@openbat/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,1221 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+
+// src/index.ts
+var import_commander6 = require("commander");
+
+// src/commands/config.ts
+var import_commander = require("commander");
+
+// src/config.ts
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var CONFIG_PATH = (0, import_node_path.join)((0, import_node_os.homedir)(), ".openbatrc");
+var DEFAULT_BASE_URL = "https://app.openbat.com";
+async function readConfig() {
+  try {
+    const st = (0, import_node_fs.statSync)(CONFIG_PATH);
+    if ((st.mode & 63) !== 0) {
+      try {
+        (0, import_node_fs.chmodSync)(CONFIG_PATH, 384);
+      } catch {
+        process.stderr.write(
+          "warning: ~/.openbatrc has loose permissions (not 0600). Run `chmod 600 ~/.openbatrc`.\n"
+        );
+      }
+    }
+    const raw = await import_node_fs.promises.readFile(CONFIG_PATH, "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw err;
+  }
+}
+async function writeConfig(cfg) {
+  const json = JSON.stringify(cfg, null, 2);
+  await import_node_fs.promises.writeFile(CONFIG_PATH, json + "\n", { mode: 384 });
+}
+async function resolveConfig(opts) {
+  const file = await readConfig();
+  let apiKey = null;
+  let apiKeySource = "missing";
+  if (opts.apiKeyFlag) {
+    apiKey = opts.apiKeyFlag;
+    apiKeySource = "flag";
+  } else if (process.env.OPENBAT_API_KEY) {
+    apiKey = process.env.OPENBAT_API_KEY;
+    apiKeySource = "env";
+  } else if (file.apiKey) {
+    apiKey = file.apiKey;
+    apiKeySource = "file";
+  }
+  let baseUrl = DEFAULT_BASE_URL;
+  let baseUrlSource = "default";
+  if (opts.baseUrlFlag) {
+    baseUrl = opts.baseUrlFlag;
+    baseUrlSource = "flag";
+  } else if (process.env.OPENBAT_BASE_URL) {
+    baseUrl = process.env.OPENBAT_BASE_URL;
+    baseUrlSource = "env";
+  } else if (file.baseUrl) {
+    baseUrl = file.baseUrl;
+    baseUrlSource = "file";
+  }
+  return { apiKey, baseUrl, apiKeySource, baseUrlSource };
+}
+async function setApiKey(apiKey) {
+  if (apiKey.startsWith("ob_live_")) {
+    throw new Error(
+      "This looks like an ingest key (ob_live_\u2026). The CLI uses Read / Admin / PAT keys \u2014 generate one in Settings \u2192 API Keys."
+    );
+  }
+  if (!/^ob_(?:read|admin|pat)_[0-9a-f]{32}$/.test(apiKey)) {
+    throw new Error(
+      "That doesn't look like a valid OpenBat key. Expected format: ob_(read|admin|pat)_<32 hex chars>."
+    );
+  }
+  const file = await readConfig();
+  file.apiKey = apiKey;
+  await writeConfig(file);
+}
+async function setBaseUrl(baseUrl) {
+  try {
+    new URL(baseUrl);
+  } catch {
+    throw new Error(`Invalid URL: ${baseUrl}`);
+  }
+  const file = await readConfig();
+  file.baseUrl = baseUrl;
+  await writeConfig(file);
+}
+function configPath() {
+  return CONFIG_PATH;
+}
+
+// src/format.ts
+var ANSI = {
+  dim: "\x1B[2m",
+  bold: "\x1B[1m",
+  reset: "\x1B[0m"
+};
+function emit(value, opts = {}) {
+  if (opts.json || !process.stdout.isTTY) {
+    process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+    return;
+  }
+  process.stdout.write(prettyPrint(value) + "\n");
+}
+function prettyPrint(value) {
+  if (value === null || value === void 0) return "(empty)";
+  if (Array.isArray(value)) return prettyArray(value);
+  if (typeof value === "object") return prettyObject(value);
+  return String(value);
+}
+function prettyObject(obj) {
+  const lines = [];
+  const keyWidth = Math.max(...Object.keys(obj).map((k) => k.length), 0);
+  for (const [k, v] of Object.entries(obj)) {
+    const padded = k.padEnd(keyWidth);
+    const rendered = v === null ? `${ANSI.dim}null${ANSI.reset}` : typeof v === "object" ? indent(prettyPrint(v), keyWidth + 2) : String(v);
+    lines.push(`${ANSI.bold}${padded}${ANSI.reset}  ${rendered}`);
+  }
+  return lines.join("\n");
+}
+function prettyArray(arr) {
+  if (arr.length === 0) return `${ANSI.dim}(no rows)${ANSI.reset}`;
