@formo/cli 1.3.0 → 1.3.2

package/README.md

@@ -148,7 +148,8 @@ Merge-update identity properties on a wallet profile.
 
 | Option | Description |
 |---|---|
-| `--properties` | JSON object of properties to merge |
+| `--properties` | JSON object of properties to merge; use `null` to unset a property |
+| `--unset` | Comma-separated property keys to unset (`user_id` cannot be unset) |
 
 **Allowed property keys:** `user_id`, `display_name`, `email`, `farcaster`, `discord`, `twitter`, `telegram`, `instagram`, `website`, `github`, `linkedin`, `facebook`, `tiktok`, `youtube`, `reddit`, `avatar`, `description`, `location`, `ens`, `lens`, `basenames`, `linea`. Unknown keys are rejected server-side.
 
@@ -157,6 +158,8 @@ formo profiles update 0xd8dA... --properties '{"display_name":"Vitalik","twitter
 formo profiles update vitalik.eth --properties '{"email":"alice@example.com"}'
 ```
 
+`--unset` takes precedence over matching keys in `--properties`. Deletions also mask enriched fallback values and historical snapshot reads until a new value is set.
+
 > Requires `profiles:write` scope.
 
 ### `profiles properties batch`
@@ -265,7 +268,7 @@ Get a single board by ID.
 |---|---|
 | `--title` | Board title |
 | `--description` | Optional board description |
-| `--is-public` | Make the board publicly viewable |
+| `--is-public` | Make the board publicly viewable. Omit to keep it private (the default). |
 
 ```bash
 formo boards create --title "Revenue Metrics" --description "Weekly revenue tracking"
@@ -277,7 +280,7 @@ formo boards create --title "Revenue Metrics" --description "Weekly revenue trac
 |---|---|
 | `--title` | New board title |
 | `--description` | New board description |
-| `--is-public` | Update public visibility |
+| `--is-public` | Make the board publicly viewable. Omit to keep the stored setting; pass `--is-public=false` to make it private. |
 
 ### `boards delete <boardId>`
 Delete a board.
@@ -351,8 +354,8 @@ Get a single tracked contract.
 | `--name` | Human-readable contract name |
 | `--abi` | Contract ABI as a JSON string; sent stringified to the API |
 | `--events` | JSON array of ABI event objects to monitor |
-| `--start-block` | Optional start block |
-| `--include-in-pipeline` | Include this contract in the Goldsky events pipeline (`true` by default in the API) |
+| `--start-block` | Non-negative safe integer recorded on the contract; does not backfill historical events |
+| `--include-in-pipeline` | Deploy this contract to the events pipeline. Omit for decode-only (the default). |
 
 ```bash
 formo contracts create --address 0x1f9840a85d5af5bf1d1762f925bdaddc4201f984 --chain 1 \
@@ -367,8 +370,8 @@ formo contracts create --address 0x1f9840a85d5af5bf1d1762f925bdaddc4201f984 --ch
 | `--name` | Updated contract name |
 | `--abi` | Updated ABI |
 | `--events` | Updated JSON array of ABI event objects |
-| `--start-block` | Optional start block |
-| `--include-in-pipeline` | Include or exclude this contract from the Goldsky events pipeline |
+| `--start-block` | Non-negative safe integer recorded on the contract; does not backfill historical events |
+| `--include-in-pipeline` | Deploy this contract to the events pipeline. Omit to keep the stored setting; pass `--include-in-pipeline=false` to exclude it. |
 
 
 ### `contracts delete <chain> <address>`
@@ -435,6 +438,12 @@ formo analytics retention --filters '[{"field":"location","op":"eq","value":"US"
 
 On `kpis`, `top_*`, `revenue_*` and `volume_by_metric`, `--params '{"page_scope":"session"}'` widens a `page` filter from page-scoped metrics (the default) to the legacy session scope.
 
+On user-aggregate pipes such as `lifecycle` and `frequency`, either-touch attribution filters can use a `fields` pair in place of `field`, e.g. `{"fields":["first_utm_source","last_utm_source"],"op":"eq","value":"twitter"}`.
+
+Overview Data source filters use `field: "channel"` with `web`, `mobile`, `api`, `import`, `server`, or `onchain`; acquisition channel uses `channel_type`. User/lifecycle source filters use `source_filter` through `--params` with `field: "source"`.
