@myapihq/cli 1.1.0-wip.2 → 1.1.0-wip.4

package/dist/commands/funnel.js

@@ -108,13 +108,27 @@ export async function push(slug, flags) {
     if (resolvedFromOrg) {
         info(`(Used the org's only funnel: ${funnelId}. Set a default with: myapi config set-funnel ${funnelId})`);
     }
-    if (result?.url) {
-        info(`Preview: ${result.url}`);
-    }
-    else {
+    let liveUrl = result?.url;
+    if (!liveUrl) {
         const org = await hq.getOrg(config.api_key, orgId);
         if (org.preview_subdomain) {
-            info(`Preview: https://${org.preview_subdomain}.makeautonomous.com${finalSlug}`);
+            liveUrl = `https://${org.preview_subdomain}.makeautonomous.com${finalSlug}`;
+        }
+    }
+    if (liveUrl)
+        info(`Preview: ${liveUrl}`);
+    // If we're still on the preview subdomain, hint at how to serve on a
+    // custom domain. Tailor the hint: if a default_domain is already
+    // configured (registered + meant to be used), suggest assigning it
+    // directly; otherwise point at register + assign.
+    const onPreview = liveUrl?.includes('.makeautonomous.com');
+    if (onPreview) {
+        const dom = config.default_domain;
+        if (dom) {
+            info(`(Serving on the preview subdomain. To serve on ${dom} instead: myapi domain assign ${dom})`);
+        }
+        else {
+            info(`(Serving on the preview subdomain. To serve on a custom domain: myapi domain register <domain> && myapi domain assign <domain>)`);
         }
     }
 }
@@ -149,6 +163,11 @@ const SUBCOMMAND_USAGE = {
 Reads HTML from stdin and publishes to <slug> on your funnel. Funnel is resolved
 from --funnel, the default funnel, or (only if the org has exactly one) auto-picked.
 
+By default, your funnel is served on a preview subdomain (*.makeautonomous.com).
+To serve on your own domain, register and assign one with:
+  myapi domain register <domain>
+  myapi domain assign <domain>
+
 Examples:
   echo '<h1>Hello</h1>' | myapi funnel push /
   cat about.html | myapi funnel push /about

package/dist/commands/image.d.ts

@@ -1,4 +1,4 @@
-export declare function generate(flags: Record<string, string | boolean>): Promise<void>;
-export declare function list(flags: Record<string, string | boolean>): Promise<void>;
-export declare function del(id: string, flags: Record<string, string | boolean>): Promise<void>;
-export declare function run(subcommand: string | undefined, args: string[], flags: Record<string, string | boolean>): Promise<void>;
+import type { FlagSchema } from '../flags.js';
+import { type Flags } from '../helpers.js';
+export declare const SCHEMA: FlagSchema;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/image.js