+  const first = arr[0];
+  if (first && typeof first === "object" && !Array.isArray(first)) {
+    const keys = Object.keys(first);
+    const isFlat = arr.every(
+      (row) => row && typeof row === "object" && !Array.isArray(row) && keys.every((k) => {
+        const v = row[k];
+        return v === null || ["string", "number", "boolean"].includes(typeof v);
+      })
+    );
+    if (isFlat) return renderTable(arr, keys);
+  }
+  return arr.map((row) => prettyPrint(row)).join("\n---\n");
+}
+function renderTable(rows, keys) {
+  const cellAt = (row, k) => {
+    const v = row[k];
+    if (v === null || v === void 0) return "\u2014";
+    return String(v);
+  };
+  const widths = keys.map(
+    (k) => Math.max(k.length, ...rows.map((r) => cellAt(r, k).length))
+  );
+  const header = keys.map((k, i) => `${ANSI.bold}${k.padEnd(widths[i])}${ANSI.reset}`).join("  ");
+  const sep = widths.map((w) => "\u2500".repeat(w)).join("  ");
+  const body = rows.map(
+    (row) => keys.map((k, i) => cellAt(row, k).padEnd(widths[i])).join("  ")
+  ).join("\n");
+  return `${header}
+${ANSI.dim}${sep}${ANSI.reset}
+${body}`;
+}
+function indent(s, columns) {
+  const pad = " ".repeat(columns);
+  return s.split("\n").map((line, i) => i === 0 ? line : pad + line).join("\n");
+}
+function fatal(msg) {
+  process.stderr.write(`error: ${msg}
+`);
+  process.exit(1);
+}
+
+// src/commands/config.ts
+function configCommand() {
+  const cmd = new import_commander.Command("config").description(
+    "Manage the CLI's ~/.openbatrc settings"
+  );
+  cmd.command("set-key").description("Store your Read API key in ~/.openbatrc").option("--from-stdin", "Read the key from stdin (default and recommended)", true).option(
+    "--value <key>",
+    "Pass the key inline. Discouraged \u2014 leaks into shell history."
+  ).action(async (opts) => {
+    try {
+      let key;
+      if (opts.value) {
+        key = opts.value.trim();
+      } else {
+        const chunks = [];
+        for await (const chunk of process.stdin) {
+          chunks.push(chunk);
+        }
+        key = Buffer.concat(chunks).toString("utf8").trim();
+        if (!key) {
+          fatal(
+            "No key on stdin. Try: echo 'ob_read_...' | openbat config set-key --from-stdin"
+          );
+        }
+      }
+      await setApiKey(key);
+      process.stdout.write(
+        `Saved Read key to ${configPath()} (mode 0600).
+`
+      );
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("set-url <baseUrl>").description(
+    "Override the OpenBat API base URL (default: https://app.openbat.com)"
+  ).action(async (baseUrl) => {
+    try {
+      await setBaseUrl(baseUrl);
+      process.stdout.write(`Saved base URL: ${baseUrl}
+`);
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("show").description("Show the current resolved config (key prefix only)").action(async () => {
+    const cfg = await resolveConfig({});
+    const keyDisplay = cfg.apiKey ? `${cfg.apiKey.slice(0, 16)}\u2026<hidden>` : "(not set)";
+    emit({
+      apiKey: keyDisplay,
+      apiKeySource: cfg.apiKeySource,
+      baseUrl: cfg.baseUrl,
+      baseUrlSource: cfg.baseUrlSource,
+      configFile: configPath()
+    });
+  });
+  return cmd;
+}
+
+// src/commands/data.ts
+var import_commander2 = require("commander");
+
+// src/api-client.ts
+var import_node_url = require("url");
+var KEY_REGEX = /ob_(?:live|read|admin|pat)_[0-9a-f]{32}/g;
+function redact(s) {
+  return s.replace(KEY_REGEX, (k) => `${k.slice(0, 16)}\u2026<hidden>`);
+}
+function assertHttpsOrLocalhost(baseUrl) {
+  let url;
+  try {
+    url = new import_node_url.URL(baseUrl);
+  } catch {
+    throw new Error(`Invalid base URL: ${redact(baseUrl)}`);
+  }
+  if (url.protocol === "https:") return;
+  if (url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1")) {
+    return;
+  }
+  throw new Error(
+    "Refusing to use a non-HTTPS base URL. localhost / 127.0.0.1 are allowed for dev."