+
+Retention defaults to rolling (active in week N or later); use `--params '{"retention_type":"recurring"}'` for activity in exactly week N. Funnel steps accept `events` OR alternatives with member-level `filters`; the primary `type`/`event` is always included and step-level `filters` apply to the whole group.
+
 All user-attribute, profile, social, lifecycle and resource predicates go in the single `--filters` array, using the canonical envelope with named qualifiers (`chain_id`, `app_id`, `token_address`, `scope`, `tag_id`). The retired per-family params — `socials`, `chain_filters`, `app_filters`, `token_filters`, `label_filters`, `profile_filters`, `lifecycle_filter` — are rejected with a `400` if passed through `--params`.
 
 ---
@@ -549,7 +558,7 @@ Every command supports the standard incur output flags:
 | `--verbose` | Include the full envelope (`ok`, `data`, `meta`) |
 | `--filter-output <keys>` | Filter output by key paths (e.g. `data,meta.duration`) |
 
-Every list endpoint returns a `PaginatedResponse<T>` envelope: `{ data: [...], total, page, size, has_more }`. Every error follows: `{ error: { code, message, doc_url, param?, details? } }` — branch on `error.code`, not `message`.
+Every list endpoint returns a `PaginatedResponse<T>` envelope: `{ data: [...], total, page, size, has_more }`. Most API errors follow: `{ error: { code, message, doc_url, param?, details? } }` — branch on `error.code` when available. Event-ingestion errors can be `{error:"..."}`, and rate-limit responses can be plain text; HTTP status is authoritative.
 
 ---
 

package/dist/commands/analytics.js

@@ -17,11 +17,11 @@ exports.analytics = incur_1.Cli.create('analytics', {
 const PIPES = [
     { name: 'kpis', description: 'Traffic KPIs: visitors, pageviews, bounce rate, session duration' },
     { name: 'event_timeseries', description: 'Event counts over time' },
-    { name: 'funnel', description: 'Conversion funnel across ordered steps. --params: steps (JSON array of {type,event,name,filters?}), window_seconds, funnel_type, group_by, limit, attribution' },
+    { name: 'funnel', description: 'Conversion funnel across ordered steps. --params: steps (JSON array of {type,event,name,filters?,events?}; events adds OR alternatives with member filters), window_seconds, funnel_type, group_by, limit, attribution' },
     { name: 'flow', description: 'User path/flow analysis. --params: start_step / end_step (JSON {type,event,...}), global_filters, window_seconds, max_steps' },
     { name: 'frequency', description: 'Engagement frequency distribution' },
-    { name: 'lifecycle', description: 'User lifecycle stages (new, returning, power, resurrected, churned)' },
-    { name: 'retention', description: 'Retention cohort analysis (params: id_type, event_type, event_name, min_users)' },
+    { name: 'lifecycle', description: 'User lifecycle stages (New, Returning, Power user, At Risk, Churned, Resurrected)' },
+    { name: 'retention', description: 'Retention cohort analysis (params: retention_type — rolling by default or recurring, id_type, event_type, event_name, min_users)' },
     { name: 'revenue_overview', description: 'Revenue overview with optional breakdown (params: group_by — incl. channel_type and paid_source for ad network, rank_by)' },
     { name: 'revenue_by_metric', description: 'Revenue ranked by a metric column (params: metric_column — incl. channel and paid_source for ad network, limit, offset)' },
     { name: 'revenue_timeseries', description: 'Revenue over time (params: address)' },
@@ -45,8 +45,11 @@ const RESERVED_PARAM_KEYS = new Set([
     'dateTo',
     'filters',
 ]);
-const ANALYTICS_FILTER_KEYS = new Set(['field', 'op', 'value', 'filters']);
-const ANALYTICS_NESTED_FILTER_KEYS = new Set(['field', 'op', 'value']);
+const ANALYTICS_FILTER_KEYS = new Set([
+    'field', 'fields', 'op', 'value', 'filters',
+    'chain_id', 'app_id', 'token_address', 'scope', 'tag_id',
+]);
+const ANALYTICS_NESTED_FILTER_KEYS = new Set(['field', 'fields', 'op', 'value']);
 function validateAnalyticsFilter(filter, path, allowNested) {
     if (!filter || typeof filter !== 'object' || Array.isArray(filter)) {
         throw new Error(`${path} must be a {field, op, value} object`);
@@ -59,11 +62,19 @@ function validateAnalyticsFilter(filter, path, allowNested) {
         ? ANALYTICS_FILTER_KEYS
         : ANALYTICS_NESTED_FILTER_KEYS;
     if (Object.keys(record).some((key) => !allowedKeys.has(key))) {
-        throw new Error(`${path} may only contain field, op, value${allowNested ? ', and filters' : ''}`);
+        throw new Error(`${path} may only contain field, op, value, fields${allowNested ? ', filters, and resource qualifiers (chain_id, app_id, token_address, scope, tag_id)' : ''}`);
+    }
+    if (record.field !== undefined && record.fields !== undefined) {
+        throw new Error(`${path} must use only one of field or fields`);
+    }
