@myapihq/cli 2.3.1 → 2.4.0

package/dist/commands/login.js

@@ -0,0 +1,447 @@
+// `myapi login` — browser-based operator sign-in (Google via my-auth-api).
+//
+// Flow (decision-operator-login-google-2026-07-24): open the hosted login page
+// of the MyAPI operator tenant on my-auth-api, complete Google (or email-code)
+// sign-in in the browser, receive the OIDC code on a loopback redirect
+// (RFC 8252), exchange the code for tokens at the tenant's /token endpoint
+// (PKCE), then exchange the resulting id_token at `POST /hq/account/exchange`
+// for the hq API key — saved to ~/.myapi/config.json like `account setup`.
+//
+// `--mock` still runs the whole browser UX against an in-process fake of the
+// hosted login page (real loopback server, real PKCE, fake identity, persists
+// nothing) for offline UX previews and demos.
+import * as http from 'http';
+import * as crypto from 'crypto';
+import { spawn } from 'child_process';
+import { info, success, error } from '../output.js';
+import { addAccount } from '../config.js';
+export const EXPOSES = [
+    'POST /hq/account/exchange',
+];
+export const SCHEMA = {
+    mock: 'boolean',
+    'no-browser': 'boolean',
+};
+export const HELP = `Usage: myapi login [--no-browser] [--mock]
+
+Signs in to MyAPI in your browser — Google, or an email code — and stores the
+session in ~/.myapi/config.json. The account created/linked here is the same
+account model as \`myapi account setup\`; anonymous setup stays available and
+unchanged.
+
+Flags:
+  --no-browser  Print the sign-in URL instead of opening a browser
+  --mock        Run the flow against an in-process mock (offline UX preview;
+                nothing is saved, no network calls leave your machine)`;
+// Operator tenant + native CLI client on my-auth-api (public, non-secret ids;
+// overridable for staging). Must match the backend's OPERATOR_AUTH_TENANT /
+// OPERATOR_AUTH_CLIENT_ID (auto-provisioned by EnsureOperatorTenant).
+const OPERATOR_TENANT = process.env.MYAPI_OPERATOR_TENANT ?? '75e48426-1e8d-45c7-9ab3-b3b7d6fd216d';
+const OPERATOR_CLIENT_ID = process.env.MYAPI_OPERATOR_CLIENT_ID ?? 'cl_operator_cli';
+function authBase() { return process.env.MYAPI_AUTH_URL ?? 'https://auth.myapihq.com'; }
+function hqBase() { return process.env.MYAPI_HQ_URL ?? process.env.MYAPI_API_BASE ?? 'https://api.myapihq.com'; }
+function authorizeBase() { return `${authBase()}/auth/${OPERATOR_TENANT}/authorize`; }
+function tokenUrl() { return `${authBase()}/auth/${OPERATOR_TENANT}/token`; }
+export function generatePkce() {
+    const verifier = crypto.randomBytes(32).toString('base64url');
+    const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+    const state = crypto.randomBytes(16).toString('base64url');
+    return { verifier, challenge, state };
+}
+export function buildAuthorizeUrl(base, redirectUri, pkce) {
+    const u = new URL(base);
+    u.searchParams.set('client_id', OPERATOR_CLIENT_ID);
+    u.searchParams.set('response_type', 'code');
+    u.searchParams.set('redirect_uri', redirectUri);
+    u.searchParams.set('state', pkce.state);
+    u.searchParams.set('code_challenge', pkce.challenge);
+    u.searchParams.set('code_challenge_method', 'S256');
+    u.searchParams.set('scope', 'openid email profile');
+    return u.toString();
+}
+// ── Browser opener (zero-dep, best-effort) ──────────────────────────────────
+function openBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open'
+        : process.platform === 'win32' ? 'cmd'
+            : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ── Loopback callback server ────────────────────────────────────────────────
+const CALLBACK_TIMEOUT_MS = 180_000;
+// One page, styled once: used for both the success and error variants of the