+  );
+}
+var _apiKey, _ApiClient_instances, mutate_fn;
+var ApiClient = class {
+  constructor(opts) {
+    __privateAdd(this, _ApiClient_instances);
+    __privateAdd(this, _apiKey);
+    assertHttpsOrLocalhost(opts.baseUrl);
+    this.baseUrl = opts.baseUrl.replace(/\/$/, "");
+    __privateSet(this, _apiKey, opts.apiKey);
+  }
+  /**
+   * Issue a GET against `path` (must begin with `/`). Returns the parsed
+   * JSON on 200. Throws an Error whose message is safe to print (key
+   * redacted, status included).
+   */
+  async get(path) {
+    const url = `${this.baseUrl}${path}`;
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "GET",
+        headers: {
+          "x-openbat-key": __privateGet(this, _apiKey),
+          accept: "application/json"
+        }
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new Error(`Request to ${redact(url)} failed: ${redact(msg)}`);
+    }
+    return parseResponse(res, url);
+  }
+  /** Issue a POST with a JSON body. */
+  async post(path, body) {
+    return __privateMethod(this, _ApiClient_instances, mutate_fn).call(this, "POST", path, body);
+  }
+  /** Issue a PATCH with a JSON body. */
+  async patch(path, body) {
+    return __privateMethod(this, _ApiClient_instances, mutate_fn).call(this, "PATCH", path, body);
+  }
+  /** Issue a DELETE. Body is rarely used; we still allow it. */
+  async delete(path, body) {
+    return __privateMethod(this, _ApiClient_instances, mutate_fn).call(this, "DELETE", path, body);
+  }
+  /** Pass-through for streaming endpoints (export). Returns the raw body. */
+  async getRaw(path) {
+    const url = `${this.baseUrl}${path}`;
+    const res = await fetch(url, {
+      method: "GET",
+      headers: {
+        "x-openbat-key": __privateGet(this, _apiKey)
+      }
+    });
+    if (!res.ok || !res.body) {
+      const errText = await res.text().catch(() => "");
+      throw new Error(
+        `GET ${redact(url)} \u2192 ${res.status} ${res.statusText}${errText ? `: ${redact(errText.slice(0, 200))}` : ""}`
+      );
+    }
+    return {
+      body: res.body,
+      contentType: res.headers.get("content-type") ?? "application/octet-stream"
+    };
+  }
+};
+_apiKey = new WeakMap();
+_ApiClient_instances = new WeakSet();
+mutate_fn = async function(method, path, body) {
+  const url = `${this.baseUrl}${path}`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers: {
+        "x-openbat-key": __privateGet(this, _apiKey),
+        "content-type": "application/json",
+        accept: "application/json"
+      },
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`Request to ${redact(url)} failed: ${redact(msg)}`);
+  }
+  return parseResponse(res, url);
+};
+async function parseResponse(res, url) {
+  if (res.status === 401) {
+    throw new Error(
+      "Unauthorized. The API key was rejected (invalid, wrong kind for this endpoint, expired, or revoked)."
+    );
+  }
+  if (res.status === 403) {
+    throw new Error(
+      "Forbidden. The credential is valid but lacks permission for this operation (e.g. read-scope PAT can't mutate)."
+    );
+  }
+  if (res.status === 429) {
+    const retry = res.headers.get("retry-after");
+    throw new Error(
+      `Rate limited.${retry ? ` Retry after ${retry}s.` : ""}`
+    );
+  }
+  if (!res.ok) {
+    let errBody = null;
+    try {
+      errBody = await res.json();
+    } catch {
+    }
+    throw new Error(
+      `GET ${redact(url)} \u2192 ${res.status} ${res.statusText}${errBody?.error ? `: ${redact(errBody.error)}` : ""}`
+    );
+  }
+  try {
+    return await res.json();
+  } catch {
+    throw new Error(`Response from ${redact(url)} was not valid JSON`);
+  }
+}
+
+// src/commands/data.ts
+async function client(globals) {
+  const cfg = await resolveConfig({
+    apiKeyFlag: globals.apiKey ?? null,
+    baseUrlFlag: globals.baseUrl ?? null
+  });
+  if (!cfg.apiKey) {
+    fatal(
+      "No API key configured. Run `openbat config set-key`, or pass --api-key, or set OPENBAT_API_KEY."