+    if (record.fields !== undefined && (!Array.isArray(record.fields) || record.fields.length !== 2 ||
+        !record.fields.every((field) => typeof field === 'string' && field.length > 0))) {
+        throw new Error(`${path}.fields must name exactly two non-empty columns`);
     }
-    if (typeof record.field !== 'string' || record.field.length === 0) {
-        throw new Error(`${path} requires a non-empty string "field"`);
+    if (record.fields === undefined && (typeof record.field !== 'string' || record.field.length === 0)) {
+        throw new Error(`${path} requires a non-empty string "field" or a "fields" pair`);
     }
+    (0, filters_1.validateQualifiers)(record, typeof record.field === 'string' ? record.field : '', path);
     if (!(0, filters_1.isCanonicalFilterOperator)(record.op)) {
         throw new Error(`${path} requires a canonical "op"`);
     }
@@ -163,7 +174,7 @@ const sharedOptions = incur_1.z.object({
         .string()
         .optional()
         .describe('JSON array of filter conditions: [{"field","op","value"}]. ' +
-        'Use op "in"/"nin" with an array value (e.g. ["chrome","firefox"]); pipe-delimited strings are also accepted. Array string members cannot contain "|".'),
+        'Use op "in"/"nin" with an array value (e.g. ["chrome","firefox"]); pipe-delimited strings are also accepted. Array string members cannot contain "|". Resource filters accept chain_id, app_id, token_address, scope, and tag_id qualifiers.'),
     params: incur_1.z
         .string()
         .optional()

package/dist/commands/contracts.js

@@ -22,6 +22,12 @@ function parseChain(chain) {
     }
     return value;
 }
+function parseStartBlock(value) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new Error('--start-block must be a non-negative safe integer');
+    }
+    return value;
+}
 // ── List contracts ──
 function listContractsRun(options = {}) {
     (0, client_1.requireApiKey)();
@@ -76,7 +82,7 @@ function buildCreateContractBody(options) {
         events: parsedEvents,
     };
     if (options.startBlock !== undefined)
-        body.start_block = options.startBlock;
+        body.start_block = parseStartBlock(options.startBlock);
     if (options.includeInPipeline !== undefined) {
         body.include_in_pipeline = options.includeInPipeline;
     }
@@ -129,7 +135,7 @@ function buildUpdateContractBody(chain, address, options) {
         events: parsedEvents,
     };
     if (options.startBlock !== undefined)
-        body.start_block = options.startBlock;
+        body.start_block = parseStartBlock(options.startBlock);
     if (options.includeInPipeline !== undefined) {
         body.include_in_pipeline = options.includeInPipeline;
     }

package/dist/commands/import.js

@@ -15,6 +15,8 @@ function buildImportBody(options) {
     }
     if (options.rows) {
         const rows = (0, json_1.parseJsonArrayOfObjects)(options.rows, '--rows');
+        if (rows.length === 0)
+            throw new Error('--rows must contain at least one wallet');
         const addresses = rows.map((row) => row.address);
         if (addresses.some((address) => typeof address !== 'string' || !address)) {
             throw new Error('--rows entries must each include a non-empty string address');
@@ -28,6 +30,8 @@ function buildImportBody(options) {
         throw new Error('Provide --addresses or --rows');
     }
     const addresses = (0, json_1.parseJsonArray)(options.addresses, '--addresses');
+    if (addresses.length === 0)
+        throw new Error('--addresses must contain at least one wallet');
     if (addresses.some((address) => typeof address !== 'string' || !address)) {
         throw new Error('--addresses must be a JSON array of wallet address strings');
     }

package/dist/commands/profiles.d.ts

@@ -35,7 +35,8 @@ export interface SearchProfilesOptions extends LifecycleThresholdOptions {
 export declare function parseSearchFilters(raw: string): unknown[];
 export declare function searchProfilesRun(options: SearchProfilesOptions): Promise<unknown>;
 export interface UpdateProfileOptions {
-    properties: string;
+    properties?: string;
+    unset?: string;
 }
 export declare function buildUpdateProfileBody(options: UpdateProfileOptions): Record<string, unknown>;
 export declare function updateProfileRun(address: string, options: UpdateProfileOptions): Promise<unknown>;

package/dist/commands/profiles.js

@@ -150,72 +150,12 @@ const RESOURCE_FIELD_PREFIXES = new Set([
     'label',
     'labels',
 ]);
-const QUALIFIER_KEYS = [
-    'chain_id',
-    'app_id',
-    'token_address',
-    'tag_id',
-    'scope',
-];
 const FILTER_ENTRY_KEYS = new Set([
     'field',
     'op',
     'value',
-    ...QUALIFIER_KEYS,
+    ...filters_1.QUALIFIER_KEYS,
 ]);
-/**
- * Enforce the per-field qualifier rules, mirroring the API's schema. Sending a
- * qualifier the field does not accept — or omitting a required one — is a 400,
- * so we fail here with a message that names the offending key.
