@myapihq/cli 2.27.3 → 2.27.4

package/dist/commands/storage-upload-json.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/storage-upload-json.test.js

@@ -0,0 +1,73 @@
+// `storage upload --json` printed prose.
+//
+// Every other storage verb honours --json. Upload did not, so an agent that
+// asked for machine output got "✓ Asset uploaded! ID: obj_…" and had to scrape
+// the id out of a sentence to learn what it had just created — on the one verb
+// whose RESULT it most needs, for a platform whose primary caller is an agent.
+//
+// Found by the probe on its first storage run: the step failed with "no JSON on
+// stdout", which is the probe noticing something a human would have read past.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const ORG = '11111111-1111-4111-8111-111111111111';
+const sdk = vi.hoisted(() => ({
+    storage: { uploadAsset: vi.fn() },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+const RESULT = { asset_id: 'obj_abc', url: 'https://api.myapihq.com/storage/obj_abc' };
+let printed;
+// A real file rather than an fs mock: the handler reads it through whichever
+// fs binding it imports, and a mock that misses that binding fails the test
+// for a reason that has nothing to do with the behaviour under test.
+const FILE = path.join(os.tmpdir(), `storage-json-${process.pid}.txt`);
+beforeEach(async () => {
+    fs.writeFileSync(FILE, 'bytes');
+    printed = [];
+    vi.clearAllMocks();
+    sdk.storage.uploadAsset.mockResolvedValue(RESULT);
+    const output = await import('../output.js');
+    const cap = ((m) => { printed.push(typeof m === 'string' ? m : JSON.stringify(m)); });
+    vi.spyOn(output, 'success').mockImplementation(cap);
+    vi.spyOn(output, 'info').mockImplementation(cap);
+    vi.spyOn(output, 'printJson').mockImplementation(cap);
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        printed.push(String(m));
+        throw new Error('__EXIT__');
+    }));
+});
+afterEach(() => { vi.restoreAllMocks(); try {
+    fs.unlinkSync(FILE);
+}
+catch { /* already gone */ } });
+async function upload(flags) {
+    const { run } = await import('./storage.js');
+    try {
+        await run('upload', [FILE], { org: ORG, 'content-type': 'text/plain', ...flags });
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('storage upload --json', () => {
+    it('emits the asset object, not a sentence about it', async () => {
+        await upload({ json: true });
+        const out = printed.join('\n');
+        expect(out).toContain('obj_abc');
+        expect(out).not.toMatch(/Asset uploaded/);
+        expect(() => JSON.parse(out)).not.toThrow();
+    });
+    it('still prints the public-URL warning for humans', async () => {
+        // That warning is the only thing standing between a customer and a
+        // permanently public file, so --json must not be what removes it.
+        await upload({});
+        expect(printed.join('\n')).toMatch(/public forever/i);
+    });
+});

package/dist/commands/storage.js

@@ -101,6 +101,14 @@ async function upload(filePath, flags) {
     const name = flags.name || basename(filePath);
     const visibility = flags.private ? 'private' : undefined;
     const res = await sdkStorage.uploadAsset(config.api_key, orgId, data, contentType, name, visibility);
+    // Every other storage verb honours --json; upload did not, so an agent that
+    // asked for machine output got prose and had to scrape "ID: obj_…" out of a
+    // sentence to learn what it had just created. Agents are the primary caller
+    // of this platform, and upload is the verb whose RESULT they most need.
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     // A private upload has no URL to print, and saying nothing here would look
     // like a partial failure. Name the next step instead.
     if (visibility) {

package/dist/sdk-iam.test.js

@@ -163,9 +163,23 @@ describe('hq IAM contract surface', () => {
         expect(hq.EXPOSES).toContain('POST /hq/account/keys/revoke-all');
         expect(hq.EXPOSES).toContain('PATCH /hq/account/spend-cap');
     });
-    it('GRANTABLE_SLOTS matches the backend iam.GrantableSlots vocabulary', () => {
+    // NOT a check against the backend, whatever the previous name said. This
+    // file cannot reach `iam.GrantableSlots`; it compares one client-side copy
+    // against another written here. When the backend added `payments`, both
+    // copies stayed stale, this stayed green, and it would have FAILED anyone
+    // who tried to fix it — a guard enforcing the bug.
+    //
+    // Found the only way it could be: the API accepted `--grant payments:write`
+    // while the CLI called it an unknown slot. Until then the only way to mint a
+    // payments-scoped key was to omit --grant, which mints an UNRESTRICTED key.
+    //
+    // Kept as a pin, because a change to this list should be deliberate, and
+    // renamed so it stops claiming an authority it does not have. The real check
+    // is the API: it rejects a grant it does not know.
+    it('GRANTABLE_SLOTS is not changed by accident (a pin, not a backend check)', () => {
         expect([...hq.GRANTABLE_SLOTS].sort()).toEqual(['audience', 'company', 'crm', 'database', 'domain', 'email', 'function',
-            'funnel', 'image', 'llm', 'people', 'storage', 'url', 'webhook', 'workflow']);
+            'funnel', 'image', 'llm', 'payments', 'people', 'storage', 'url',
+            'webhook', 'workflow']);
     });
     it('GRANTABLE_SLOTS excludes management/non-grantable surfaces', () => {
         for (const s of ['hq', 'admin', 'internal', 'schema', 'ops', 'pixel']) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.27.3",
+  "version": "2.27.4",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.27.3"
+    "@myapihq/sdk": "^2.27.4"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",