+    );
+  }
+  return new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+}
+function formatOpts(cmd) {
+  const opts = cmd.optsWithGlobals();
+  return { json: !!opts.json };
+}
+function chatbotCommand() {
+  const cmd = new import_commander2.Command("chatbot").description(
+    "Inspect the chatbot bound to this API key"
+  );
+  cmd.command("info").description("Show the chatbot the current API key authorizes").action(async function() {
+    try {
+      const c = await client(this.optsWithGlobals());
+      const result = await c.get(
+        "/api/v1/chatbots"
+      );
+      const list = result.chatbots ?? [];
+      emit(list[0] ?? null, formatOpts(this));
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function conversationsCommand() {
+  const cmd = new import_commander2.Command("conversations").description(
+    "Browse conversations"
+  );
+  cmd.command("list").description("Page through recent conversations").option("--page <n>", "Page number", "1").option("--limit <n>", "Page size (max 100)", "20").action(async function(opts) {
+    try {
+      const c = await client(this.optsWithGlobals());
+      const params = new URLSearchParams({
+        page: opts.page,
+        limit: opts.limit
+      });
+      const result = await c.get(`/api/v1/conversations?${params}`);
+      if (this.optsWithGlobals().json) {
+        emit(result, { json: true });
+      } else {
+        emit(result.conversations, formatOpts(this));
+        process.stderr.write(
+          `
+Total: ${result.total}, page ${opts.page}, limit ${opts.limit}
+`
+        );
+      }
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("show <id>").description("Show one conversation by id, with messages").action(async function(id) {
+    try {
+      const c = await client(this.optsWithGlobals());
+      const result = await c.get(
+        `/api/v1/conversations/${encodeURIComponent(id)}`
+      );
+      emit(result.conversation, formatOpts(this));
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function analyticsCommand() {
+  const cmd = new import_commander2.Command("analytics").description(
+    "Aggregated analytics for the bound chatbot"
+  );
+  cmd.command("overview").description("Total conversations, messages, sentiment distribution").action(async function() {
+    try {
+      const c = await client(this.optsWithGlobals());
+      const result = await c.get(
+        "/api/v1/analytics/overview"
+      );
+      emit(result, formatOpts(this));
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("sentiment").description("Sentiment over time (default last 30 days)").option("--days <n>", "Look-back window in days", "30").action(async function(opts) {
+    try {
+      const c = await client(this.optsWithGlobals());
+      const params = new URLSearchParams({ days: opts.days });
+      const result = await c.get(
+        `/api/v1/analytics/sentiment?${params}`
+      );
+      emit(result, formatOpts(this));
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function exportCommand() {
+  const cmd = new import_commander2.Command("export").description("Dump all conversation data for the bound chatbot").option("--format <fmt>", "json or csv", "json").option("--out <path>", "Write to file (defaults to stdout)").action(async function(opts) {
+    try {
+      const c = await client(this.optsWithGlobals());
+      const info = await c.get(
+        "/api/v1/chatbots"
+      );
+      const id = info.chatbots[0]?.id;
+      if (!id) fatal("Could not resolve chatbot from API key.");
+      const format = opts.format === "csv" ? "csv" : "json";
+      const { body } = await c.getRaw(
+        `/api/v1/export/${id}?format=${format}`
+      );
+      if (opts.out) {
+        const { createWriteStream } = await import("fs");
+        const { Writable } = await import("stream");
+        const { Readable } = await import("stream");
+        const file = createWriteStream(opts.out);
+        const nodeReadable = Readable.fromWeb(
+          body
+        );
+        await new Promise((resolve, reject) => {
+          nodeReadable.pipe(file);
+          file.on("finish", () => resolve());
+          file.on("error", (e) => reject(e));
+        });
+        process.stderr.write(`Wrote ${opts.out}
+`);
+      } else {
+        const reader = body.getReader();
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          process.stdout.write(value);
+        }
+      }
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+
+// src/commands/auth.ts
+var import_commander3 = require("commander");
+async function client2(globals) {
+  const cfg = await resolveConfig({
+    apiKeyFlag: globals.apiKey ?? null,
+    baseUrlFlag: globals.baseUrl ?? null
+  });
+  if (!cfg.apiKey) {
+    fatal(
+      "No API key configured. Run `openbat config set-key`, pass --api-key, or set OPENBAT_API_KEY."
