@myapihq/cli 2.27.3 → 2.28.0

package/dist/commands/storage-upload-json.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/storage-upload-json.test.js

@@ -0,0 +1,73 @@
+// `storage upload --json` printed prose.
+//
+// Every other storage verb honours --json. Upload did not, so an agent that
+// asked for machine output got "✓ Asset uploaded! ID: obj_…" and had to scrape
+// the id out of a sentence to learn what it had just created — on the one verb
+// whose RESULT it most needs, for a platform whose primary caller is an agent.
+//
+// Found by the probe on its first storage run: the step failed with "no JSON on
+// stdout", which is the probe noticing something a human would have read past.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const ORG = '11111111-1111-4111-8111-111111111111';
+const sdk = vi.hoisted(() => ({
+    storage: { uploadAsset: vi.fn() },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+const RESULT = { asset_id: 'obj_abc', url: 'https://api.myapihq.com/storage/obj_abc' };
+let printed;
+// A real file rather than an fs mock: the handler reads it through whichever
+// fs binding it imports, and a mock that misses that binding fails the test
+// for a reason that has nothing to do with the behaviour under test.
+const FILE = path.join(os.tmpdir(), `storage-json-${process.pid}.txt`);
+beforeEach(async () => {
+    fs.writeFileSync(FILE, 'bytes');
+    printed = [];
+    vi.clearAllMocks();
+    sdk.storage.uploadAsset.mockResolvedValue(RESULT);
+    const output = await import('../output.js');
+    const cap = ((m) => { printed.push(typeof m === 'string' ? m : JSON.stringify(m)); });
+    vi.spyOn(output, 'success').mockImplementation(cap);
+    vi.spyOn(output, 'info').mockImplementation(cap);
+    vi.spyOn(output, 'printJson').mockImplementation(cap);
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        printed.push(String(m));
+        throw new Error('__EXIT__');
+    }));
+});
+afterEach(() => { vi.restoreAllMocks(); try {
+    fs.unlinkSync(FILE);
+}
+catch { /* already gone */ } });
+async function upload(flags) {
+    const { run } = await import('./storage.js');
+    try {
+        await run('upload', [FILE], { org: ORG, 'content-type': 'text/plain', ...flags });
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('storage upload --json', () => {
+    it('emits the asset object, not a sentence about it', async () => {
+        await upload({ json: true });
+        const out = printed.join('\n');
+        expect(out).toContain('obj_abc');
+        expect(out).not.toMatch(/Asset uploaded/);
+        expect(() => JSON.parse(out)).not.toThrow();
+    });
+    it('still prints the public-URL warning for humans', async () => {
+        // That warning is the only thing standing between a customer and a
+        // permanently public file, so --json must not be what removes it.
+        await upload({});
+        expect(printed.join('\n')).toMatch(/public forever/i);
+    });
+});

package/dist/commands/storage.js

@@ -25,7 +25,20 @@ export const SCHEMA = {
     private: 'boolean',
     ttl: 'string',
 };
-// Mirrors UploadContentType in @myapihq/sdk + backend allowlist.
+// Extension → content type, for inference only. The API accepts any MIME type
+// (a customer found it taking a CSV this table rejected), so widening this
+// costs nothing at the boundary — it only saves people from --content-type.
+//
+// The media types were here already. The text and data ones below are the
+// files a platform that hosts websites and stores exports obviously handles,
+// and a probe hit the gap on its first run trying to upload a .txt.
+//
+// DELIBERATELY ABSENT: .html and .js. They would upload fine and then DOWNLOAD
+// rather than render, because storage serves anything outside its inline-safe
+// list as an attachment — a defence against a polyglot file executing at the
+// api.myapihq.com origin, where session cookies live. Making them one step
+// easier to upload would mostly generate "why doesn't my page load" questions.
+// HTML belongs in a funnel, which serves it from a domain of its own.
 const EXT_TO_CT = {
     '.png': 'image/png',
     '.jpg': 'image/jpeg',
@@ -36,6 +49,11 @@ const EXT_TO_CT = {
     '.pdf': 'application/pdf',
     '.mp4': 'video/mp4',
     '.webm': 'video/webm',
+    '.txt': 'text/plain',
+    '.md': 'text/markdown',
+    '.csv': 'text/csv',
+    '.json': 'application/json',
+    '.zip': 'application/zip',
 };
 function summarizeAsset(a) {
     return {
@@ -101,6 +119,14 @@ async function upload(filePath, flags) {
     const name = flags.name || basename(filePath);
     const visibility = flags.private ? 'private' : undefined;
     const res = await sdkStorage.uploadAsset(config.api_key, orgId, data, contentType, name, visibility);
+    // Every other storage verb honours --json; upload did not, so an agent that
+    // asked for machine output got prose and had to scrape "ID: obj_…" out of a
+    // sentence to learn what it had just created. Agents are the primary caller
+    // of this platform, and upload is the verb whose RESULT they most need.
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     // A private upload has no URL to print, and saying nothing here would look
     // like a partial failure. Name the next step instead.
     if (visibility) {