@@ -1,70 +1,157 @@
 import { image as sdkImage } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
-import { success, error, printTable, info, printJson } from '../output.js';
-import { sleep } from '../utils.js';
-export async function generate(flags) {
+import { success, error, printTable, info, printJson, banner } from '../output.js';
+import { formatDate, pollJob } from '../utils.js';
+import { requireOrg, requireArg } from '../helpers.js';
+export const SCHEMA = {
+    org: 'string',
+    prompt: 'string',
+    ratio: 'string',
+    style: 'string',
+    colors: 'string',
+    text: 'boolean',
+};
+const VALID_RATIOS = new Set(['1:1', '16:9', '9:16', '4:3', '3:4']);
+// Hex list: optional leading #, 3 or 6 hex digits, comma-separated.
+const HEX_LIST_RE = /^#?[0-9a-fA-F]{3}(?:[0-9a-fA-F]{3})?(?:\s*,\s*#?[0-9a-fA-F]{3}(?:[0-9a-fA-F]{3})?)*$/;
+const PRICE_USD = 0.05;
+function summarizeImage(j) {
+    const prompt = (j.prompt || '');
+    const truncated = prompt.length > 60 ? prompt.slice(0, 60) + '...' : prompt;
+    return {
+        job_id: j.job_id,
+        status: j.status,
+        aspect_ratio: j.aspect_ratio,
+        prompt: truncated,
+        url: j.url || '',
+        created_at: j.created_at ? formatDate(j.created_at) : '',
+    };
+}
+async function generate(promptArg, flags) {
     const config = requireConfig();
-    const orgId = flags.org || config.default_org;
-    if (!orgId || !flags.prompt) {
-        error("Missing required arguments.\nUsage: myapi image generate --prompt <text> --org <id>\n(Or set defaults via: myapi config set-org <id>)");
+    const orgId = requireOrg(flags, config, 'myapi image generate <prompt> [--ratio 1:1|16:9|9:16|4:3|3:4] [--style <s>] [--colors <hex,hex>] [--text] [--org <id>]');
+    // Convention: first required arg is positional. --prompt still works for back-compat.
+    const prompt = promptArg || flags.prompt;
+    if (!prompt) {
+        error('Missing required arguments.\nUsage: myapi image generate <prompt> [--ratio <ratio>] [--style <s>] [--colors <c>] [--text] [--org <id>]\n   or: myapi image generate --prompt "<text>" ...');
+    }
+    // Client-side validation: catch typos before they round-trip.
+    if (flags.ratio && !VALID_RATIOS.has(flags.ratio)) {
+        error(`Invalid --ratio "${flags.ratio}". Allowed: ${[...VALID_RATIOS].join(', ')}`);
     }
-    const payload = { prompt: flags.prompt };
+    if (flags.colors && !HEX_LIST_RE.test(flags.colors)) {
+        error(`Invalid --colors "${flags.colors}". Expected comma-separated hex like "#ff6600,#003366" (3- or 6-digit, # optional).`);
+    }
+    const payload = { prompt };
     if (flags.ratio)
         payload.aspect_ratio = flags.ratio;
     if (flags.style)
         payload.style = flags.style;
     if (flags.colors)
         payload.colors = flags.colors;
-    const res = await sdkImage.generateImage(config.api_key, orgId, payload);
-    process.stdout.write("Generating image ");
-    const chars = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-    let i = 0;
-    let elapsed = 0;
-    while (elapsed < 60000) {
-        const job = await sdkImage.getImageJob(config.api_key, orgId, res.job_id);
-        if (job.status === 'completed') {
-            process.stdout.write('\r\x1b[K');
-            if (flags.json)
-                printJson(job);
-            else
-                success(`Image generated!\nURL: ${job.url}`);
-            return;
-        }
-        if (job.status === 'failed') {
-            process.stdout.write('\r\x1b[K');
-            error(`Image generation failed: ${job.error || 'Unknown error'}`);
-        }
-        process.stdout.write(`\rGenerating image ${chars[i++ % chars.length]}`);
-        await sleep(3000);
-        elapsed += 3000;
+    if (flags.text)
+        payload.has_text = true;
+    // Cost preview before kickoff. Goes to stderr (banner) so --json output
+    // stays clean for piping.
+    banner(`› Charging $${PRICE_USD.toFixed(2)} for this image generation…`);
+    const job = await sdkImage.generateImage(config.api_key, orgId, payload);
+    const final = await pollJob({
+        label: 'Generating image',
+        timeoutMs: 90_000,
+        intervalMs: 3000,
+        check: () => sdkImage.getImageJob(config.api_key, orgId, job.job_id),
+        isDone: s => s.status === 'completed',
+        isFailed: s => s.status === 'failed',
+        failedMessage: 'Image generation failed',
+        timeoutMessage: 'Image generation timed out — re-run "myapi image get <id>" to check later.',
+    });
+    if (flags.json) {
+        printJson(final);
+        return;
     }