+// "return to your terminal" screen the browser lands on after sign-in.
+function landingHtml(title, body, ok) {
+    return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>
+  body{font-family:-apple-system,system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:90vh;margin:0;background:#fafafa;color:#1a1a1a}
+  @media(prefers-color-scheme:dark){body{background:#111;color:#eee}}
+  .card{text-align:center;padding:2.5rem 3rem;border-radius:12px;box-shadow:0 1px 8px rgba(0,0,0,.08);background:#fff;max-width:26rem}
+  @media(prefers-color-scheme:dark){.card{background:#1c1c1c}}
+  .mark{font-size:2.2rem;margin-bottom:.6rem}
+  h1{font-size:1.15rem;margin:.2rem 0 .6rem}
+  p{color:#666;font-size:.92rem;line-height:1.5;margin:0}
+  @media(prefers-color-scheme:dark){p{color:#aaa}}
+</style></head><body><div class="card">
+  <div class="mark">${ok ? '✓' : '✕'}</div><h1>${title}</h1><p>${body}</p>
+</div></body></html>`;
+}
+function startCallbackServer(expectedState) {
+    return new Promise((resolveStart, rejectStart) => {
+        let settle;
+        const result = new Promise((resolve, reject) => { settle = { resolve, reject }; });
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (url.pathname !== '/callback') {
+                res.writeHead(404).end();
+                return;
+            }
+            const err = url.searchParams.get('error');
+            const code = url.searchParams.get('code');
+            const state = url.searchParams.get('state');
+            if (err) {
+                res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+                    .end(landingHtml('Sign-in cancelled', 'You can close this tab and return to your terminal.', false));
+                settle.reject(new Error(err === 'access_denied' ? 'Sign-in was cancelled in the browser.' : `Sign-in failed: ${err}`));
+                return;
+            }
+            if (!code || state !== expectedState) {
+                res.writeHead(400, { 'content-type': 'text/html; charset=utf-8' })
+                    .end(landingHtml('Sign-in failed', 'State mismatch — please close this tab and run <code>myapi login</code> again.', false));
+                settle.reject(new Error('State mismatch on the login callback — possible interception; aborting.'));
+                return;
+            }
+            res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+                .end(landingHtml("You're signed in", 'You can close this tab and return to your terminal.', true));
+            settle.resolve({ code });
+        });
+        server.on('error', rejectStart);
+        // Port 0 → OS-assigned; loopback only. The redirect URI is registered as
+        // a loopback template backend-side (RFC 8252 §7.3 — any port allowed).
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (!addr || typeof addr === 'string') {
+                rejectStart(new Error('Could not bind loopback callback server.'));
+                return;
+            }
+            resolveStart({
+                redirectUri: `http://127.0.0.1:${addr.port}/callback`,
+                result,
+                close: () => server.close(),
+            });
+        });
+    });
+}
+// ── Mock hosted login page (my-auth-api stand-in) ───────────────────────────
+//
+// Serves a believable copy of the operator tenant's hosted login page so the
+// end-to-end UX — terminal → browser → Google/email → redirect → terminal —
+// can be felt before the backend exists. The "auth code" it issues encodes
+// the chosen identity so the CLI can render the final message truthfully.
+function mockLoginPage(query) {
+    const redirect = query.get('redirect_uri') ?? '';
