boom);
+        const { del } = await import('./org.js');
+        await expect(del(ORG, { yes: true })).rejects.toThrow('NOT_FOUND');
+        expect(sdk.hq.deleteOrg).toHaveBeenCalledTimes(1);
+    });
+});

package/dist/commands/org.js

@@ -135,7 +135,35 @@ export async function del(id, flags) {
         if (!ok)
             error('Aborted.');
     }
-    await hq.deleteOrg(config.api_key, id);
+    // First without confirm. The API refuses a non-empty org with an inventory of
+    // what would be destroyed, and that inventory is the only place it can be
+    // seen — after the delete there is nothing left to look at. So the refusal is
+    // not an error to route around; it is the thing worth showing.
+    try {
+        await hq.deleteOrg(config.api_key, id);
+    }
+    catch (e) {
+        const err = e;
+        if (err?.code !== 'CONFIRM_REQUIRED')
+            throw e;
+        // `body` is the backend's error object verbatim; CONFIRM_REQUIRED carries
+        // the inventory in `owns`.
+        const owns = Array.isArray(err.body?.owns) ? err.body.owns : undefined;
+        info(owns?.length
+            ? `This org still owns ${owns.join(', ')}. Deleting it destroys all of that permanently.`
+            : 'This org still owns resources. Deleting it destroys all of them permanently.');
+        if (!flags.yes) {
+            const ok = await confirm(`› Delete ${label} and everything it owns? (y/N) `, false);
+            if (!ok)
+                error('Aborted. Nothing was deleted.');
+        }
+        // --yes already means "I am not being asked again", and the inventory has
+        // been printed either way. Previously this path did not exist at all: the
+        // API told the caller to "repeat the call with ?confirm=", advice a CLI
+        // user could not act on, so `org delete --yes` could not delete any org
+        // that owned anything — which is every org, since create provisions a funnel.
+        await hq.deleteOrg(config.api_key, id, { confirm: true });
+    }
     success(`Org ${label} deleted`);
 }
 // Update one or more fields of an org. At least one --flag must be supplied;

package/dist/completion.js

@@ -27,7 +27,7 @@ const BLOCK_END = `# end ${PROGRAM} completion`;
 // is missing here.
 export const COMMANDS = [
     'account', 'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
-    'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image',
+    'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image', 'init',
     'doctor', 'install-skills', 'keys', 'llm', 'login', 'org', 'payments', 'people', 'pixel',
     'feedback', 'queue', 'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
     'workflow',

package/dist/config.d.ts

@@ -9,6 +9,7 @@ export interface AccountEntry {
     registrant?: sdkDomain.Registrant;
     is_anonymous?: boolean;
     skills_installed?: boolean;
+    key_org_id?: string;
     last_org_used?: string;
     org_names?: Record<string, string>;
 }
@@ -24,6 +25,16 @@ export declare const CONFIG_DIR: string;
 export declare const CONFIG_FILE: string;
 export declare function loadFullConfig(): FullConfig | null;
 export declare function loadConfig(): Config | null;
+/**
+ * The stored account whose key is locked to `orgId`, if there is one.
+ *
+ * This is what lets a project directory name an org and get the right
+ * credential without keeping a secret in the repo: the project file says which
+ * org, the config says which key belongs to it.
+ */
+export declare function accountLockedTo(orgId: string): AccountEntry | undefined;
+/** Every distinct org this machine holds an org-locked key for. */
+export declare function lockedOrgs(): string[];
 export declare function saveConfig(config: Config): void;
 export declare function addAccount(account: AccountEntry): number;
 export declare function switchAccount(index: number): boolean;