-    process.stdout.write('\r\x1b[K');
-    error("Image generation timed out");
+    success(`Image generated!\nID:  ${final.job_id}\nURL: ${final.url}`);
 }
-export async function list(flags) {
+async function list(flags) {
     const config = requireConfig();
-    const orgId = flags.org || config.default_org;
-    if (!orgId)
-        error("Missing required arguments.\nUsage: myapi image list --org <id>\n(Or set defaults via: myapi config set-org <id>)");
+    const orgId = requireOrg(flags, config, 'myapi image list [--org <id>]');
     const images = await sdkImage.listImages(config.api_key, orgId);
-    if (flags.json)
+    if (flags.json) {
         printJson(images);
-    else
-        printTable(images);
+        return;
+    }
+    printTable(images.map(summarizeImage), {
+        flags,
+        empty: 'No images yet. Generate one: myapi image generate "<prompt>"',
+    });
 }
-export async function del(id, flags) {
+async function get(id, flags) {
     const config = requireConfig();
-    const orgId = flags.org || config.default_org;
-    if (!orgId || !id) {
-        error("Missing required arguments.\nUsage: myapi image delete <job_id> --org <id>\n(Or set defaults via: myapi config set-org <id>)");
+    const orgId = requireOrg(flags, config, 'myapi image get <job_id> [--org <id>] [--json]');
+    requireArg(id, 'job_id', 'myapi image get <job_id> [--org <id>] [--json]');
+    const job = await sdkImage.getImageJob(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(job);
+        return;
     }
+    info(`ID:           ${job.job_id}`);
+    info(`Status:       ${job.status}`);
+    info(`Aspect ratio: ${job.aspect_ratio}`);
+    if (job.prompt)
+        info(`Prompt:       ${job.prompt}`);
+    if (job.url)
+        info(`URL:          ${job.url}`);
+    if (job.error)
+        info(`Error:        ${job.error}`);
+    if (job.created_at)
+        info(`Created:      ${formatDate(job.created_at)}`);
+}
+// `get-url`: just the URL string, nothing else. Curl-friendly. Errors if
+// the job isn't completed (no URL to print).
+async function getUrl(id, _flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(_flags, config, 'myapi image get-url <job_id> [--org <id>]');
+    requireArg(id, 'job_id', 'myapi image get-url <job_id> [--org <id>]');
+    const job = await sdkImage.getImageJob(config.api_key, orgId, id);
+    if (!job.url) {
+        error(`Image ${id} has no URL yet (status: ${job.status}). Re-check with: myapi image get ${id}`);
+    }
+    console.log(job.url);
+}
+async function del(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi image delete <job_id> [--org <id>]');
+    requireArg(id, 'job_id', 'myapi image delete <job_id> [--org <id>]');
     await sdkImage.deleteImage(config.api_key, orgId, id);
-    success(`Image deleted! (Job ${id} history retained, URL nullified)`);
+    success(`Image ${id} deleted (job history retained, URL nullified)`);
 }
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     'list': 'myapi image list [--org <id>] [--json]',
-    'generate': 'myapi image generate --prompt "<text>" [--ratio <1:1|16:9>] [--style <style>] [--colors <hex_list>] [--org <id>]',
+    'generate': `myapi image generate <prompt> [--ratio 1:1|16:9|9:16|4:3|3:4] [--style <s>] [--colors <hex,hex>] [--text] [--org <id>]
+       myapi image generate --prompt "<text>" ...
+
+Either form works; the positional prompt is the recommended shape.
+
+Generation is asynchronous — the CLI polls for up to 90s. If it times out
+the job keeps running server-side; re-fetch with:
+  myapi image get <job_id>
+
+Cost: $${PRICE_USD.toFixed(2)} per generation. Failed jobs aren't charged.
+
+Flags:
+  --ratio   Aspect ratio (allowed: ${[...VALID_RATIOS].join(', ')}; default 1:1)
+  --style   Free-form style hint (e.g. "watercolor", "cyberpunk neon")
+  --colors  Hex colors comma-separated (e.g. "#ff6600,#003366")
+  --text    Allow text in the image (off by default — text rarely renders well)`,
+    'get': `myapi image get <job_id> [--org <id>] [--json]
+
+Round-trips the API to fetch the full job: status, URL, prompt, aspect ratio,
+created_at. JSON output via --json; otherwise human-readable block.`,
+    'get-url': `myapi image get-url <job_id> [--org <id>]
+
+Prints just the asset URL. Errors if the job hasn't completed yet.
+Curl-friendly:
+  curl -O "$(myapi image get-url <id>)"`,
     'delete': 'myapi image delete <job_id> [--org <id>]',
 };
 export async function run(subcommand, args, flags) {
@@ -72,11 +159,14 @@ export async function run(subcommand, args, flags) {
         info(`Usage: myapi image <subcommand>
 