package/dist/errors.test.js

@@ -107,3 +107,35 @@ describe('a 500 must be reportable', () => {
         expect(out).not.toMatch(/our fault/i);
     });
 });
+describe('a 401 that is not about credentials', () => {
+    // The platform relayed an upstream's auth status verbatim: analytics
+    // refusing US arrived as 401 ANALYTICS_ERROR, and the CLI told a customer
+    // with a valid key to run `myapi account setup`. It fixed nothing, so they
+    // ran it again and got the same sentence. Reported from a real terminal
+    // 2026-08-23; `org list` worked with that key in the same shell.
+    //
+    // The backend no longer relays it. This is the client half: do not assert a
+    // cause the error itself contradicts.
+    const AUTH_CODES = ['unauthorized', 'invalid api key', 'invalid_token', 'unknown_error'];
+    it('a real auth failure still says the key is invalid', () => {
+        for (const code of AUTH_CODES) {
+            const e = new MyApiError(code, 401);
+            expect(looksLikeBadKey(e), `${code} should read as a bad key`).toBe(true);
+        }
+    });
+    it('a foreign code at 401 does not', () => {
+        expect(looksLikeBadKey(new MyApiError('ANALYTICS_ERROR', 401))).toBe(false);
+    });
+    it('a bare 401 with no code still does — most arrive that way', () => {
+        expect(looksLikeBadKey(new MyApiError('', 401))).toBe(true);
+    });
+});
+// Mirrors the predicate in index.ts. Kept here so the rule is testable without
+// importing the entrypoint, which runs main() on import.
+function looksLikeBadKey(err) {
+    const AUTH_CODES = new Set([
+        'unauthorized', 'invalid api key', 'invalid_api_key', 'invalid_token',
+        'missing authorization header', 'invalid authorization header', 'unknown_error',
+    ]);
+    return err.status === 401 && (!err.code || AUTH_CODES.has(String(err.code).toLowerCase()));
+}

package/dist/helpers.d.ts

@@ -17,6 +17,12 @@ export interface ResolvedOrg {
  */
 export declare function resolveOrg(flags: Flags, config: Config): ResolvedOrg | undefined;
 export declare function requireOrg(flags: Flags, config: Config, usage: string): string;
+/**
+ * Test seam. Both org notices fire once per PROCESS, which is right for a CLI
+ * invocation and wrong for a test file — without this the first test latches
+ * them and every later assertion passes for the wrong reason.
+ */
+export declare function _resetOrgNotices(): void;
 export declare function orgLine(orgId: string, name: string | undefined, changedFrom?: string): string;
 /** The org this invocation resolved to, for `--json` consumers. */
 export declare function currentOrg(): {