+    const state = query.get('state') ?? '';
+    const qs = (extra) => new URLSearchParams({ redirect_uri: redirect, state, ...extra }).toString();
+    return `<!doctype html><html><head><meta charset="utf-8"><title>Sign in — MyAPI</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>
+  body{font-family:-apple-system,system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:95vh;margin:0;background:#fafafa;color:#1a1a1a}
+  @media(prefers-color-scheme:dark){body{background:#111;color:#eee}}
+  .card{padding:2.5rem;border-radius:12px;box-shadow:0 1px 8px rgba(0,0,0,.08);background:#fff;width:20rem}
+  @media(prefers-color-scheme:dark){.card{background:#1c1c1c}}
+  h1{font-size:1.1rem;text-align:center;margin:0 0 .4rem}
+  .sub{text-align:center;color:#888;font-size:.8rem;margin-bottom:1.4rem}
+  a.google{display:flex;align-items:center;justify-content:center;gap:.6rem;border:1px solid #ddd;border-radius:8px;padding:.65rem;text-decoration:none;color:inherit;font-size:.95rem}
+  a.google:hover{background:rgba(66,133,244,.06)}
+  @media(prefers-color-scheme:dark){a.google{border-color:#333}}
+  .g{font-weight:700;background:linear-gradient(90deg,#4285F4,#EA4335,#FBBC05,#34A853);-webkit-background-clip:text;background-clip:text;color:transparent}
+  .or{display:flex;align-items:center;gap:.8rem;color:#aaa;font-size:.75rem;margin:1.2rem 0}
+  .or::before,.or::after{content:"";flex:1;height:1px;background:#e5e5e5}
+  @media(prefers-color-scheme:dark){.or::before,.or::after{background:#333}}
+  input{width:100%;box-sizing:border-box;padding:.6rem;border:1px solid #ddd;border-radius:8px;font-size:.9rem;background:transparent;color:inherit}
+  @media(prefers-color-scheme:dark){input{border-color:#333}}
+  button{width:100%;margin-top:.7rem;padding:.6rem;border:0;border-radius:8px;background:#1a1a1a;color:#fff;font-size:.9rem;cursor:pointer}
+  @media(prefers-color-scheme:dark){button{background:#eee;color:#111}}
+  .mock{margin-top:1.4rem;text-align:center;font-size:.72rem;color:#c98200}
+</style></head><body><div class="card">
+  <h1>Sign in to MyAPI</h1>
+  <div class="sub">to continue to the MyAPI CLI</div>
+  <a class="google" href="/mock/google?${qs({})}"><span class="g">G</span> Continue with Google</a>
+  <div class="or">or</div>
+  <form action="/mock/email" method="get">
+    <input type="hidden" name="redirect_uri" value="${redirect}">
+    <input type="hidden" name="state" value="${state}">
+    <input name="email" type="email" placeholder="you@example.com" required>
+    <button type="submit">Continue with email</button>
+  </form>
+  <div class="mock">MOCK — local preview, no real authentication</div>
+</div></body></html>`;
+}
+function mockGoogleChooser(query) {
+    const account = (email) => {
+        const u = new URLSearchParams({
+            redirect_uri: query.get('redirect_uri') ?? '',
+            state: query.get('state') ?? '',
+            email, method: 'google',
+        });
+        return `/mock/complete?${u.toString()}`;
+    };
+    return `<!doctype html><html><head><meta charset="utf-8"><title>Choose an account</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>
+  body{font-family:Roboto,-apple-system,system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:95vh;margin:0;background:#fff;color:#202124}
+  @media(prefers-color-scheme:dark){body{background:#1f1f1f;color:#e8eaed}}
+  .card{border:1px solid #dadce0;border-radius:12px;padding:2.5rem 2rem;width:21rem}
+  @media(prefers-color-scheme:dark){.card{border-color:#5f6368}}
+  .logo{text-align:center;font-size:1.4rem;font-weight:500;margin-bottom:.6rem}
+  .logo span:nth-child(1){color:#4285F4}.logo span:nth-child(2){color:#EA4335}.logo span:nth-child(3){color:#FBBC05}.logo span:nth-child(4){color:#4285F4}.logo span:nth-child(5){color:#34A853}.logo span:nth-child(6){color:#EA4335}
