@myapihq/cli 2.27.4 → 2.28.0

package/dist/commands/storage.js

@@ -25,7 +25,20 @@ export const SCHEMA = {
     private: 'boolean',
     ttl: 'string',
 };
-// Mirrors UploadContentType in @myapihq/sdk + backend allowlist.
+// Extension → content type, for inference only. The API accepts any MIME type
+// (a customer found it taking a CSV this table rejected), so widening this
+// costs nothing at the boundary — it only saves people from --content-type.
+//
+// The media types were here already. The text and data ones below are the
+// files a platform that hosts websites and stores exports obviously handles,
+// and a probe hit the gap on its first run trying to upload a .txt.
+//
+// DELIBERATELY ABSENT: .html and .js. They would upload fine and then DOWNLOAD
+// rather than render, because storage serves anything outside its inline-safe
+// list as an attachment — a defence against a polyglot file executing at the
+// api.myapihq.com origin, where session cookies live. Making them one step
+// easier to upload would mostly generate "why doesn't my page load" questions.
+// HTML belongs in a funnel, which serves it from a domain of its own.
 const EXT_TO_CT = {
     '.png': 'image/png',
     '.jpg': 'image/jpeg',
@@ -36,6 +49,11 @@ const EXT_TO_CT = {
     '.pdf': 'application/pdf',
     '.mp4': 'video/mp4',
     '.webm': 'video/webm',
+    '.txt': 'text/plain',
+    '.md': 'text/markdown',
+    '.csv': 'text/csv',
+    '.json': 'application/json',
+    '.zip': 'application/zip',
 };
 function summarizeAsset(a) {
     return {

package/dist/errors.test.js

@@ -107,3 +107,35 @@ describe('a 500 must be reportable', () => {
         expect(out).not.toMatch(/our fault/i);
     });
 });
+describe('a 401 that is not about credentials', () => {
+    // The platform relayed an upstream's auth status verbatim: analytics
+    // refusing US arrived as 401 ANALYTICS_ERROR, and the CLI told a customer
+    // with a valid key to run `myapi account setup`. It fixed nothing, so they
+    // ran it again and got the same sentence. Reported from a real terminal
+    // 2026-08-23; `org list` worked with that key in the same shell.
+    //
+    // The backend no longer relays it. This is the client half: do not assert a
+    // cause the error itself contradicts.
+    const AUTH_CODES = ['unauthorized', 'invalid api key', 'invalid_token', 'unknown_error'];
+    it('a real auth failure still says the key is invalid', () => {
+        for (const code of AUTH_CODES) {
+            const e = new MyApiError(code, 401);
+            expect(looksLikeBadKey(e), `${code} should read as a bad key`).toBe(true);
+        }
+    });
+    it('a foreign code at 401 does not', () => {
+        expect(looksLikeBadKey(new MyApiError('ANALYTICS_ERROR', 401))).toBe(false);
+    });
+    it('a bare 401 with no code still does — most arrive that way', () => {
+        expect(looksLikeBadKey(new MyApiError('', 401))).toBe(true);
+    });
+});
+// Mirrors the predicate in index.ts. Kept here so the rule is testable without
+// importing the entrypoint, which runs main() on import.
+function looksLikeBadKey(err) {
+    const AUTH_CODES = new Set([
+        'unauthorized', 'invalid api key', 'invalid_api_key', 'invalid_token',
+        'missing authorization header', 'invalid authorization header', 'unknown_error',
+    ]);
+    return err.status === 401 && (!err.code || AUTH_CODES.has(String(err.code).toLowerCase()));
+}

package/dist/helpers.d.ts

@@ -17,6 +17,12 @@ export interface ResolvedOrg {
  */
 export declare function resolveOrg(flags: Flags, config: Config): ResolvedOrg | undefined;
 export declare function requireOrg(flags: Flags, config: Config, usage: string): string;
+/**
+ * Test seam. Both org notices fire once per PROCESS, which is right for a CLI
+ * invocation and wrong for a test file — without this the first test latches
+ * them and every later assertion passes for the wrong reason.
+ */
+export declare function _resetOrgNotices(): void;
 export declare function orgLine(orgId: string, name: string | undefined, changedFrom?: string): string;
 /** The org this invocation resolved to, for `--json` consumers. */
 export declare function currentOrg(): {