+    );
+  }
+  return new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+}
+function detectKind(apiKey) {
+  if (apiKey.startsWith("ob_read_")) return "read";
+  if (apiKey.startsWith("ob_admin_")) return "admin";
+  if (apiKey.startsWith("ob_pat_")) return "pat";
+  return "unknown";
+}
+function authCommand() {
+  const cmd = new import_commander3.Command("auth").description(
+    "Inspect the current credential's scope and audit history"
+  );
+  cmd.command("whoami").description("Print the credential kind, target chatbots / orgs").action(async function() {
+    try {
+      const globals = this.optsWithGlobals();
+      const cfg = await resolveConfig({
+        apiKeyFlag: globals.apiKey ?? null,
+        baseUrlFlag: globals.baseUrl ?? null
+      });
+      if (!cfg.apiKey) fatal("No API key configured.");
+      const kind = detectKind(cfg.apiKey);
+      const c = new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+      if (kind === "pat") {
+        const orgs = await c.get("/api/v1/orgs");
+        const chatbots = await c.get(
+          "/api/v1/chatbots"
+        );
+        emit(
+          {
+            kind,
+            keyPrefix: `${cfg.apiKey.slice(0, 16)}\u2026<hidden>`,
+            orgs: orgs.orgs,
+            chatbots: chatbots.chatbots
+          },
+          { json: !!globals.json }
+        );
+      } else {
+        const chatbots = await c.get(
+          "/api/v1/chatbots"
+        );
+        emit(
+          {
+            kind,
+            keyPrefix: `${cfg.apiKey.slice(0, 16)}\u2026<hidden>`,
+            chatbots: chatbots.chatbots
+          },
+          { json: !!globals.json }
+        );
+      }
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("audit-log").description("Show recent audit-log entries for the current user").option("--days <n>", "Look-back window in days", "7").action(async function() {
+    try {
+      process.stderr.write(
+        "audit-log: endpoint not yet exposed via HTTP \u2014 query `select * from api_audit_log` in Supabase Studio for now.\n"
+      );
+      const _c = await client2(this.optsWithGlobals());
+      void _c;
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+
+// src/commands/org.ts
+var import_commander4 = require("commander");
+async function client3(globals) {
+  const cfg = await resolveConfig({
+    apiKeyFlag: globals.apiKey ?? null,
+    baseUrlFlag: globals.baseUrl ?? null
+  });
+  if (!cfg.apiKey) {
+    fatal("No API key configured. Run `openbat config set-key`.");
+  }
+  if (!cfg.apiKey.startsWith("ob_pat_")) {
+    fatal("Org commands require a PAT key (ob_pat_\u2026). Set one with `openbat config set-key`.");
+  }
+  return new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+}
+function orgCommand() {
+  const cmd = new import_commander4.Command("org").description(
+    "Manage the OpenBat tenant org (rename, members, invitations). Requires PAT."
+  );
+  cmd.command("list").description("List orgs the current PAT's user belongs to").action(async function() {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client3(globals);
+      const result = await c.get("/api/v1/orgs");
+      emit(result.orgs, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("show").description("Show the active org (id, name, members)").action(async function() {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client3(globals);
+      const result = await c.get(
+        "/api/v1/orgs/active"
+      );
+      emit(
+        { org: result.org, members: result.members },
+        { json: !!globals.json }
+      );
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("rename").description("Rename an org (owner only)").requiredOption("--id <orgId>", "Org id").requiredOption("--name <name>", "New name").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client3(globals);
+      await c.patch(`/api/v1/orgs/${opts.id}`, { name: opts.name });
+      emit({ ok: true, renamed: opts.id }, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  const members = cmd.command("members").description("Manage org members");
+  members.command("list").requiredOption("--id <orgId>", "Org id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client3(globals);
+      const result = await c.get(
+        `/api/v1/orgs/${opts.id}/members`
+      );
+      emit(result.members, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  members.command("invite").requiredOption("--id <orgId>", "Org id").requiredOption("--email <email>", "Invitee email").option("--role <role>", "member | admin", "member").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client3(globals);
+      const result = await c.post(
+        `/api/v1/orgs/${opts.id}/members`,
+        { email: opts.email, role: opts.role }
+      );
+      if (!result.emailSent) {
+        process.stderr.write(
+          "[note] invitation row created \u2014 but the invitation email is currently sent only via the dashboard flow. Wire-up tracked as a follow-up.\n"
+        );
+      }
+      emit(result.invitation, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  members.command("set-role").requiredOption("--id <orgId>", "Org id").requiredOption("--member <memberId>", "Member id").requiredOption("--role <role>", "admin | member").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client3(globals);
+      await c.patch(`/api/v1/orgs/${opts.id}/members/${opts.member}`, {
+        role: opts.role
+      });