+  h1{font-size:1.15rem;font-weight:400;text-align:center;margin:.4rem 0 1.6rem}
+  a{display:flex;align-items:center;gap:.9rem;padding:.8rem .6rem;text-decoration:none;color:inherit;border-top:1px solid #eee;font-size:.9rem}
+  @media(prefers-color-scheme:dark){a{border-color:#3c4043}}
+  a:hover{background:rgba(66,133,244,.05)}
+  .av{width:2rem;height:2rem;border-radius:50%;background:#7b1fa2;color:#fff;display:flex;align-items:center;justify-content:center;font-size:.9rem}
+  .av.b{background:#00796b}
+  .mock{margin-top:1.4rem;text-align:center;font-size:.72rem;color:#c98200}
+</style></head><body><div class="card">
+  <div class="logo"><span>G</span><span>o</span><span>o</span><span>g</span><span>l</span><span>e</span></div>
+  <h1>Choose an account<br><small style="font-size:.75rem;color:#888">to continue to <b>MyAPI</b></small></h1>
+  <a href="${account('simon@gmail.com')}"><span class="av">S</span> <span>Simon<br><small style="color:#888">simon@gmail.com</small></span></a>
+  <a href="${account('founder@mycompany.com')}"><span class="av b">F</span> <span>Founder<br><small style="color:#888">founder@mycompany.com</small></span></a>
+  <div class="mock">MOCK — no real Google involved</div>
+</div></body></html>`;
+}
+function mockEmailCodePage(query) {
+    const u = new URLSearchParams({
+        redirect_uri: query.get('redirect_uri') ?? '',
+        state: query.get('state') ?? '',
+        email: query.get('email') ?? '',
+        method: 'email',
+    });
+    return `<!doctype html><html><head><meta charset="utf-8"><title>Enter code — MyAPI</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>
+  body{font-family:-apple-system,system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:95vh;margin:0;background:#fafafa;color:#1a1a1a}
+  @media(prefers-color-scheme:dark){body{background:#111;color:#eee}}
+  .card{padding:2.5rem;border-radius:12px;box-shadow:0 1px 8px rgba(0,0,0,.08);background:#fff;width:20rem;text-align:center}
+  @media(prefers-color-scheme:dark){.card{background:#1c1c1c}}
+  h1{font-size:1.05rem;margin:0 0 .5rem}
+  p{color:#888;font-size:.85rem;margin:0 0 1.2rem}
+  input{width:100%;box-sizing:border-box;padding:.6rem;border:1px solid #ddd;border-radius:8px;font-size:1.1rem;text-align:center;letter-spacing:.4em;background:transparent;color:inherit}
+  @media(prefers-color-scheme:dark){input{border-color:#333}}
+  button{width:100%;margin-top:.8rem;padding:.6rem;border:0;border-radius:8px;background:#1a1a1a;color:#fff;font-size:.9rem;cursor:pointer}
+  @media(prefers-color-scheme:dark){button{background:#eee;color:#111}}
+  .mock{margin-top:1.4rem;font-size:.72rem;color:#c98200}
+</style></head><body><div class="card">
+  <h1>Check your email</h1>
+  <p>We sent a code to <b>${query.get('email') ?? ''}</b><br>(mock: any 6 digits work)</p>
+  <form action="/mock/complete" method="get">
+    ${[...u.entries()].map(([k, v]) => `<input type="hidden" name="${k}" value="${v}">`).join('')}
+    <input name="code" inputmode="numeric" pattern="[0-9]{6}" placeholder="••••••" required>
+    <button type="submit">Verify</button>
+  </form>
+  <div class="mock">MOCK — no email was sent</div>
+</div></body></html>`;
+}
+function startMockIdp() {
+    return new Promise((resolveStart, rejectStart) => {
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+            const html = (body) => res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }).end(body);
+            switch (url.pathname) {
+                case '/authorize': return html(mockLoginPage(url.searchParams));
+                case '/mock/google': return html(mockGoogleChooser(url.searchParams));