package/dist/helpers.js

@@ -50,10 +50,47 @@ export function requireOrg(flags, config, usage) {
             `The server would refuse this (403 SCOPE_FORBIDDEN), so nothing was sent.\n` +
             `Use a key for ${orgId}, or drop the override to work in ${config.key_org_id}.`);
     }
+    warnOnceIfSharedDefault(orgId, resolved, config);
     announceOrg(orgId, config);
     recordResolvedOrg(orgId, config);
     return orgId;
 }
+// The moment the machine-wide default becomes a hazard, said once.
+//
+// `default_org` is one value for the whole machine. With a single project that
+// is a convenience; the second project makes it a trap, because whichever ran
+// `config set-org` last owns every bare command in both. Customers reported
+// exactly that, and `myapi init` exists to end it — but only for someone who
+// knows to run it.
+//
+// So: when a command falls through to the machine-wide default AND this machine
+// has already been used with more than one org, say so. Not on every run — a
+// line that is always there is filtered out within a day — and not at all for
+// the single-project case, which is the majority and is genuinely fine.
+function warnOnceIfSharedDefault(orgId, resolved, config) {
+    if (resolved.source !== 'default')
+        return; // something explicit chose it
+    if (sharedDefaultWarned)
+        return;
+    const seen = Object.keys(config.org_names ?? {});
+    if (seen.length < 2)
+        return; // one org on this machine: no ambiguity
+    sharedDefaultWarned = true;
+    const name = config.org_names?.[orgId] ?? orgId;
+    banner(`myapi: using your machine-wide default org (${name}). ` +
+        `This machine has used ${seen.length} orgs; a second project running ` +
+        '`config set-org` would silently retarget this one. Bind the directory instead: myapi init --org <id>');
+}
+let sharedDefaultWarned = false;
+/**
+ * Test seam. Both org notices fire once per PROCESS, which is right for a CLI
+ * invocation and wrong for a test file — without this the first test latches
+ * them and every later assertion passes for the wrong reason.
+ */
+export function _resetOrgNotices() {
+    sharedDefaultWarned = false;
+    announced = false;
+}
 function describeSource(r) {
     switch (r.source) {
         case 'flag': return '--org';

package/dist/index.js

@@ -358,8 +358,28 @@ async function main() {
     }
     catch (err) {
         if (err instanceof MyApiError) {
-            if (err.status === 401)
+            // 401 alone does not mean the key is bad. The platform relayed an
+            // upstream's auth status verbatim — analytics refusing US came back as
+            // 401 ANALYTICS_ERROR — and this told a customer with a perfectly valid
+            // key to run `myapi account setup`. It fixed nothing, so they ran it
+            // again and got the same sentence. Reported 2026-08-23; the backend no
+            // longer relays it, and this stops the CLI asserting a cause the error
+            // itself contradicts.
+            //
+            // Codes the platform actually uses for a bad credential, plus the empty
+            // case (a bare string body, which is how most 401s arrive).
+            const AUTH_CODES = new Set([
+                'unauthorized', 'invalid api key', 'invalid_api_key', 'invalid_token',
+                'missing authorization header', 'invalid authorization header', 'unknown_error',
+            ]);
+            if (err.status === 401 && (!err.code || AUTH_CODES.has(String(err.code).toLowerCase()))) {
                 error('Invalid API key. Run: myapi account setup');
+            }
+            else if (err.status === 401) {
+                // A 401 carrying a code that is not about credentials. Show what the
+                // platform actually said rather than a guess it contradicts.
+                error(friendlyError(err));
+            }
             else if (err.status === 402) {
                 const body = (err.body ?? {});
                 if (err.code === 'REGISTRATION_REQUIRED' || err.code === 'UPGRADE_REQUIRED')

package/dist/org-resolution.test.js

@@ -155,3 +155,52 @@ describe('a locked key refuses a mismatched target', () => {
         expect(exitError).toMatch(/without a value/);
     });
 });
+describe('the machine-wide default warns once, when it is a hazard', () => {
+    // `default_org` is one value for the whole machine. With a single project
+    // that is a convenience; the second project makes it a trap, because
+    // whichever ran `config set-org` last owns every bare command in both.
+    // Customers reported exactly that. `myapi init` ends it — for someone who
+    // knows to run it, which is what this line is for.
+    let banners;
+    beforeEach(async () => {
+        banners = [];
+        const helpers = await import('./helpers.js');
+        helpers._resetOrgNotices();
+        const output = await import('./output.js');
+        vi.spyOn(output, 'banner').mockImplementation(((m) => { banners.push(String(m)); }));
+        vi.spyOn(output, 'error').mockImplementation(((m) => {
+            throw new Error('__EXIT__');
+        }));
+    });
+    afterEach(() => vi.restoreAllMocks());
+    async function resolve(config, flags = {}) {
+        const { requireOrg } = await import('./helpers.js');
+        try {
+            requireOrg(flags, config, 'usage');
+        }
+        catch (e) {
+            if (e?.message !== '__EXIT__')
+                throw e;
+        }
+        return banners.join('\n');
+    }
+    const manyOrgs = { [A]: 'Alpha', [B]: 'Beta' };
+    it('warns when a bare command lands on the machine default and the machine has seen several orgs', async () => {
+        const out = await resolve({ ...base, default_org: A, org_names: manyOrgs });
+        expect(out).toMatch(/machine-wide default/i);
+        expect(out).toContain('myapi init --org');
+    });
+    it('stays quiet for a single-org machine, which is genuinely fine', async () => {
+        const out = await resolve({ ...base, default_org: A, org_names: { [A]: 'Alpha' } });
+        expect(out).not.toMatch(/machine-wide default/i);
+    });
+    it('stays quiet when --org chose the org', async () => {
+        const out = await resolve({ ...base, default_org: A, org_names: manyOrgs }, { org: B });
+        expect(out).not.toMatch(/machine-wide default/i);
+    });
+    it('stays quiet when a project file chose the org', async () => {
+        writeProjectOrg(tmp, B);
+        const out = await resolve({ ...base, default_org: A, org_names: manyOrgs });
+        expect(out).not.toMatch(/machine-wide default/i);
+    });
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.27.4",
+  "version": "2.28.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.27.4"
+    "@myapihq/sdk": "^2.28.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",