 Subcommands:
-  list       List all your generated images
-  generate   Generate a new AI image from a prompt ($0.05 per generation)
-  delete     Delete the physical image file for a job (history retained, URL nullified)
+  list                List all your generated images
+  generate <prompt>   Generate a new AI image (async, polls up to 90s, $${PRICE_USD.toFixed(2)})
+  get <job_id>        Fetch full job metadata (JSON or human-readable)
+  get-url <job_id>    Print just the asset URL (curl-friendly)
+  delete <job_id>     Delete the asset (job history retained)
 
-All commands accept --org <id> (or set default: myapi config set-org <id>).`);
+All commands accept --org <id> (or set default: myapi config set-org <id>).
+The asset lands in your org's storage and is also visible via "myapi storage list".`);
         return;
     }
     if (flags.help) {
@@ -84,13 +174,15 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         if (usage)
             info(`Usage: ${usage}`);
         else
-            info(`Unknown subcommand: ${subcommand}. Run "myapi image --help" for the list.`);
+            error(`Unknown subcommand: ${subcommand}. Run "myapi image --help" for the list.`);
         return;
     }
     switch (subcommand) {
         case 'list': return list(flags);
-        case 'generate': return generate(flags);
+        case 'generate': return generate(args[0], flags);
+        case 'get': return get(args[0], flags);
+        case 'get-url': return getUrl(args[0], flags);
         case 'delete': return del(args[0], flags);
-        default: error(`Unknown subcommand: ${subcommand}. Run "myapi image --help" for a list of valid subcommands.`);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi image --help" for available subcommands.`);
     }
 }

package/dist/commands/storage.d.ts

@@ -1,4 +1,4 @@
-export declare function list(flags: Record<string, string | boolean>): Promise<void>;
-export declare function ingest(url: string, flags: Record<string, string | boolean>): Promise<void>;
-export declare function del(id: string, flags: Record<string, string | boolean>): Promise<void>;
-export declare function run(subcommand: string | undefined, args: string[], flags: Record<string, string | boolean>): Promise<void>;
+import type { FlagSchema } from '../flags.js';
+import { type Flags } from '../helpers.js';
+export declare const SCHEMA: FlagSchema;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/storage.js