+                case '/mock/email': return html(mockEmailCodePage(url.searchParams));
+                case '/mock/complete': {
+                    // Issue the "auth code": identity claims, base64url — mock only.
+                    const claims = { email: url.searchParams.get('email'), method: url.searchParams.get('method') };
+                    const code = 'mock_' + Buffer.from(JSON.stringify(claims)).toString('base64url');
+                    const target = new URL(url.searchParams.get('redirect_uri') ?? '');
+                    target.searchParams.set('code', code);
+                    target.searchParams.set('state', url.searchParams.get('state') ?? '');
+                    res.writeHead(302, { location: target.toString() }).end();
+                    return;
+                }
+                default: res.writeHead(404).end();
+            }
+        });
+        server.on('error', rejectStart);
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (!addr || typeof addr === 'string') {
+                rejectStart(new Error('Could not bind mock login server.'));
+                return;
+            }
+            resolveStart({
+                authorizeBase: `http://127.0.0.1:${addr.port}/authorize`,
+                close: () => server.close(),
+            });
+        });
+    });
+}
+// exchangeCodeForTokens redeems the OIDC authorization code at the operator
+// tenant's /token endpoint (PKCE, no client secret — public native client) and
+// returns the id_token. The endpoint is form-encoded (OAuth2 §4.1.3).
+async function exchangeCodeForTokens(code, verifier, redirectUri) {
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: redirectUri,
+        client_id: OPERATOR_CLIENT_ID,
+        code_verifier: verifier,
+    });
+    const r = await fetch(tokenUrl(), {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+        signal: AbortSignal.timeout(30_000),
+    });
+    const data = await r.json().catch(() => ({}));
+    if (!r.ok || !data?.id_token) {
+        throw new Error(`Token exchange failed (${r.status}): ${data?.error_description || data?.error || 'no id_token returned'}`);
+    }
+    return data.id_token;
+}
+// exchangeTokenForKey trades the verified id_token for an hq API key + defaults.
+async function exchangeTokenForKey(idToken) {
+    const r = await fetch(`${hqBase()}/hq/account/exchange`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ id_token: idToken }),
+        signal: AbortSignal.timeout(30_000),
+    });
+    const env = await r.json().catch(() => ({}));
+    if (!r.ok || !env?.data?.api_key) {
+        const msg = env?.error?.message || env?.error || `HTTP ${r.status}`;
+        throw new Error(`Sign-in exchange failed: ${typeof msg === 'string' ? msg : JSON.stringify(msg)}`);
+    }
+    return env.data;
+}
+// emailFromIdToken reads the (already backend-verified) email claim for display
+// + the local config entry. Never trusted for auth — that's the backend's job.
+function emailFromIdToken(idToken) {
+    try {
+        const claims = JSON.parse(Buffer.from(idToken.split('.')[1] ?? '', 'base64url').toString());
+        return typeof claims.email === 'string' ? claims.email : '';
+    }
+    catch {
+        return '';
+    }
+}
+// Mock stand-in for `POST /hq/account/exchange`. Used only by `--mock`.
+function mockExchange(code) {
+    let claims = {};
+    try {
+        claims = JSON.parse(Buffer.from(code.replace(/^mock_/, ''), 'base64url').toString());
+    }
+    catch { /* fall through */ }
+    return {
+        email: claims.email || 'you@example.com',
+        method: claims.method === 'email' ? 'email' : 'google',
+        account_id: 'acct_mock_' + crypto.randomBytes(4).toString('hex'),