+      emit({ ok: true }, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  members.command("remove").requiredOption("--id <orgId>", "Org id").requiredOption("--member <memberId>", "Member id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client3(globals);
+      await c.delete(`/api/v1/orgs/${opts.id}/members/${opts.member}`);
+      emit({ ok: true }, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  const invitations = cmd.command("invitations").description("Manage pending invitations");
+  invitations.command("list").requiredOption("--id <orgId>", "Org id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client3(globals);
+      const result = await c.get(
+        `/api/v1/orgs/${opts.id}/invitations`
+      );
+      emit(result.invitations, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+
+// src/commands/write.ts
+var import_commander5 = require("commander");
+async function client4(globals) {
+  const cfg = await resolveConfig({
+    apiKeyFlag: globals.apiKey ?? null,
+    baseUrlFlag: globals.baseUrl ?? null
+  });
+  if (!cfg.apiKey) {
+    fatal("No API key configured. Run `openbat config set-key`.");
+  }
+  return new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+}
+function surfacePlaintext(plaintext, label) {
+  process.stderr.write(
+    `
+\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  ${label} (shown ONCE \u2014 store this now)
+
+  ${plaintext}
+\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+`
+  );
+}
+function chatbotsCommand() {
+  const cmd = new import_commander5.Command("chatbots").description(
+    "List, create, delete chatbots in the current scope"
+  );
+  cmd.command("list").description("List every chatbot the credential can reach").action(async function() {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.get(
+        "/api/v1/chatbots"
+      );
+      emit(result.chatbots, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("create").description("Create a new chatbot (PAT scope required)").requiredOption("--name <name>", "Chatbot name").option("--website <url>").option("--docs-url <url>").option("--mcp-url <url>").option("--language <code>", "Primary language code (default: en)", "en").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.post("/api/v1/chatbots", {
+        name: opts.name,
+        websiteUrl: opts.website,
+        docsUrl: opts.docsUrl,
+        mcpUrl: opts.mcpUrl,
+        primaryLanguage: opts.language
+      });
+      surfacePlaintext(result.ingestApiKey, "Ingest API key (ob_live_*)");
+      emit(
+        { chatbot: result.chatbot, dashboardUrl: result.dashboardUrl },
+        { json: !!globals.json }
+      );
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("delete <chatbotId>").description("Delete a chatbot (irreversible \u2014 cascade-deletes everything)").action(async function(chatbotId) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      await c.delete(`/api/v1/chatbots/${chatbotId}`);
+      emit({ ok: true, deleted: chatbotId }, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function webhooksCommand() {
+  const cmd = new import_commander5.Command("webhooks").description("Manage webhooks for a chatbot");
+  cmd.command("list").requiredOption("--chatbot <id>", "Chatbot id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.get(
+        `/api/v1/chatbots/${opts.chatbot}/webhooks`
+      );
+      emit(result.webhooks, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("create").requiredOption("--chatbot <id>", "Chatbot id").requiredOption("--name <name>").requiredOption("--url <url>").option("--type <type>", "discord | slack | custom", "custom").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.post(`/api/v1/chatbots/${opts.chatbot}/webhooks`, {
+        name: opts.name,
+        url: opts.url,
+        type: opts.type
+      });
+      surfacePlaintext(result.webhook.signing_secret, "Webhook signing secret");
+      emit(result.webhook, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("delete").requiredOption("--chatbot <id>", "Chatbot id").requiredOption("--webhook <id>", "Webhook id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      await c.delete(`/api/v1/chatbots/${opts.chatbot}/webhooks/${opts.webhook}`);
+      emit({ ok: true, deleted: opts.webhook }, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function settingsCommand() {
+  const cmd = new import_commander5.Command("settings").description(
+    "Manage chatbot settings + per-chatbot keys"
+  );
+  const keys = cmd.command("keys").description("Manage API keys for a chatbot");
+  keys.command("rotate-ingest").requiredOption("--chatbot <id>", "Chatbot id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.post(
+        `/api/v1/chatbots/${opts.chatbot}/keys/ingest/rotate`,
+        {}
+      );
+      surfacePlaintext(result.plaintext, "New ingest key (ob_live_*)");
+      emit({ prefix: result.prefix }, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  keys.command("generate-read").requiredOption("--chatbot <id>", "Chatbot id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.post(
+        `/api/v1/chatbots/${opts.chatbot}/keys/read`,
+        {}
+      );
+      surfacePlaintext(result.plaintext, "New read key (ob_read_*)");
+      emit({ prefix: result.prefix }, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  keys.command("generate-admin").requiredOption("--chatbot <id>", "Chatbot id").requiredOption("--name <name>", "Human-friendly name (e.g. 'CI key')").option("--expires-in-days <n>", "Auto-expire after N days").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.post(`/api/v1/chatbots/${opts.chatbot}/admin-keys`, {