package/dist/config.js

@@ -1,6 +1,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { findProjectOrg } from './project.js';
 // MYAPI_CONFIG_DIR redirects the whole config surface — key, accounts,
 // defaults — somewhere other than ~/.myapi.
 //
@@ -79,11 +80,44 @@ export function loadConfig() {
     }
     if (!active)
         return null;
+    // The directory picks the CREDENTIAL, not just the org.
+    //
+    // Resolving the org from .myapi.json while still authenticating with the
+    // account-wide key gets the right answer by client-side convention only —
+    // the server has nothing to enforce, because an account-wide key may touch
+    // every org. Selecting the key that is LOCKED to this project's org is what
+    // turns the whole thing from a default into a boundary: from here on a
+    // mistake is a 403, not a write into the wrong tenant.
+    //
+    // Falls through to the active account when the directory names no org, or
+    // names one this machine holds no locked key for.
+    const dirOrg = process.env.MYAPI_ORG || findProjectOrg()?.org;
+    if (dirOrg) {
+        const locked = full.accounts.find(a => a.key_org_id === dirOrg);
+        if (locked)
+            return { ...locked, autocomplete_setup: full.autocomplete_setup };
+    }
     return {
         ...active,
         autocomplete_setup: full.autocomplete_setup,
     };
 }
+/**
+ * The stored account whose key is locked to `orgId`, if there is one.
+ *
+ * This is what lets a project directory name an org and get the right
+ * credential without keeping a secret in the repo: the project file says which
+ * org, the config says which key belongs to it.
+ */
+export function accountLockedTo(orgId) {
+    const full = loadFullConfig();
+    return full?.accounts.find(a => a.key_org_id === orgId);
+}
+/** Every distinct org this machine holds an org-locked key for. */
+export function lockedOrgs() {
+    const full = loadFullConfig();
+    return [...new Set((full?.accounts ?? []).map(a => a.key_org_id).filter(Boolean))];
+}
 // Single point of truth for writes. Ensures CONFIG_DIR exists and that the
 // file is created with mode 0o600 (owner read/write only) — no caller has
 // to remember either.

package/dist/exposes.test.js

@@ -15,6 +15,7 @@ const COMMAND_MODULES = [
     './commands/crm/companies.js',
     './commands/crm/pagination.js',
     './commands/database.js',
+    './commands/init.js',
     './commands/domain.js',
     './commands/email/index.js',
     './commands/email/mailbox.js',

package/dist/helpers.d.ts

@@ -1,5 +1,21 @@
 import { type Config } from './config.js';
 export type Flags = Record<string, string | boolean | number>;
+export type OrgSource = 'flag' | 'env' | 'project' | 'key' | 'default';
+export interface ResolvedOrg {
+    org: string;
+    source: OrgSource;
+    /** For 'project', the file it came from, so output can name it. */
+    from?: string;
+}
+/**
+ * Resolves the org without side effects, so it can be tested and reported on
+ * (`myapi status`) rather than only observed by running a real command.
+ *
+ * Precedence: --org > MYAPI_ORG > nearest .myapi.json > the key's own lock >
+ * default_org. The first four are per-invocation or per-directory. The last is
+ * the machine-global one that two projects fight over.
+ */
+export declare function resolveOrg(flags: Flags, config: Config): ResolvedOrg | undefined;
 export declare function requireOrg(flags: Flags, config: Config, usage: string): string;
 export declare function orgLine(orgId: string, name: string | undefined, changedFrom?: string): string;
 /** The org this invocation resolved to, for `--json` consumers. */

