@myapihq/cli 2.31.1 → 2.31.2

package/dist/flags.d.ts

@@ -1,6 +1,7 @@
 export type FlagType = 'string' | 'boolean' | 'number' | 'list';
 export type FlagSchema = Record<string, FlagType>;
 export declare const GLOBAL_FLAGS: FlagSchema;
+export declare const DISPATCH_FLAGS: ReadonlySet<string>;
 export interface ParsedArgs {
     args: string[];
     flags: Record<string, string | boolean | number>;

package/dist/flags.js

@@ -5,13 +5,37 @@
 // utils.ts — adding a new value flag without registering it would silently
 // turn it into a boolean (e.g. `--html '<p>'` becoming `flags.html === true`).
 // Flags every command understands.
+//
+// `org` belongs here rather than in each command's own schema. Ten commands
+// declared it individually and the other nineteen did not, so the same flag
+// refused a duplicate on `myapi pixel` and silently kept the last value on
+// `myapi funnel push` — see the duplicate check in parseFlags for why last-wins
+// is the one outcome you cannot recover from. For the tenant selector it picks
+// the organisation your write lands in, which makes it the worst flag in the
+// CLI to resolve silently.
 export const GLOBAL_FLAGS = {
     help: 'boolean',
     json: 'boolean',
     verbose: 'boolean',
     yes: 'boolean',
     y: 'boolean',
+    version: 'boolean',
+    org: 'string',
 };
+// Short aliases are consumed as `-h` / `-v` / `-V` before the `--flag` branch,
+// so they never appear as keys in `merged` and need no type — but they do land
+// in `flags` (as help/version), so the dispatcher must still tolerate them.
+const SHORT_ALIASES = ['h', 'v', 'V'];
+// What the dispatcher tolerates on any command, derived from the list above so
+// the two cannot disagree. They previously drifted: `--org` was missing here
+// while being honoured, so the CLI announced "unknown flag --org (took value
+// …)" and then switched organisation anyway. A user who believed the warning
+// and dropped the flag would have written to whatever org the config pointed
+// at (ImmoPilot, 2026-08-22).
+export const DISPATCH_FLAGS = new Set([
+    ...Object.keys(GLOBAL_FLAGS),
+    ...SHORT_ALIASES,
+]);
 // `quiet` suppresses the unknown-flag note. The dispatcher parses twice — once
 // to learn the command, once under that command's own schema — and only the
 // second pass knows which flags are genuinely foreign, so the first must stay

package/dist/flags.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { parseFlags } from './flags.js';
+import { parseFlags, GLOBAL_FLAGS, DISPATCH_FLAGS } from './flags.js';
 const SCHEMA = {
     org: 'string',
     name: 'string',
@@ -190,3 +190,29 @@ describe('parseFlags — repeated flags are never silently collapsed', () => {
         expect(flags.name).toBe('prod');
     });
 });
+// ImmoPilot, 2026-08-22: `--org` was honoured while being announced as an
+// unknown flag, because the dispatcher's tolerated-flag list and the parser's
+// typed-flag list were maintained separately and disagreed. DISPATCH_FLAGS is
+// now derived from GLOBAL_FLAGS, so this asserts the derivation holds rather
+// than re-checking a hand-written list.
+describe('global flag lists cannot drift', () => {
+    it('every globally-typed flag is tolerated by the dispatcher', () => {
+        for (const key of Object.keys(GLOBAL_FLAGS)) {
+            expect(DISPATCH_FLAGS.has(key)).toBe(true);
+        }
+    });
+    it('org is typed globally, so every command refuses a duplicate', () => {
+        // Ten commands declared `org` in their own schema and got this guard; the
+        // other nineteen silently kept the last value. Parse with an empty schema
+        // to stand in for a command that declares nothing of its own.
+        expect(() => parseFlags(['--org', 'ORG_A', '--org', 'ORG_B'], {}, true)).toThrow(/--org was given more than once/);
+    });
+    it('a single --org still parses to its value under an empty schema', () => {
+        const { flags } = parseFlags(['--org', 'ORG_A'], {}, true);
+        expect(flags.org).toBe('ORG_A');
+    });
+    it('--org is not reported as a foreign flag', () => {
+        const { unknownFlags } = parseFlags(['--org', 'ORG_A'], {}, true);
+        expect(unknownFlags ?? []).not.toContain('--org');
+    });
+});

package/dist/index.js

@@ -5,7 +5,7 @@ import { MyApiError, setUserAgent, hq } from '@myapihq/sdk';
 import { friendlyError } from './errors.js';
 import { currentOrg, adoptSoleOrg } from './helpers.js';
 import * as fs from 'fs';
-import { parseFlags } from './flags.js';
+import { parseFlags, DISPATCH_FLAGS } from './flags.js';
 const pkgPath = new URL('../package.json', import.meta.url);
 const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
 // Identify the CLI (and its version) on every outbound request. Without this
@@ -100,8 +100,7 @@ const COMMAND_SCHEMAS = {
     webhook: webhookCmd.SCHEMA,
     workflow: workflowCmd.SCHEMA,
 };
-// Flags the dispatcher itself consumes, valid on any command.
-const DISPATCH_FLAGS = new Set(['help', 'h', 'json', 'verbose', 'yes', 'y', 'version', 'v', 'V', 'org']);
+// Flags the dispatcher itself consumes are derived from GLOBAL_FLAGS in flags.ts.
 function warnForeignFlags(command, flags) {
     if (!command || process.env.MYAPI_QUIET_UNKNOWN_FLAGS)
         return;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.31.1",
+  "version": "2.31.2",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -47,7 +47,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.31.1"
+    "@myapihq/sdk": "^2.31.2"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",