package/dist/helpers.js

@@ -50,10 +50,47 @@ export function requireOrg(flags, config, usage) {
             `The server would refuse this (403 SCOPE_FORBIDDEN), so nothing was sent.\n` +
             `Use a key for ${orgId}, or drop the override to work in ${config.key_org_id}.`);
     }
+    warnOnceIfSharedDefault(orgId, resolved, config);
     announceOrg(orgId, config);
     recordResolvedOrg(orgId, config);
     return orgId;
 }
+// The moment the machine-wide default becomes a hazard, said once.
+//
+// `default_org` is one value for the whole machine. With a single project that
+// is a convenience; the second project makes it a trap, because whichever ran
+// `config set-org` last owns every bare command in both. Customers reported
+// exactly that, and `myapi init` exists to end it — but only for someone who
+// knows to run it.
+//
+// So: when a command falls through to the machine-wide default AND this machine
+// has already been used with more than one org, say so. Not on every run — a
+// line that is always there is filtered out within a day — and not at all for
+// the single-project case, which is the majority and is genuinely fine.
+function warnOnceIfSharedDefault(orgId, resolved, config) {
+    if (resolved.source !== 'default')
+        return; // something explicit chose it
+    if (sharedDefaultWarned)
+        return;
+    const seen = Object.keys(config.org_names ?? {});
+    if (seen.length < 2)
+        return; // one org on this machine: no ambiguity
+    sharedDefaultWarned = true;
+    const name = config.org_names?.[orgId] ?? orgId;
+    banner(`myapi: using your machine-wide default org (${name}). ` +
+        `This machine has used ${seen.length} orgs; a second project running ` +
+        '`config set-org` would silently retarget this one. Bind the directory instead: myapi init --org <id>');
+}
+let sharedDefaultWarned = false;
+/**
+ * Test seam. Both org notices fire once per PROCESS, which is right for a CLI
+ * invocation and wrong for a test file — without this the first test latches
+ * them and every later assertion passes for the wrong reason.
+ */
+export function _resetOrgNotices() {
+    sharedDefaultWarned = false;
+    announced = false;
+}
 function describeSource(r) {
     switch (r.source) {
         case 'flag': return '--org';

package/dist/index.js

@@ -358,8 +358,28 @@ async function main() {
     }
     catch (err) {
         if (err instanceof MyApiError) {
-            if (err.status === 401)
+            // 401 alone does not mean the key is bad. The platform relayed an
+            // upstream's auth status verbatim — analytics refusing US came back as
+            // 401 ANALYTICS_ERROR — and this told a customer with a perfectly valid
+            // key to run `myapi account setup`. It fixed nothing, so they ran it
+            // again and got the same sentence. Reported 2026-08-23; the backend no
+            // longer relays it, and this stops the CLI asserting a cause the error
+            // itself contradicts.
+            //
+            // Codes the platform actually uses for a bad credential, plus the empty
+            // case (a bare string body, which is how most 401s arrive).
+            const AUTH_CODES = new Set([
+                'unauthorized', 'invalid api key', 'invalid_api_key', 'invalid_token',
+                'missing authorization header', 'invalid authorization header', 'unknown_error',
+            ]);
+            if (err.status === 401 && (!err.code || AUTH_CODES.has(String(err.code).toLowerCase()))) {
                 error('Invalid API key. Run: myapi account setup');
+            }
+            else if (err.status === 401) {
+                // A 401 carrying a code that is not about credentials. Show what the
+                // platform actually said rather than a guess it contradicts.
+                error(friendlyError(err));
+            }
             else if (err.status === 402) {
                 const body = (err.body ?? {});
                 if (err.code === 'REGISTRATION_REQUIRED' || err.code === 'UPGRADE_REQUIRED')