package/dist/helpers.js

@@ -1,8 +1,33 @@
 import { error, banner } from './output.js';
+import { findProjectOrg } from './project.js';
 import { loadConfig, saveConfig } from './config.js';
 import { confirm, isNonInteractive } from './prompt.js';
-// error() returns `never`, so after `if (!x) error(...)` TS narrows x to a
-// non-falsy value and the casts disappear.
+/**
+ * Resolves the org without side effects, so it can be tested and reported on
+ * (`myapi status`) rather than only observed by running a real command.
+ *
+ * Precedence: --org > MYAPI_ORG > nearest .myapi.json > the key's own lock >
+ * default_org. The first four are per-invocation or per-directory. The last is
+ * the machine-global one that two projects fight over.
+ */
+export function resolveOrg(flags, config) {
+    if (typeof flags.org === 'string' && flags.org)
+        return { org: flags.org, source: 'flag' };
+    const env = process.env.MYAPI_ORG;
+    if (env)
+        return { org: env, source: 'env' };
+    const project = findProjectOrg();
+    if (project)
+        return { org: project.org, source: 'project', from: project.file };
+    // A locked key does not need to be told which org it is for — the server will
+    // only accept one. Ranking it above default_org means an org-locked key makes
+    // the machine-global default irrelevant, which is the whole point.
+    if (config.key_org_id)
+        return { org: config.key_org_id, source: 'key' };
+    if (config.default_org)
+        return { org: config.default_org, source: 'default' };
+    return undefined;
+}
 export function requireOrg(flags, config, usage) {
     // A present-but-empty --org (e.g. --org "$ORG" with $ORG unset, or a bare
     // --org that swallowed no value) must never degrade to the default org —
@@ -10,14 +35,34 @@ export function requireOrg(flags, config, usage) {
     if ('org' in flags && (flags.org === '' || flags.org === true)) {
         error(`--org was passed without a value. Refusing to fall back to the default org.\nUsage: ${usage}`);
     }
-    const orgId = (typeof flags.org === 'string' ? flags.org : '') || config.default_org;
-    if (!orgId) {
-        error(`Missing required arguments.\nUsage: ${usage}\n(Or set default: myapi config set-org <id>)`);
+    const resolved = resolveOrg(flags, config);
+    if (!resolved) {
+        error(`Missing required arguments.\nUsage: ${usage}\n` +
+            `(This directory has no org. Set one up with: myapi init --org <id>)`);
+    }
+    const orgId = resolved.org;
+    // The key is locked server-side; a mismatch is a guaranteed 403. Saying so
+    // here costs nothing and can explain WHICH org the key belongs to, which the
+    // server's refusal cannot: it will not name another tenant's id back to a
+    // caller that has no authority over it.
+    if (config.key_org_id && orgId !== config.key_org_id) {
+        error(`This API key is locked to org ${config.key_org_id}, but ${describeSource(resolved)} says ${orgId}.\n` +
+            `The server would refuse this (403 SCOPE_FORBIDDEN), so nothing was sent.\n` +
+            `Use a key for ${orgId}, or drop the override to work in ${config.key_org_id}.`);
     }
     announceOrg(orgId, config);
     recordResolvedOrg(orgId, config);
     return orgId;
 }
+function describeSource(r) {
+    switch (r.source) {
+        case 'flag': return '--org';
+        case 'env': return 'MYAPI_ORG';
+        case 'project': return r.from ?? '.myapi.json';
+        case 'key': return 'the key';
+        case 'default': return 'your machine-wide default org';
+    }
+}
 // ── Which org am I in? ───────────────────────────────────────────────────────
 //
 // The org is ambient, sticky and invisible: it comes from a saved default that

package/dist/index.js

@@ -35,6 +35,7 @@ import * as urlCmd from './commands/url.js';
 import * as authProductCmd from './commands/authproduct.js';
 import * as configCmd from './commands/config.js';
 import * as statusCmd from './commands/status.js';
+import * as initCmd from './commands/init.js';
 import * as peopleCmd from './commands/people.js';
 import * as companyCmd from './commands/company.js';
 import * as audienceCmd from './commands/audience.js';
@@ -317,6 +318,9 @@ async function main() {
             case 'status':
                 await statusCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'init':
+                await initCmd.run(subcommand, restArgs, flags);
+                break;
             case 'keys':
                 await keysCmd.run(subcommand, restArgs, flags);
                 break;
@@ -510,6 +514,7 @@ Commands:
   funnel          Manage websites (publish pages, custom domains, funnels)
   git             Hosted git repositories — repos, commits, branches, history
   image           Generate AI images and manage them in storage
+  init            Bind this directory to one org (locked key + .myapi.json)
   install-skills  Install or update the MyAPI skills pack for AI agents
   llm             Run LLM completions and embeddings (chat + embed, with usage/cost)
   login           Sign in via your browser — Google or email code (preview: --mock)

package/dist/org-resolution.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/org-resolution.test.js