+        name: opts.name,
+        expiresInDays: opts.expiresInDays ? Number(opts.expiresInDays) : void 0
+      });
+      surfacePlaintext(result.plaintext, "New admin key (ob_admin_*)");
+      emit(result.key, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  keys.command("list-admin").requiredOption("--chatbot <id>", "Chatbot id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.get(
+        `/api/v1/chatbots/${opts.chatbot}/admin-keys`
+      );
+      emit(result.keys, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  keys.command("revoke-admin").requiredOption("--chatbot <id>", "Chatbot id").requiredOption("--key <keyId>", "Admin key id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      await c.delete(`/api/v1/chatbots/${opts.chatbot}/admin-keys/${opts.key}`);
+      emit({ ok: true, revoked: opts.key }, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("update").description("Patch a chatbot's settings JSONB").requiredOption("--chatbot <id>", "Chatbot id").option("--description <text>").option("--website-url <url>").option("--language <code>").action(async function(opts) {
+    try {
+      const settings = {};
+      if (opts.description) settings.description = opts.description;
+      if (opts.websiteUrl) settings.website_url = opts.websiteUrl;
+      if (opts.language) settings.primaryLanguage = opts.language;
+      if (Object.keys(settings).length === 0) {
+        fatal("Provide at least one setting to update.");
+      }
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      await c.patch(`/api/v1/chatbots/${opts.chatbot}/settings`, { settings });
+      emit({ ok: true }, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function workflowsCommand() {
+  const cmd = new import_commander5.Command("workflows").description("Manage workflows");
+  cmd.command("list").requiredOption("--chatbot <id>", "Chatbot id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.get(
+        `/api/v1/chatbots/${opts.chatbot}/workflows`
+      );
+      emit(result.workflows, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("create").description("Create a workflow from a built-in template").requiredOption("--chatbot <id>", "Chatbot id").requiredOption("--name <name>").requiredOption(
+    "--template <name>",
+    "flag-to-webhook | outcome-to-webhook | sentiment-drop-to-webhook"
+  ).requiredOption(
+    "--trigger-value <v>",
+    "Flag value / outcome value / sentiment threshold"
+  ).requiredOption("--webhook <id>", "Webhook id to fire").option("--message <tpl>", "Message template (supports {{user.id}}, etc.)").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.post(`/api/v1/chatbots/${opts.chatbot}/workflows`, {
+        name: opts.name,
+        template: opts.template,
+        triggerValue: opts.triggerValue,
+        webhookId: opts.webhook,
+        messageTemplate: opts.message
+      });
+      emit(result, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function reportsCommand() {
+  const cmd = new import_commander5.Command("reports").description("Manage AI reports");
+  cmd.command("list").requiredOption("--chatbot <id>", "Chatbot id").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.get(
+        `/api/v1/chatbots/${opts.chatbot}/reports`
+      );
+      emit(result.reports, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("create").description("Create a new AI report; returns the org-private dashboard URL").requiredOption("--chatbot <id>", "Chatbot id").option("--name <name>", "Report name", "Untitled Report").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.post(`/api/v1/chatbots/${opts.chatbot}/reports`, { name: opts.name });
+      process.stderr.write(
+        `
+Created report. View it (org members only):
+  ${result.dashboardUrl}
+
+`
+      );
+      emit(
+        { report: result.report, dashboardUrl: result.dashboardUrl },
+        { json: !!globals.json }
+      );
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function analysisCommand() {
+  const cmd = new import_commander5.Command("analysis").description("Manage analysis definitions");
+  cmd.command("list").requiredOption("--chatbot <id>", "Chatbot id").option("--type <t>", "intent | flag | assistant_outcome | assistant_issue").option("--pending", "Include pending suggestions").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const qs = new URLSearchParams();
+      if (opts.type) qs.set("type", opts.type);
+      if (opts.pending) qs.set("pending", "true");
+      const result = await c.get(
+        `/api/v1/chatbots/${opts.chatbot}/analysis-definitions${qs.size ? `?${qs}` : ""}`
+      );
+      emit(result.definitions, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("add").requiredOption("--chatbot <id>", "Chatbot id").requiredOption(
+    "--type <t>",
+    "intent | flag | assistant_outcome | assistant_issue"
+  ).requiredOption("--name <slug>", "snake_case slug").requiredOption("--display-name <text>").requiredOption("--description <text>").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const result = await c.post(
+        `/api/v1/chatbots/${opts.chatbot}/analysis-definitions`,
+        {
+          analysisType: opts.type,
+          name: opts.name,
+          displayName: opts.displayName,