@@ -1,39 +1,127 @@
-import { storage as sdkStorage } from '@myapihq/sdk';
+import { readFile } from 'fs/promises';
+import { extname, basename } from 'path';
+import { storage as sdkStorage, STORAGE_BASE } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson } from '../output.js';
-export async function list(flags) {
+import { formatDate } from '../utils.js';
+import { requireOrg, requireArg } from '../helpers.js';
+export const SCHEMA = {
+    org: 'string',
+    name: 'string',
+};
+// Mirrors UploadContentType in @myapihq/sdk + backend allowlist.
+const EXT_TO_CT = {
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+};
+function summarizeAsset(a) {
+    return {
+        asset_id: a.asset_id,
+        name: a.name || '(unnamed)',
+        url: a.url,
+        created_at: a.created_at ? formatDate(a.created_at) : '',
+    };
+}
+async function list(flags) {
     const config = requireConfig();
-    const orgId = flags.org || config.default_org;
-    if (!orgId)
-        error("Missing required arguments.\nUsage: myapi storage list --org <id>\n(Or set defaults via: myapi config set-org <id>)");
+    const orgId = requireOrg(flags, config, 'myapi storage list [--org <id>]');
     const assets = await sdkStorage.listAssets(config.api_key, orgId);
-    if (flags.json)
+    if (flags.json) {
         printJson(assets);
-    else
-        printTable(assets);
+        return;
+    }
+    printTable(assets.map(summarizeAsset), {
+        flags,
+        empty: 'No assets yet. Upload one: myapi storage upload <file>  ·  Or ingest from URL: myapi storage ingest <url>',
+    });
 }
-export async function ingest(url, flags) {
+async function ingest(url, flags) {
     const config = requireConfig();
-    const orgId = flags.org || config.default_org;
-    if (!orgId || !url) {
-        error("Missing required arguments.\nUsage: myapi storage ingest <url> [--name <name>] --org <id>\n(Or set defaults via: myapi config set-org <id>)");
-    }
+    const orgId = requireOrg(flags, config, 'myapi storage ingest <url> [--name <name>] [--org <id>]');
+    requireArg(url, 'url', 'myapi storage ingest <url> [--name <name>] [--org <id>]');
     const res = await sdkStorage.ingestAsset(config.api_key, orgId, url, flags.name);
     success(`Asset ingested! ID: ${res.asset_id}\nHosted URL: ${res.url}`);
 }
-export async function del(id, flags) {
+async function upload(filePath, flags) {
     const config = requireConfig();
-    const orgId = flags.org || config.default_org;
-    if (!orgId || !id) {
-        error("Missing required arguments.\nUsage: myapi storage delete <id> --org <id>\n(Or set defaults via: myapi config set-org <id>)");
+    const orgId = requireOrg(flags, config, 'myapi storage upload <file> [--name <name>] [--org <id>]');
+    requireArg(filePath, 'file', 'myapi storage upload <file> [--name <name>] [--org <id>]');
+    const ext = extname(filePath).toLowerCase();
+    const contentType = EXT_TO_CT[ext];
+    if (!contentType) {
+        error(`Unsupported file extension "${ext}". Supported: ${Object.keys(EXT_TO_CT).join(', ')}.\n(SVG and non-image types — pdf/mp4/webm — go through "myapi storage ingest <url>" today.)`);
+    }
+    let data;
+    try {
+        data = await readFile(filePath);
+    }
+    catch (e) {
+        if (e?.code === 'ENOENT')
+            error(`File not found: ${filePath}`);
+        if (e?.code === 'EACCES')
+            error(`Permission denied: ${filePath}`);
+        error(`Could not read ${filePath}: ${e?.message ?? e}`);
     }
+    const name = flags.name || basename(filePath);
+    const res = await sdkStorage.uploadAsset(config.api_key, orgId, data, contentType, name);
+    success(`Asset uploaded! ID: ${res.asset_id}\nHosted URL: ${res.url}`);
+}
+// `get`: round-trip metadata for one asset. Backend has no single-asset
+// GET endpoint today, so we list + filter locally. Switch to a direct
+// call once the backend exposes one.
+async function get(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi storage get <asset_id> [--org <id>]');
+    requireArg(id, 'asset_id', 'myapi storage get <asset_id> [--org <id>]');
+    const all = await sdkStorage.listAssets(config.api_key, orgId);
+    const asset = all.find(a => a.asset_id === id);
+    if (!asset)
+        error(`Asset ${id} not found in this org. List with: myapi storage list`);
+    if (flags.json) {
+        printJson(asset);
+        return;
+    }
+    info(`ID:      ${asset.asset_id}`);
+    info(`Name:    ${asset.name || '(unnamed)'}`);
+    info(`URL:     ${asset.url}`);
+    if (asset.created_at)
+        info(`Created: ${formatDate(asset.created_at)}`);
+}
+// `get-url`: cheapest possible — print the public URL pattern. No API
+// call. Curl-friendly. Doesn't even verify the asset exists; that's a
+// trade-off for being a pure local URL constructor.
+async function getUrl(id, _flags) {
+    requireArg(id, 'asset_id', 'myapi storage get-url <asset_id>');
+    console.log(`${STORAGE_BASE}/storage/${encodeURIComponent(id)}`);
+}
+async function del(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi storage delete <asset_id> [--org <id>]');
+    requireArg(id, 'asset_id', 'myapi storage delete <asset_id> [--org <id>]');
     await sdkStorage.deleteAsset(config.api_key, orgId, id);
     success(`Asset ${id} deleted`);
 }
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     'list': 'myapi storage list [--org <id>] [--json]',
-    'ingest': 'myapi storage ingest <url> [--name <name>] [--org <id>]',
+    'ingest': `myapi storage ingest <url> [--name <name>] [--org <id>]
+
+Server fetches the URL and stores the file. Useful for migrating assets that
+already live on a public URL (e.g. importing brand assets from another host).`,
+    'upload': `myapi storage upload <file> [--name <name>] [--org <id>]
+
+Direct multipart upload of a local file. Supported: ${Object.keys(EXT_TO_CT).join(', ')}.
+The display name defaults to the file's basename — override with --name.`,
+    'get': `myapi storage get <asset_id> [--org <id>] [--json]
+
+Round-trips the API to fetch the asset's metadata (name, URL, created_at).`,
+    'get-url': `myapi storage get-url <asset_id>
+
+Prints the public CDN URL with no API call. Curl-friendly:
+  curl -O "$(myapi storage get-url <id>)"`,
     'delete': 'myapi storage delete <asset_id> [--org <id>]',
 };
 export async function run(subcommand, args, flags) {
@@ -41,9 +129,12 @@ export async function run(subcommand, args, flags) {
         info(`Usage: myapi storage <subcommand>
 