@@ -0,0 +1,157 @@
+// Which org does a command target, and can a second project on the same
+// machine change the answer?
+//
+// `myapi config set-org` writes `default_org` into ~/.myapi/config.json — one
+// file per MACHINE. Two checkouts share it: project A sets A, project B sets B,
+// and every later bare command in A targets B. It succeeds, against the wrong
+// tenant. That is the most-reported problem with the CLI and it is a scope
+// mismatch, not a bug: the org is a property of the work, stored per machine.
+//
+// The chain here fixes it by putting four per-invocation or per-directory
+// sources ahead of the machine-global one, and by refusing outright when the
+// key's server-side lock disagrees with any of them.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { resolveOrg } from './helpers.js';
+import { findProjectOrg, writeProjectOrg } from './project.js';
+const A = 'aaaaaaaa-1111-4111-8111-aaaaaaaaaaaa';
+const B = 'bbbbbbbb-2222-4222-8222-bbbbbbbbbbbb';
+const base = { api_key: 'hq_live_test', account_id: 'acct' };
+let tmp;
+let cwdSpy;
+function chdirTo(dir) {
+    cwdSpy?.mockRestore();
+    cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(dir);
+}
+beforeEach(() => {
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'myapi-org-'));
+    delete process.env.MYAPI_ORG;
+    chdirTo(tmp);
+});
+afterEach(() => {
+    cwdSpy?.mockRestore();
+    delete process.env.MYAPI_ORG;
+    fs.rmSync(tmp, { recursive: true, force: true });
+});
+describe('org resolution order', () => {
+    it('--org beats everything', () => {
+        process.env.MYAPI_ORG = B;
+        writeProjectOrg(tmp, B);
+        const r = resolveOrg({ org: A }, { ...base, key_org_id: B, default_org: B });
+        expect(r).toMatchObject({ org: A, source: 'flag' });
+    });
+    it('MYAPI_ORG beats the project file and the default', () => {
+        process.env.MYAPI_ORG = A;
+        writeProjectOrg(tmp, B);
+        expect(resolveOrg({}, { ...base, default_org: B })).toMatchObject({ org: A, source: 'env' });
+    });
+    it('the project file beats the machine-wide default — the whole point', () => {
+        // Project B set the global default to B. This directory is project A.
+        writeProjectOrg(tmp, A);
+        expect(resolveOrg({}, { ...base, default_org: B })).toMatchObject({ org: A, source: 'project' });
+    });
+    it("a locked key beats the machine-wide default, so the default stops mattering", () => {
+        expect(resolveOrg({}, { ...base, key_org_id: A, default_org: B }))
+            .toMatchObject({ org: A, source: 'key' });
+    });
+    it('falls back to the default when nothing else says', () => {
+        expect(resolveOrg({}, { ...base, default_org: B })).toMatchObject({ org: B, source: 'default' });
+    });
+    it('resolves to nothing when there is nothing to resolve', () => {
+        expect(resolveOrg({}, base)).toBeUndefined();
+    });
+});
+describe('the project file', () => {
+    it('is found by walking up, like .git', () => {
+        const nested = path.join(tmp, 'src', 'deep', 'nested');
+        fs.mkdirSync(nested, { recursive: true });
+        writeProjectOrg(tmp, A);
+        chdirTo(nested);
+        expect(findProjectOrg()).toMatchObject({ org: A });
+    });
+    it('takes the NEAREST one, so a nested project wins over its parent', () => {
+        const inner = path.join(tmp, 'inner');
+        fs.mkdirSync(inner);
+        writeProjectOrg(tmp, A);
+        writeProjectOrg(inner, B);
+        chdirTo(inner);
+        expect(findProjectOrg()).toMatchObject({ org: B });
+    });
+    it('never carries a key', () => {