+        default_org: 'mock-org',
+        default_funnel: 'mock-funnel',
+    };
+}
+// ── Command ─────────────────────────────────────────────────────────────────
+export async function login(flags = {}) {
+    if (flags.help) {
+        info(HELP);
+        return;
+    }
+    if (flags.mock) {
+        await loginMock(flags);
+        return;
+    }
+    const pkce = generatePkce();
+    const callback = await startCallbackServer(pkce.state);
+    const authorizeUrl = buildAuthorizeUrl(authorizeBase(), callback.redirectUri, pkce);
+    info('› Opening your browser to sign in…');
+    const opened = flags['no-browser'] ? false : openBrowser(authorizeUrl);
+    if (!opened) {
+        info('› Open this URL to sign in:');
+        info(`  ${authorizeUrl}`);
+    }
+    info('› Waiting for sign-in in the browser… (Ctrl-C to cancel)');
+    const timeout = setTimeout(() => {
+        info('');
+        error('Timed out waiting for the browser sign-in (3 minutes). Run: myapi login');
+    }, CALLBACK_TIMEOUT_MS);
+    let auth;
+    let email = '';
+    try {
+        const { code } = await callback.result;
+        const idToken = await exchangeCodeForTokens(code, pkce.verifier, callback.redirectUri);
+        email = emailFromIdToken(idToken);
+        auth = await exchangeTokenForKey(idToken);
+    }
+    catch (e) {
+        error(e?.message ?? 'Sign-in failed.');
+    }
+    finally {
+        clearTimeout(timeout);
+        callback.close();
+    }
+    if (!auth)
+        error('Sign-in failed.');
+    addAccount({
+        api_key: auth.api_key,
+        account_id: auth.account_id,
+        email: email || undefined,
+        default_org: auth.default_org || undefined,
+        default_funnel: auth.default_funnel || undefined,
+    });
+    success(`› ✓ Signed in${email ? ` · ${email}` : ''}`);
+    info(`  Account: ${auth.account_id}`);
+    if (auth.default_org)
+        info(`  Org: ${auth.default_org}${auth.default_funnel ? ` · Funnel: ${auth.default_funnel}` : ''}`);
+    info('  Saved to ~/.myapi/config.json');
+}
+// loginMock runs the full browser UX against the in-process fake IdP. Nothing is
+// persisted and no network calls leave the machine — a UX preview / demo aid.
+async function loginMock(flags = {}) {
+    const pkce = generatePkce();
+    const callback = await startCallbackServer(pkce.state);
+    const idp = await startMockIdp();
+    const authorizeUrl = buildAuthorizeUrl(idp.authorizeBase, callback.redirectUri, pkce);
+    info('› Opening your browser to sign in… (mock preview — nothing is saved)');
+    const opened = flags['no-browser'] ? false : openBrowser(authorizeUrl);
+    if (!opened) {
+        info('› Open this URL to sign in:');
+        info(`  ${authorizeUrl}`);
+    }
+    info('› Waiting for sign-in in the browser… (Ctrl-C to cancel)');
+    const timeout = setTimeout(() => {
+        info('');
+        error('Timed out waiting for the browser sign-in (3 minutes). Run: myapi login --mock');
+    }, CALLBACK_TIMEOUT_MS);
+    let result;
+    try {
+        const { code } = await callback.result;
+        result = mockExchange(code);
+    }
+    catch (e) {
+        error(e?.message ?? 'Sign-in failed.');
+    }
+    finally {
+        clearTimeout(timeout);
+        callback.close();
+        idp.close();
+    }
+    if (!result)
+        error('Sign-in failed.');
+    const via = result.method === 'google' ? 'Google' : 'email code';
+    success(`› Signed in · ${result.email} (via ${via})`);
+    info(`  Account:  ${result.account_id}`);
+    info(`  Org:      ${result.default_org} · Funnel: ${result.default_funnel}`);
+    info('');
+    info('› (mock) Nothing was saved. Run `myapi login` for the real sign-in.');
+}