- */
-function validateQualifiers(record, field) {
-    const present = (key) => record[key] !== undefined;
-    const required = (key) => {
-        if (!present(key)) {
-            throw new Error(`--filters: "${key}" is required for "${field}"`);
-        }
-    };
-    const forbidden = (keys) => {
-        for (const key of keys) {
-            if (present(key)) {
-                throw new Error(`--filters: "${key}" is not valid for "${field}"`);
-            }
-        }
-    };
-    switch (field) {
-        case 'chains.balance':
-            // chain_id optional — omit it to match any chain.
-            forbidden(['app_id', 'token_address', 'tag_id', 'scope']);
-            break;
-        case 'apps.balance':
-            required('app_id');
-            forbidden(['token_address', 'tag_id', 'scope']);
-            break;
-        case 'tokens.balance':
-            required('token_address');
-            required('scope');
-            if (record.scope !== 'any' && record.scope !== 'protocol') {
-                throw new Error(`--filters: "scope" must be "any" or "protocol"`);
-            }
-            // app_id identifies the protocol, so it is required by (and only by)
-            // scope: "protocol".
-            if (record.scope === 'protocol') {
-                required('app_id');
-            }
-            else {
-                forbidden(['app_id']);
-            }
-            forbidden(['tag_id']);
-            break;
-        case 'labels.value':
-            required('tag_id');
-            forbidden(['app_id', 'token_address', 'scope']);
-            break;
-        default:
-            // users.* — a user attribute carries no resource identity.
-            forbidden(QUALIFIER_KEYS);
-    }
-}
 /**
  * Parse and validate the --filters JSON. Ensures it is an array of
  * `{ field, op, value }` objects carrying a canonical `field` — either
@@ -263,7 +203,7 @@ function parseSearchFilters(raw) {
                     '(a bare name is silently ignored by the API and returns the entire unfiltered dataset)');
             }
         }
-        validateQualifiers(record, field);
+        (0, filters_1.validateQualifiers)(record, field);
         // The balance fields compare numerically; a stringified number is a 400.