+        // A file named in a repo gets committed eventually. Trading a wrong-org
+        // write for a leaked credential would be a worse deal than the bug.
+        const file = writeProjectOrg(tmp, A);
+        const raw = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        expect(Object.keys(raw)).toEqual(['org']);
+        expect(JSON.stringify(raw)).not.toMatch(/hq_live|api_key|key/i);
+    });
+    it('preserves keys it does not own', () => {
+        const file = path.join(tmp, '.myapi.json');
+        fs.writeFileSync(file, JSON.stringify({ note: 'mine', org: B }));
+        writeProjectOrg(tmp, A);
+        expect(JSON.parse(fs.readFileSync(file, 'utf-8'))).toEqual({ note: 'mine', org: A });
+    });
+    it('ignores a malformed file rather than bricking every command below it', () => {
+        fs.writeFileSync(path.join(tmp, '.myapi.json'), '{ not json');
+        expect(findProjectOrg()).toBeUndefined();
+        expect(resolveOrg({}, { ...base, default_org: B })).toMatchObject({ org: B, source: 'default' });
+    });
+    it('ignores a file that names no org', () => {
+        fs.writeFileSync(path.join(tmp, '.myapi.json'), JSON.stringify({ note: 'hi' }));
+        expect(findProjectOrg()).toBeUndefined();
+    });
+});
+describe('a locked key refuses a mismatched target', () => {
+    // The server enforces this (403 SCOPE_FORBIDDEN, verified against production
+    // 2026-08-23). Refusing locally costs nothing and can say WHICH org the key
+    // belongs to — which the server's refusal deliberately will not, since it
+    // must not name one tenant's id to a caller with no authority over it.
+    let exitError;
+    beforeEach(async () => {
+        exitError = null;
+        const output = await import('./output.js');
+        vi.spyOn(output, 'error').mockImplementation(((m) => {
+            exitError = String(m);
+            throw new Error('__EXIT__');
+        }));
+        vi.spyOn(output, 'banner').mockImplementation(() => { });
+    });
+    afterEach(() => vi.restoreAllMocks());
+    async function requireOrgSafely(flags, config) {
+        const { requireOrg } = await import('./helpers.js');
+        try {
+            return requireOrg(flags, config, 'usage');
+        }
+        catch (e) {
+            if (e?.message !== '__EXIT__')
+                throw e;
+            return undefined;
+        }
+    }
+    it('refuses --org pointing somewhere the key cannot go, before sending', async () => {
+        await requireOrgSafely({ org: B }, { ...base, key_org_id: A });
+        expect(exitError).toContain(A);
+        expect(exitError).toContain(B);
+        expect(exitError).toMatch(/nothing was sent/i);
+    });
+    it('names the source of the conflicting org, not just the conflict', async () => {
+        writeProjectOrg(tmp, B);
+        await requireOrgSafely({}, { ...base, key_org_id: A });
+        expect(exitError).toContain('.myapi.json');
+    });
+    it('allows an --org that agrees with the lock', async () => {
+        const got = await requireOrgSafely({ org: A }, { ...base, key_org_id: A });
+        expect(got).toBe(A);
+        expect(exitError).toBeNull();
+    });
+    it('needs no --org at all when the key is locked', async () => {
+        const got = await requireOrgSafely({}, { ...base, key_org_id: A });
+        expect(got).toBe(A);
+    });
+    it('still refuses a --org that arrived empty', async () => {
+        await requireOrgSafely({ org: '' }, { ...base, key_org_id: A, default_org: A });
+        expect(exitError).toMatch(/without a value/);
+    });
+});