package/dist/commands/org.d.ts

@@ -6,7 +6,7 @@ export declare const SCHEMA: FlagSchema;
 export declare function create(restArgs: string[], flags: Flags): Promise<void>;
 export declare function list(flags: Flags): Promise<void>;
 export declare function get(id: string, flags: Flags): Promise<void>;
-export declare function del(id: string, _flags: Flags): Promise<void>;
+export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function update(restArgs: string[], flags: Flags): Promise<void>;
 export declare function importOrg(args: string[], flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/org.js

@@ -1,7 +1,7 @@
 import { hq, funnel as sdkFunnel } from '@myapihq/sdk';
 import { requireConfig, saveConfig } from '../config.js';
 import { success, error, printTable, printJson, info } from '../output.js';
-import { confirm } from '../prompt.js';
+import { confirm, isNonInteractive } from '../prompt.js';
 import { formatDate, pollJob } from '../utils.js';
 import { requireOrg, requireArg } from '../helpers.js';
 export const EXPOSES = [
@@ -45,7 +45,11 @@ export async function create(restArgs, flags) {
             info(`Preview domain: https://${org.preview_subdomain}.makeautonomous.com`);
         }
     }
-    const setDefault = !!flags.yes || await confirm('› Set as default org and funnel? (Y/n) ', true);
+    // Never re-point the CLI's defaults on a silent fallback: in non-interactive
+    // contexts (CI, agent pipelines) only --yes may switch the default org —
+    // an unanswered prompt must not count as consent.
+    const setDefault = !!flags.yes ||
+        (!isNonInteractive() && await confirm('› Set as default org and funnel? (Y/n) ', true));
     let funnelId;
     if (setDefault) {
         config.default_org = org.id;
@@ -112,11 +116,23 @@ export async function get(id, flags) {
     if (org.preview_subdomain)
         info(`Preview: https://${org.preview_subdomain}.makeautonomous.com`);
 }
-export async function del(id, _flags) {
-    requireArg(id, 'id', 'myapi org delete <id>');
+export async function del(id, flags) {
+    requireArg(id, 'id', 'myapi org delete <id> --yes');
     const config = requireConfig();
+    // Look before the write: name the org we are about to destroy, and fail
+    // (rather than proceed blind) if it can't be resolved.
+    const org = await hq.getOrg(config.api_key, id);
+    const label = org.name ? `"${org.name}" (${id})` : id;
+    if (!flags.yes) {
+        if (isNonInteractive()) {
+            error(`Refusing to delete org ${label} without --yes.\nThis permanently deletes the org and its funnels. Usage: myapi org delete <id> --yes`);
+        }
+        const ok = await confirm(`› Permanently delete org ${label} and all its funnels? (y/N) `, false);
+        if (!ok)
+            error('Aborted.');
+    }
     await hq.deleteOrg(config.api_key, id);
-    success(`Org ${id} deleted`);
+    success(`Org ${label} deleted`);
 }
 // Update one or more fields of an org. At least one --flag must be supplied;
 // otherwise we have nothing to send (the SDK accepts a partial payload but
@@ -195,11 +211,12 @@ Examples:
   myapi org create "Acme Inc" --yes
   myapi org create --name "Acme Inc" --yes`,
     'get': 'myapi org get <id> [--json]',
-    'delete': `myapi org delete <id>
+    'delete': `myapi org delete <id> [--yes]
 
 Permanently deletes an organization and its associated funnels.
 Any registered domains assigned to this org must be unassigned first.
-No confirmation prompt — the action is immediate.`,
+Asks for confirmation; pass --yes to skip (required in non-interactive runs).
+Verify the id first with: myapi org get <id>`,
     'sync-brand': `myapi org sync-brand <domain> [--org <id>]
 
 Fetches an existing website and extracts brand signals (name, logo, description,

package/dist/commands/queue.js

@@ -2,7 +2,7 @@ import { queue as sdkQueue } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson } from '../output.js';
 import { formatDate } from '../utils.js';
-import { requireOrg, requireArg } from '../helpers.js';
+import { requireOrg, requireArg, confirmDestructive } from '../helpers.js';
 export const EXPOSES = [
     'POST /queue/orgs/{org_id}/queues',
     'GET /queue/orgs/{org_id}/queues',
@@ -167,10 +167,11 @@ export async function job(jobId, flags) {
 }
 export async function del(name, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi queue delete <name> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi queue delete <name> [--yes] [--org <id>]');
     requireArg(name, 'name', 'myapi queue delete <name>');
+    await confirmDestructive(flags, `delete queue "${name}" in org ${orgId}`, 'myapi queue delete <name> --yes [--org <id>]');
     await sdkQueue.deleteQueue(config.api_key, orgId, name);
-    success(`Deleted queue: ${name}`);
+    success(`Deleted queue: ${name} (org ${orgId})`);
 }
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {

package/dist/commands/setup.js

@@ -214,7 +214,10 @@ export async function importKey(apiKey, flags) {
         throw new Error(`Could not verify API key: ${e.message}`);
     }
     const { org: defaultOrg, funnel: defaultFunnel } = await resolveDefaults(apiKey);
-    const wantsSkills = flags['no-skills'] ? false : true;
+    // import-key is the CI/Docker path and its help documents --install-skills
+    // as opt-IN: never write skill files/symlinks into the operator's home dirs
+    // unless explicitly asked.
+    const wantsSkills = !!flags['install-skills'] && !flags['no-skills'];
     addAccount({
         api_key: apiKey, account_id: accountId, email,
         default_org: defaultOrg, default_funnel: defaultFunnel,
@@ -223,6 +226,8 @@ export async function importKey(apiKey, flags) {
     success(`› ✓ Key imported${email ? ` · ${email}` : ''}`);
     if (wantsSkills)
         await installSkills();
+    else
+        info('Skills pack not installed. Add it any time with: myapi install-skills');
 }
 // Persist a new account + (optionally) install skills.
 async function installAndPersistSkills(account, wantsSkills) {