         if (field !== 'labels.value' &&
             RESOURCE_FILTER_FIELDS.has(field) &&
@@ -442,9 +382,26 @@ exports.profiles.command('search', {
     },
 });
 function buildUpdateProfileBody(options) {
-    const body = (0, json_1.parseJsonObject)(options.properties, '--properties');
+    const body = options.properties
+        ? (0, json_1.parseJsonObject)(options.properties, '--properties')
+        : {};
+    if (options.unset) {
+        const keys = options.unset
+            .split(',')
+            .map((key) => key.trim())
+            .filter((key) => key.length > 0);
+        if (keys.length === 0) {
+            throw new Error('--unset must list at least one property key');
+        }
+        for (const key of keys) {
+            if (key === 'user_id') {
+                throw new Error('user_id cannot be unset (it participates in identity stitching)');
+            }
+            body[key] = null;
+        }
+    }
     if (Object.keys(body).length === 0) {
-        throw new Error('--properties must contain at least one key');
+        throw new Error('provide --properties and/or --unset with at least one key');
     }
     return body;
 }
@@ -461,7 +418,12 @@ exports.profiles.command('update', {
     options: incur_1.z.object({
         properties: incur_1.z
             .string()
-            .describe('JSON object of properties to merge. Allowed keys: user_id, display_name, email, farcaster, discord, twitter, telegram, instagram, website, github, linkedin, facebook, tiktok, youtube, reddit, avatar, description, location, ens, lens, basenames, linea'),
+            .optional()
+            .describe('JSON object of properties to merge; a null value unsets (deletes) that property. Allowed keys: user_id, display_name, email, farcaster, discord, twitter, telegram, instagram, website, github, linkedin, facebook, tiktok, youtube, reddit, avatar, description, location, ens, lens, basenames, linea'),
+        unset: incur_1.z
+            .string()
+            .optional()
+            .describe('Comma-separated property keys to unset (delete), e.g. "email,twitter". Shorthand for null values in --properties. user_id cannot be unset.'),
     }),
     examples: [
         {
@@ -476,8 +438,18 @@ exports.profiles.command('update', {
             options: { properties: '{"email":"alice@example.com"}' },
             description: 'Set just the email',
         },
+        {
+            args: { address: '0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045' },
+            options: { unset: 'email,twitter' },
+            description: 'Delete the email and Twitter properties',
+        },
+        {
+            args: { address: '0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045' },
+            options: { properties: '{"display_name":"alice.eth"}', unset: 'email' },
+            description: 'Set a new display name and delete the email in one call',
+        },
     ],
-    hint: 'Requires profiles:write scope on your API key. Only the listed keys are accepted; unknown keys are rejected.',
+    hint: 'Requires profiles:write scope on your API key. Only the listed keys are accepted; unknown keys are rejected. Deleting a property hides any globally-enriched fallback value too; user_id cannot be unset.',
     run({ args, options }) {
         return updateProfileRun(args.address, options);
     },
@@ -507,7 +479,7 @@ exports.profilesProperties.command('batch', {
     options: incur_1.z.object({
         rows: incur_1.z
             .string()
-            .describe('JSON array of flat {address,...properties} objects. ENS names are not resolved in batch requests.'),
+            .describe('JSON array of flat {address,...properties} objects; a null value unsets (deletes) that property (user_id cannot be unset). ENS names are not resolved in batch requests.'),
     }),
     examples: [
         {
@@ -516,6 +488,12 @@ exports.profilesProperties.command('batch', {
             },
             description: 'Batch set display names and emails',
         },
+        {
+            options: {
+                rows: '[{"address":"0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045","email":null}]',
+            },
+            description: 'Batch delete emails (null unsets a property)',
+        },
     ],
     hint: 'Requires profiles:write scope on your API key. Unknown keys are ignored by the API; invalid rows are quarantined.',
     run({ options }) {

package/dist/lib/client.d.ts

@@ -4,7 +4,7 @@ export declare const DEFAULT_EVENTS_BASE_URL = "https://events.formo.so";
 export declare function getApiBaseUrl(): string;
 export declare function getEventsBaseUrl(): string;
 export interface ApiErrorBody {
-    error?: {
+    error?: string | {
         code?: string;
         message?: string;
         doc_url?: string;

package/dist/lib/client.js

@@ -30,8 +30,14 @@ function getEventsBaseUrl() {
 function parseApiError(error) {
     const status = error.response?.status;
     const body = error.response?.data;
-    const apiError = body?.error;
-    const baseMessage = apiError?.message ?? error.message;
+    const rawError = body?.error;
+    const apiError = rawError && typeof rawError === 'object' ? rawError : undefined;
+    const plainMessage = typeof rawError === 'string'
+        ? rawError
+        : typeof error.response?.data === 'string'
+            ? error.response.data
+            : undefined;
+    const baseMessage = apiError?.message ?? plainMessage ?? error.message;
     const parts = [];
     parts.push(apiError?.code ? `[${apiError.code}] ${baseMessage}` : baseMessage);
     if (apiError?.param)

package/dist/lib/filters.d.ts

@@ -4,3 +4,10 @@ export declare function isValuelessFilterOperator(op: unknown): boolean;
 export declare function isCanonicalFilterValue(value: unknown): boolean;
 export declare function isEmptyMembershipArray(value: unknown): boolean;
 export declare function hasTinybirdMembershipDelimiter(value: unknown): boolean;
+export declare const QUALIFIER_KEYS: readonly ["chain_id", "app_id", "token_address", "tag_id", "scope"];
+/**
+ * Enforce the per-field qualifier rules, mirroring the API's schema. Sending a
+ * qualifier the field does not accept — or omitting a required one — is a 400,
+ * so we fail here with a message that names the offending key.