package/dist/project.d.ts

@@ -0,0 +1,20 @@
+export declare const PROJECT_FILE = ".myapi.json";
+export interface ProjectConfig {
+    org?: string;
+}
+export interface FoundProject {
+    org: string;
+    /** Absolute path of the file it came from, so output can name it. */
+    file: string;
+}
+/**
+ * Walks up from `startDir` looking for the nearest `.myapi.json` that names an
+ * org. Stops at the filesystem root.
+ *
+ * A malformed file is ignored rather than fatal: it must not be able to brick
+ * every command in a directory tree, and the resolution chain has other rungs.
+ * It is reported by `myapi status` instead.
+ */
+export declare function findProjectOrg(startDir?: string): FoundProject | undefined;
+/** Writes `.myapi.json` in `dir`, preserving any keys we do not own. */
+export declare function writeProjectOrg(dir: string, orgId: string): string;

package/dist/project.js

@@ -0,0 +1,59 @@
+import * as fs from 'fs';
+import * as path from 'path';
+// Which org does this directory belong to?
+//
+// `myapi config set-org` writes `default_org` into ~/.myapi/config.json — one
+// file per MACHINE. Two checkouts on one laptop share it, so project A sets it
+// to A, project B sets it to B, and every later bare command in A quietly
+// targets B. The command succeeds; it just lands in the wrong tenant. That is
+// the single most-reported problem with the CLI, and it is a scope mismatch:
+// the org is a property of the work, stored per machine.
+//
+// So: the nearest `.myapi.json` walking up from cwd, the way git finds .git and
+// npm finds package.json. Two projects get two files and stop fighting.
+//
+// It holds the ORG ID AND NEVER A KEY. A file named in a repo gets committed
+// eventually — that is not a prediction, it is what happens — and trading a
+// wrong-org write for a leaked credential would be a worse deal than the bug it
+// fixes. The org id is not a secret: it is useless without a key that the
+// server has already locked to it.
+export const PROJECT_FILE = '.myapi.json';
+/**
+ * Walks up from `startDir` looking for the nearest `.myapi.json` that names an
+ * org. Stops at the filesystem root.
+ *
+ * A malformed file is ignored rather than fatal: it must not be able to brick
+ * every command in a directory tree, and the resolution chain has other rungs.
+ * It is reported by `myapi status` instead.
+ */
+export function findProjectOrg(startDir = process.cwd()) {
+    let dir = path.resolve(startDir);
+    for (;;) {
+        const candidate = path.join(dir, PROJECT_FILE);
+        try {
+            if (fs.existsSync(candidate)) {
+                const parsed = JSON.parse(fs.readFileSync(candidate, 'utf-8'));
+                if (typeof parsed?.org === 'string' && parsed.org) {
+                    return { org: parsed.org, file: candidate };
+                }
+            }
+        }
+        catch { /* unreadable or malformed — keep walking */ }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+/** Writes `.myapi.json` in `dir`, preserving any keys we do not own. */
+export function writeProjectOrg(dir, orgId) {
+    const file = path.join(path.resolve(dir), PROJECT_FILE);
+    let existing = {};
+    try {
+        if (fs.existsSync(file))
+            existing = JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch { /* replace an unreadable file rather than fail the command */ }
+    fs.writeFileSync(file, `${JSON.stringify({ ...existing, org: orgId }, null, 2)}\n`);
+    return file;
+}

package/dist/skills/my-api-hq/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-api-hq
-version: 1.3.0
+version: 1.3.1
 description: >
   Auth, organizations, and billing hub. Start here to get an api_key and org_id — every other service depends on both.
 triggers: [api key, account, organization, org, billing, balance, topup, credits, setup, defaults, brand, sync brand, doctor, health check, is my org healthy]
-checksum: sha256-fd266da15b05dee12ce1e683612b76e0f5554247f255a9c8db9be006a403a8ff
+checksum: sha256-f8e308fd3cd4b0ed4097e6f54c620e49cfe59c5b4275cfea4c1a0e18dd78f5e4
 ---
 
 # MyApiHQ
@@ -13,20 +13,20 @@ The root service. It manages accounts, API keys, organizations, and billing. No
 
 ## Capabilities
 <!-- llm:start -->
-MyApiHQ is the platform's foundation. Every other service requires both an `api_key` and (for org-scoped resources) an `org_id` minted here. Setup is one command — `myapi account setup` — which provisions an account, generates an api_key, creates a default org, and stores everything in `~/.myapi/config.json`. Subsequent commands pick up those defaults automatically.
+MyApiHQ is the platform's foundation: every other service needs an `api_key` and (for org-scoped resources) an `org_id` minted here. `myapi account setup` provisions an account, key and first org into `~/.myapi/config.json`, and later commands pick those up.
 
 ### Anonymous vs registered accounts
 
 Two tiers, chosen at setup time:
 
-- **Anonymous** (`myapi account setup --anonymous`): zero-friction account creation. **Starts with $0 credit.** Good for catalog browsing, reading help, inspecting schemas — nothing that costs upstream money. The agent-onboarding path: provisions an account in one call, no email needed.
-- **Registered** (verified email via `myapi account link <email>`): unlocks $5 free credit and the paid surface (LLM, image, email, domain register, etc.). Required for `myapi billing setup` and anything that hits Stripe.
+- **Anonymous** (`myapi account setup --anonymous`): zero friction, **$0 credit.** Fine for browsing the catalog and reading help.
+- **Registered** (verify email via `myapi account link <email>`): unlocks $5 free credit and the paid surface (LLM, image, email, domain register).
 