package/dist/commands/storage.js

@@ -158,7 +158,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         if (usage)
             info(`Usage: ${usage}`);
         else
-            error(`Unknown subcommand: ${subcommand}. Run "myapi storage --help" for the list.`);
+            info(`Unknown subcommand: ${subcommand}. Run "myapi storage --help" for the list.`);
         return;
     }
     switch (subcommand) {

package/dist/commands/workflow.js

@@ -1,7 +1,7 @@
 import { workflow as sdkWorkflow } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson } from '../output.js';
-import { requireOrg } from '../helpers.js';
+import { requireOrg, confirmDestructive } from '../helpers.js';
 export const EXPOSES = [
     'POST /workflow/orgs/{org_id}/workflows',
     'GET /workflow/orgs/{org_id}/workflows',
@@ -273,11 +273,12 @@ export async function disable(id, flags) {
 }
 export async function del(id, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi workflow delete <id> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi workflow delete <id> [--yes] [--org <id>]');
     if (!id)
-        error('Missing required arguments.\nUsage: myapi workflow delete <id> [--org <id>]');
+        error('Missing required arguments.\nUsage: myapi workflow delete <id> [--yes] [--org <id>]');
+    await confirmDestructive(flags, `delete workflow ${id} in org ${orgId}`, 'myapi workflow delete <id> --yes [--org <id>]');
     await sdkWorkflow.deleteWorkflow(config.api_key, orgId, id);
-    success(`Deleted workflow ${id}`);
+    success(`Deleted workflow ${id} (org ${orgId})`);
 }
 export async function runs(id, flags) {
     const config = requireConfig();

package/dist/completion.js

@@ -28,14 +28,14 @@ const BLOCK_END = `# end ${PROGRAM} completion`;
 export const COMMANDS = [
     'account', 'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
     'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image',
-    'doctor', 'install-skills', 'keys', 'llm', 'org', 'payments', 'people', 'pixel', 'queue',
-    'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
+    'doctor', 'install-skills', 'keys', 'llm', 'login', 'org', 'payments', 'people', 'pixel',
+    'queue', 'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
     'workflow',
 ];
 // command → subcommands, for `myapi <command> <TAB>`. Mirrors each
 // command's dispatcher; commands absent here take no subcommand.
 export const SUBCOMMANDS = {
-    account: ['setup', 'import-key', 'whoami', 'link', 'switch', 'install-skills', 'config', 'registrant', 'api-keys', 'keys', 'mailing-address'],
+    account: ['setup', 'import-key', 'whoami', 'login', 'link', 'switch', 'install-skills', 'config', 'registrant', 'api-keys', 'keys', 'mailing-address'],
     // The end-user auth product. Operator/account commands live under `account`.
     auth: ['tenant', 'client', 'usage', 'domain'],
     org: ['create', 'delete', 'get', 'import', 'list', 'sync-brand', 'update'],

package/dist/config.js

@@ -54,6 +54,9 @@ export function loadConfig() {
 function writeFullConfig(full) {
     ensureDir();
     fs.writeFileSync(CONFIG_FILE, JSON.stringify(full, null, 2), { mode: 0o600 });
+    // `mode` only applies when the file is created. Repair permissions on
+    // configs written by older CLI versions (pre-0o600) that are still 0644.
+    fs.chmodSync(CONFIG_FILE, 0o600);
 }
 export function saveConfig(config) {
     const full = loadFullConfig() ?? { active: 0, accounts: [] };

package/dist/errors.d.ts

@@ -0,0 +1,3 @@
+import { MyApiError } from '@myapihq/sdk';
+export declare const ERROR_MESSAGES: Record<string, string>;
+export declare function friendlyError(err: MyApiError): string;