+ */
+export declare function validateQualifiers(record: Record<string, unknown>, field: string, path?: string): void;

package/dist/lib/filters.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CANONICAL_FILTER_OPERATORS = void 0;
+exports.QUALIFIER_KEYS = exports.CANONICAL_FILTER_OPERATORS = void 0;
 exports.isCanonicalFilterOperator = isCanonicalFilterOperator;
 exports.isValuelessFilterOperator = isValuelessFilterOperator;
 exports.isCanonicalFilterValue = isCanonicalFilterValue;
 exports.isEmptyMembershipArray = isEmptyMembershipArray;
 exports.hasTinybirdMembershipDelimiter = hasTinybirdMembershipDelimiter;
+exports.validateQualifiers = validateQualifiers;
 exports.CANONICAL_FILTER_OPERATORS = [
     'eq',
     'neq',
@@ -43,3 +44,71 @@ function hasTinybirdMembershipDelimiter(value) {
     return (Array.isArray(value) &&
         value.some((item) => typeof item === 'string' && item.includes('|')));
 }
+exports.QUALIFIER_KEYS = [
+    'chain_id',
+    'app_id',
+    'token_address',
+    'tag_id',
+    'scope',
+];
+/**
+ * Enforce the per-field qualifier rules, mirroring the API's schema. Sending a
+ * qualifier the field does not accept — or omitting a required one — is a 400,
+ * so we fail here with a message that names the offending key.
+ */
+function validateQualifiers(record, field, path = '--filters') {
+    for (const key of exports.QUALIFIER_KEYS) {
+        if (record[key] !== undefined && (typeof record[key] !== 'string' || record[key] === '')) {
+            throw new Error(`${path}.${key} must be a non-empty string`);
+        }
+    }
+    if (record.scope !== undefined && record.scope !== 'any' && record.scope !== 'protocol') {
+        throw new Error(`${path}.scope must be any or protocol`);
+    }
+    const present = (key) => record[key] !== undefined;
+    const required = (key) => {
+        if (!present(key)) {
+            throw new Error(`${path}: "${key}" is required for "${field}"`);
+        }
+    };
+    const forbidden = (keys) => {
+        for (const key of keys) {
+            if (present(key)) {
+                throw new Error(`${path}: "${key}" is not valid for "${field}"`);
+            }
+        }
+    };
+    switch (field) {
+        case 'chains.balance':
+            // chain_id optional — omit it to match any chain.
+            forbidden(['app_id', 'token_address', 'tag_id', 'scope']);
+            break;
+        case 'apps.balance':
+            required('app_id');
+            forbidden(['token_address', 'tag_id', 'scope']);
+            break;
+        case 'tokens.balance':
+            required('token_address');
+            required('scope');
+            if (record.scope !== 'any' && record.scope !== 'protocol') {
+                throw new Error(`${path}: "scope" must be "any" or "protocol"`);
+            }
+            // app_id identifies the protocol, so it is required by (and only by)
+            // scope: "protocol".
+            if (record.scope === 'protocol') {
+                required('app_id');
+            }
+            else {
+                forbidden(['app_id']);
+            }
+            forbidden(['tag_id']);
+            break;
+        case 'labels.value':
+            required('tag_id');
+            forbidden(['app_id', 'token_address', 'scope']);
+            break;
+        default:
+            // users.* — a user attribute carries no resource identity.
+            forbidden(exports.QUALIFIER_KEYS);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@formo/cli",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "packageManager": "pnpm@11.1.2",
   "engines": {
     "node": ">=22.12"
@@ -39,8 +39,11 @@
     "test:watch": "mocha --watch"
   },
   "dependencies": {
-    "axios": "^1.18.0",
-    "incur": "0.4.26"
+    "@toon-format/toon": "^2.3.1",
+    "axios": "^1.20.0",
+    "incur": "0.4.26",
+    "yaml": "^2.9.1",
+    "zod": "^4.6.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
@@ -52,7 +55,7 @@
     "eslint": "^10.2.0",
     "globals": "^17.4.0",
     "mocha": "^11.7.5",
-    "tsx": "^4.21.0",
+    "tsx": "^4.22.0",
     "typescript": "^5.5.4",
     "typescript-eslint": "^8.58.1"
   }