package/dist/org-resolution.test.js

@@ -155,3 +155,52 @@ describe('a locked key refuses a mismatched target', () => {
         expect(exitError).toMatch(/without a value/);
     });
 });
+describe('the machine-wide default warns once, when it is a hazard', () => {
+    // `default_org` is one value for the whole machine. With a single project
+    // that is a convenience; the second project makes it a trap, because
+    // whichever ran `config set-org` last owns every bare command in both.
+    // Customers reported exactly that. `myapi init` ends it — for someone who
+    // knows to run it, which is what this line is for.
+    let banners;
+    beforeEach(async () => {
+        banners = [];
+        const helpers = await import('./helpers.js');
+        helpers._resetOrgNotices();
+        const output = await import('./output.js');
+        vi.spyOn(output, 'banner').mockImplementation(((m) => { banners.push(String(m)); }));
+        vi.spyOn(output, 'error').mockImplementation(((m) => {
+            throw new Error('__EXIT__');
+        }));
+    });
+    afterEach(() => vi.restoreAllMocks());
+    async function resolve(config, flags = {}) {
+        const { requireOrg } = await import('./helpers.js');
+        try {
+            requireOrg(flags, config, 'usage');
+        }
+        catch (e) {
+            if (e?.message !== '__EXIT__')
+                throw e;
+        }
+        return banners.join('\n');
+    }
+    const manyOrgs = { [A]: 'Alpha', [B]: 'Beta' };
+    it('warns when a bare command lands on the machine default and the machine has seen several orgs', async () => {
+        const out = await resolve({ ...base, default_org: A, org_names: manyOrgs });
+        expect(out).toMatch(/machine-wide default/i);
+        expect(out).toContain('myapi init --org');
+    });
+    it('stays quiet for a single-org machine, which is genuinely fine', async () => {
+        const out = await resolve({ ...base, default_org: A, org_names: { [A]: 'Alpha' } });
+        expect(out).not.toMatch(/machine-wide default/i);
+    });
+    it('stays quiet when --org chose the org', async () => {
+        const out = await resolve({ ...base, default_org: A, org_names: manyOrgs }, { org: B });
+        expect(out).not.toMatch(/machine-wide default/i);
+    });
+    it('stays quiet when a project file chose the org', async () => {
+        writeProjectOrg(tmp, B);
+        const out = await resolve({ ...base, default_org: A, org_names: manyOrgs });
+        expect(out).not.toMatch(/machine-wide default/i);
+    });
+});

package/dist/sdk-iam.test.js

@@ -163,9 +163,23 @@ describe('hq IAM contract surface', () => {
         expect(hq.EXPOSES).toContain('POST /hq/account/keys/revoke-all');
         expect(hq.EXPOSES).toContain('PATCH /hq/account/spend-cap');
     });
-    it('GRANTABLE_SLOTS matches the backend iam.GrantableSlots vocabulary', () => {
+    // NOT a check against the backend, whatever the previous name said. This
+    // file cannot reach `iam.GrantableSlots`; it compares one client-side copy
+    // against another written here. When the backend added `payments`, both
+    // copies stayed stale, this stayed green, and it would have FAILED anyone
+    // who tried to fix it — a guard enforcing the bug.
+    //
+    // Found the only way it could be: the API accepted `--grant payments:write`
+    // while the CLI called it an unknown slot. Until then the only way to mint a
+    // payments-scoped key was to omit --grant, which mints an UNRESTRICTED key.
+    //
+    // Kept as a pin, because a change to this list should be deliberate, and
+    // renamed so it stops claiming an authority it does not have. The real check
+    // is the API: it rejects a grant it does not know.
+    it('GRANTABLE_SLOTS is not changed by accident (a pin, not a backend check)', () => {
         expect([...hq.GRANTABLE_SLOTS].sort()).toEqual(['audience', 'company', 'crm', 'database', 'domain', 'email', 'function',
-            'funnel', 'image', 'llm', 'people', 'storage', 'url', 'webhook', 'workflow']);
+            'funnel', 'image', 'llm', 'payments', 'people', 'storage', 'url',
+            'webhook', 'workflow']);
     });
     it('GRANTABLE_SLOTS excludes management/non-grantable surfaces', () => {
         for (const s of ['hq', 'admin', 'internal', 'schema', 'ops', 'pixel']) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.27.3",
+  "version": "2.28.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.27.3"
+    "@myapihq/sdk": "^2.28.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",