-An anonymous account can upgrade at any time via `myapi account link <email>` — the credit grants on successful verification. Anonymous accounts that need paid actions hit a friendly `REGISTRATION_REQUIRED` error pointing at `myapi account link`; a registered account with an empty wallet hits `402 INSUFFICIENT_FUNDS` (top up, or enable auto-recharge — below).
+An anonymous account upgrades any time with `myapi account link <email>`; the credit grants on verification.
 
 ### Health check
 
-`myapi doctor` runs an org-wide consistency check across every slot and layers on customer-perspective DNS/HTTP probes from your machine. It returns per-section findings (`✓` pass / `⚠` warning / `✗` critical) with remediation hints; add `--json` for machine output. The exit code is non-zero **only** on customer-actionable criticals — platform-side issues the MyAPI team is already handling are surfaced with an `ℹ` marker but don't fail the run. Run it to self-check before building (is the org set up?) and after (did everything wire up?).
+`myapi doctor` runs an org-wide consistency check across every slot, plus customer-perspective DNS/HTTP probes from your machine. It returns per-section findings (`✓` pass / `⚠` warning / `✗` critical) with remediation hints; add `--json` for machine output. The exit code is non-zero **only** on customer-actionable criticals — platform-side issues the MyAPI team is already handling are surfaced with an `ℹ` marker but don't fail the run. Run it to self-check before building (is the org set up?) and after (did everything wire up?).
 <!-- llm:end -->
 
 ## Commands
@@ -55,7 +55,8 @@ An anonymous account can upgrade at any time via `myapi account link <email>`
 | `myapi billing auto-recharge [show \| set \| disable]` | Keep the wallet funded — off-session refill when balance drops below a threshold, capped monthly |
 | `myapi account sending` / `myapi account resume-sending` | Is sending paused (bounces), and turn it on |
 | `myapi account mailing-address ["<address>"]` | Get or set the account's CAN-SPAM mailing address (required for email send) |
-| `myapi config set-org <id>` / `set-funnel <id>` / `set-domain <name>` | Set CLI defaults |
+| `myapi init --org <id>` | Bind this directory to one org: locked key + `.myapi.json` (`--force` re-binds). Use instead of `config set-org` when a machine has more than one project |
+| `myapi config set-org <id>` / `set-funnel <id>` / `set-domain <name>` | Set machine-wide CLI defaults (single-project machines only) |
 | `myapi install-skills` | Install agent skills into ~/.claude/, ~/.gemini/, ~/.cursor/ |
 | `myapi doctor [--verbose] [--json]` | Org-wide health check: config/integrity findings + DNS/HTTP probes |
 <!-- generated:end -->
@@ -94,7 +95,7 @@ Each org gets a free preview subdomain (`*.makeautonomous.com`) usable before re
 
 ## Notes
 
-- Set `--org` defaults once with `myapi config set-org <id>` to skip the flag on every command.
+- **Bind a directory to an org with `myapi init --org <id>`**, not `config set-org` — `set-org` writes ONE default for the whole machine, so two projects overwrite each other's and commands land in the wrong org while still succeeding. `init` writes `.myapi.json` (org id, never a key) plus a key the server locks to that org.
 - API keys have format `hq_live_...` and are sent as `Authorization: Bearer <key>`.
 - `org sync-brand` is async (scrapes the site, polls the job).
 
@@ -108,7 +109,9 @@ myapi keys create --name agent --org <id> --grant '*'       # locked to ONE org
 myapi keys create --name ci --grant funnel:write,storage:read --spend-cap 25
 ```
 
-- `--org <id>` — **lock it to one org.** Omit for account-wide.
+- `--org <id>` — **lock it to one org.** Omit for account-wide. A locked key is
+  refused (403) on every other org — the only scoping a stale default cannot
+  talk past. `myapi init` sets it up per directory.
 - `--grant <list>` — `slot:read` / `slot:write`; a bare slot means write, `*`
   means all. **Omitting `--grant` mints an unrestricted key.**
 - `--spend-cap <usd>` — hard ceiling; `0` means the key cannot spend at all.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.25.1",
+  "version": "2.26.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.25.1"
+    "@myapihq/sdk": "^2.26.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",