+          description: opts.description
+        }
+      );
+      emit(result, { json: !!globals.json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function usersCommand() {
+  const cmd = new import_commander5.Command("users").description(
+    "List external users (chatbot customers) with health metrics"
+  );
+  cmd.command("list").requiredOption("--chatbot <id>", "Chatbot id").option("--from <iso>").option("--to <iso>").option("--days <n>", "Convenience: last N days").option("--search <q>").option("--limit <n>", "Page size", "20").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const qs = new URLSearchParams();
+      let from = opts.from;
+      if (!from && opts.days) {
+        from = new Date(
+          Date.now() - Number(opts.days) * 864e5
+        ).toISOString();
+      }
+      if (from) qs.set("from", from);
+      if (opts.to) qs.set("to", opts.to);
+      if (opts.search) qs.set("search", opts.search);
+      qs.set("limit", opts.limit);
+      const result = await c.get(
+        `/api/v1/chatbots/${opts.chatbot}/external-users?${qs}`
+      );
+      emit(result.users, { json: !!globals.json });
+      process.stderr.write(`
+Total: ${result.total}
+`);
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+function sdkCommand() {
+  const cmd = new import_commander5.Command("sdk").description(
+    "Help install and verify the OpenBat SDK in a target project"
+  );
+  cmd.command("install-instructions").description("Print markdown the calling agent can follow").option(
+    "--framework <name>",
+    "next | node | vercel-ai-sdk (default: next)",
+    "next"
+  ).option("--chatbot <id>", "Chatbot id (for the example snippet)").action(async function(opts) {
+    const chatbotId = opts.chatbot ?? "<chatbotId>";
+    const snippetNext = `
+1. Install the SDK:
+
+   \`\`\`bash
+   npm install @openbat/sdk
+   \`\`\`
+
+2. Add the ingest key to \`.env.local\` (mode 0600):
+
+   \`\`\`
+   OPENBAT_API_KEY=ob_live_\u2026
+   \`\`\`
+
+3. Capture conversations after each LLM turn (e.g. in your Next.js
+   API route or server action):
+
+   \`\`\`ts
+   import { OpenBat } from "@openbat/sdk";
+
+   const openbat = new OpenBat({
+     apiKey: process.env.OPENBAT_API_KEY!,
+   });
+
+   await openbat.recordMessages({
+     conversationId, // your own stable id per conversation
+     user: { id: userId },
+     messages: [
+       { role: "user", content: userText },
+       { role: "assistant", content: assistantText },
+     ],
+   });
+   \`\`\`
+
+4. Verify with \`openbat sdk verify --chatbot ${chatbotId} --timeout 60\`.
+`;
+    const snippetWrapper = `
+1. \`npm install @openbat/sdk ai\`
+
+2. Wrap your AI SDK chat call:
+
+   \`\`\`ts
+   import { OpenBat, withOpenBat } from "@openbat/sdk";
+
+   const openbat = new OpenBat({ apiKey: process.env.OPENBAT_API_KEY! });
+
+   const result = await withOpenBat(openbat, { conversationId }, () =>
+     streamText({ model, messages, system }),
+   );
+   \`\`\`
+`;
+    const out = opts.framework === "vercel-ai-sdk" ? snippetWrapper : snippetNext;
+    process.stdout.write(out);
+  });
+  cmd.command("verify").description("Check whether any event has arrived for the chatbot yet").requiredOption("--chatbot <id>", "Chatbot id").option("--timeout <n>", "Seconds to wait (default: 60)", "60").action(async function(opts) {
+    try {
+      const globals = this.optsWithGlobals();
+      const c = await client4(globals);
+      const deadline = Date.now() + Number(opts.timeout) * 1e3;
+      while (Date.now() < deadline) {
+        try {
+          const result = await c.get(`/api/v1/conversations?limit=1`);
+          if (result.total > 0) {
+            process.stderr.write(
+              `\u2713 First event detected. ${result.total} conversation(s) ingested.
+`
+            );
+            return;
+          }
+        } catch {
+        }
+        await new Promise((r) => setTimeout(r, 2e3));
+      }
+      process.stderr.write(
+        `Timed out after ${opts.timeout}s \u2014 no events yet. Confirm OPENBAT_API_KEY and that recordMessages is being called.
+`
+      );
+      process.exit(2);
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+
+// src/index.ts
+var program = new import_commander6.Command();
+program.name("openbat").description(
+  "Query OpenBat chatbot data \u2014 conversations, sentiment, analytics, exports."
+).version("0.1.0").option("--api-key <key>", "Override the stored Read API key (footgun \u2014 leaks into shell history)").option(
+  "--base-url <url>",
+  "Override the OpenBat API base URL (defaults to ~/.openbatrc or https://app.openbat.com)"
+).option(
+  "--json",
+  "Emit raw JSON instead of the TTY-friendly pretty-print"
+);
+program.addCommand(configCommand());
+program.addCommand(authCommand());
+program.addCommand(orgCommand());
+program.addCommand(chatbotCommand());
+program.addCommand(chatbotsCommand());
+program.addCommand(conversationsCommand());
+program.addCommand(usersCommand());
+program.addCommand(settingsCommand());
+program.addCommand(webhooksCommand());
+program.addCommand(workflowsCommand());
+program.addCommand(reportsCommand());
+program.addCommand(analysisCommand());
+program.addCommand(analyticsCommand());
+program.addCommand(exportCommand());
+program.addCommand(sdkCommand());
+program.parseAsync().catch((err) => {
+  process.stderr.write(
+    `error: ${err instanceof Error ? err.message : String(err)}
+`
+  );
+  process.exit(1);
+});