@myapihq/cli 2.27.0 → 2.27.1

package/dist/commands/authproduct.js

@@ -9,6 +9,10 @@ import { requireOrg } from '../helpers.js';
 // OIDC endpoints (discovery/jwks/authorize/token/userinfo) are consumed by
 // apps + the JS SDK, not the CLI, so only the management surface is here.
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     name: 'string',
     type: 'string', // spa | web
     redirect: 'list', // comma-separated OR repeated; occurrences accumulate

package/dist/commands/container.js

@@ -20,6 +20,10 @@ export const EXPOSES = [
     'DELETE /container/orgs/{org_id}/containers/{id}/domain',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     name: 'string',
     type: 'string',
     cron: 'string',

package/dist/commands/doctor.js

@@ -32,7 +32,11 @@ export const EXPOSES = [
     // Lifetime delivery counts, to replace the 30-day 'quiet webhook' advice.
     'GET /webhook/orgs/{org_id}/deliveries',
 ];
-export const SCHEMA = {};
+export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it.
+    org: 'string',
+};
 const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
 const C = useColor ? {
     ok: '\x1b[32m', warn: '\x1b[33m', err: '\x1b[31m',

package/dist/commands/feedback.js

@@ -22,6 +22,10 @@ export const EXPOSES = [
     'DELETE /feedback/orgs/{org_id}/widgets/{id}',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     // Declared because `list` reads flags.limit/offset, --help documents both,
     // and a truncated page prints "raise --limit" — while the parser refused
     // them as unknown. Reported by ImmoPilot on 2026-08-19.

package/dist/commands/fn.js

@@ -15,6 +15,10 @@ export const EXPOSES = [
     'PATCH /function/orgs/{org_id}/functions/{id}/scopes',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     // `create` takes a positional name; --name stays accepted for
     // back-compat (RELEASING.md's stated convention) and must be declared
     // here so the command-aware flag check in index.ts doesn't flag it.

package/dist/commands/funnel.js

@@ -24,6 +24,10 @@ export const EXPOSES = [
     'GET /hq/orgs/{org_id}',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     funnel: 'string',
     slug: 'string',
     env: 'string',

package/dist/commands/git.js

@@ -24,6 +24,10 @@ export const EXPOSES = [
     'POST /git/orgs/{org_id}/repos/{repo}/repack',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     name: 'string',
     'default-branch': 'string',
     ref: 'string',

package/dist/commands/payments.js

@@ -13,6 +13,10 @@ export const EXPOSES = [
     'POST /payments/webhook/{org_id}',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     'stripe-key': 'string',
     amount: 'string',
     description: 'string',

package/dist/commands/queue.js

@@ -13,6 +13,10 @@ export const EXPOSES = [
     'GET /queue/orgs/{org_id}/jobs/{id}',
 ];
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     name: 'string',
     'consumer-url': 'string',
     'max-attempts': 'number',

package/dist/commands/task.js

@@ -22,6 +22,10 @@ function taskOrigin(flags) {
     return typeof v === 'string' ? v : undefined;
 }
 export const SCHEMA = {
+    // Declared because requireOrg reads it. Undeclared, the foreign-flag check
+    // called `--org` a typo on a command that had just honoured it — telling
+    // people the one flag that keeps writes in the right tenant is unrecognized.
+    org: 'string',
     body: 'string',
     importance: 'string',
     due: 'string',

package/dist/org-flag-declared.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/org-flag-declared.test.js

@@ -0,0 +1,66 @@
+// A command that reads `--org` must declare it.
+//
+// Ten command modules called requireOrg() — which reads flags.org — without
+// listing `org` in their SCHEMA. The flag still worked, because requireOrg
+// reads the raw flags. But the foreign-flag check did not know about it, so
+// every one of them answered a correct command with:
+//
+//   › Note: unknown flag(s) not recognized by this command: --org
+//     (took value "c2c4810d-…") — check for typos.
+//
+// and then used the value anyway. `funnel list --org <other>` returned the
+// other org's funnels while calling the flag a typo.
+//
+// This is not cosmetic. `--org` is the flag that keeps a write in the right
+// tenant, and telling people it is unrecognized is an invitation to drop it and
+// rely on the machine-wide default — which is precisely the habit behind the
+// cross-project collisions customers report. An agent reading stderr is even
+// likelier to "fix" the typo by removing the flag.
+//
+// Found by running a real command and reading what it printed, not from a test.
+import { describe, it, expect } from 'vitest';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const COMMANDS_DIR = fileURLToPath(new URL('./commands/', import.meta.url));
+function moduleFiles() {
+    const out = [];
+    for (const entry of readdirSync(COMMANDS_DIR).sort()) {
+        const p = path.join(COMMANDS_DIR, entry);
+        if (statSync(p).isDirectory()) {
+            const idx = path.join(p, 'index.ts');
+            try {
+                statSync(idx);
+                out.push(`${entry}/index.ts`);
+            }
+            catch { /* no dispatcher */ }
+        }
+        else if (entry.endsWith('.ts') && !entry.includes('.test.')) {
+            out.push(entry);
+        }
+    }
+    return out;
+}
+describe('every command that reads --org declares it', () => {
+    const files = moduleFiles();
+    it('found command modules (or this proves nothing)', () => {
+        expect(files.length).toBeGreaterThan(10);
+    });
+    it('no module uses requireOrg without declaring org in its SCHEMA', () => {
+        const undeclared = [];
+        for (const file of files) {
+            const src = readFileSync(path.join(COMMANDS_DIR, file), 'utf8');
+            const readsOrg = /\brequireOrg\s*\(|\brequireExplicitOrg\s*\(/.test(src);
+            if (!readsOrg)
+                continue;
+            // A module with no SCHEMA of its own inherits nothing — it still needs
+            // the declaration, so absence counts as undeclared rather than exempt.
+            const declares = /^\s*org:\s*'string',/m.test(src);
+            if (!declares)
+                undeclared.push(file);
+        }
+        expect(undeclared, `${undeclared.join(', ')} call requireOrg but do not declare ` +
+            "`org: 'string'` in SCHEMA. The flag will still work and the CLI will call it a " +
+            'typo — on the one flag that keeps a write in the right tenant.').toEqual([]);
+    });
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.27.0",
+  "version": "2.27.1",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.27.0"
+    "@myapihq/sdk": "^2.27.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",