 Subcommands:
-  list       List all your uploaded assets
-  ingest     Ingest a public image URL into your edge storage
-  delete     Delete a stored asset
+  list                List all your stored assets
+  ingest <url>        Server pulls a public URL into storage
+  upload <file>       Direct upload of a local file
+  get <asset_id>      Fetch asset metadata (name, URL, created_at)
+  get-url <asset_id>  Print the public CDN URL (no API call)
+  delete <asset_id>   Permanently delete a stored asset
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
@@ -53,13 +144,16 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         if (usage)
             info(`Usage: ${usage}`);
         else
-            info(`Unknown subcommand: ${subcommand}. Run "myapi storage --help" for the list.`);
+            error(`Unknown subcommand: ${subcommand}. Run "myapi storage --help" for the list.`);
         return;
     }
     switch (subcommand) {
         case 'list': return list(flags);
         case 'ingest': return ingest(args[0], flags);
+        case 'upload': return upload(args[0], flags);
+        case 'get': return get(args[0], flags);
+        case 'get-url': return getUrl(args[0], flags);
         case 'delete': return del(args[0], flags);
-        default: error(`Unknown subcommand: ${subcommand}. Run "myapi storage --help" for a list of valid subcommands.`);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi storage --help" for available subcommands.`);
     }
 }

package/dist/commands/workflow.js

@@ -13,16 +13,56 @@ export const SCHEMA = {
 // forms are accepted by the workflow runner. Keep this in sync if the
 // backend grows new step types.
 const SUPPORTED_STEP_TYPES = ['send_email', 'email', 'slack_message', 'slack'];
+const SLACK_HOOK_RE = /^https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+/;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+// Per-step-type required fields. Validated client-side so typos and
+// hallucinated shapes fail fast, before the network call. Backend
+// performs the same validation as defense in depth.
 function validateSteps(steps) {
     if (!Array.isArray(steps))
         error('--steps must be a JSON array of step objects.');
+    if (steps.length === 0)
+        error('--steps cannot be an empty array.');
     steps.forEach((s, i) => {
+        const where = `step ${i}`;
         if (!s || typeof s !== 'object')
-            error(`step ${i}: must be a JSON object.`);
+            error(`${where}: must be a JSON object.`);
         if (!s.type)
-            error(`step ${i}: missing required field "type". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`);
+            error(`${where}: missing required field "type". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`);
         if (!SUPPORTED_STEP_TYPES.includes(s.type)) {
-            error(`step ${i}: unknown type "${s.type}". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`);
+            error(`${where}: unknown type "${s.type}". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`);
+        }
+        if (s.type === 'send_email' || s.type === 'email') {
+            const required = ['from', 'to', 'subject'];
+            for (const f of required) {
+                if (!s[f] || typeof s[f] !== 'string') {
+                    error(`${where} (${s.type}): missing required field "${f}".`);
+                }
+            }
+            const bodyForms = ['body', 'html', 'template_id'].filter(f => s[f] !== undefined && s[f] !== '');
+            if (bodyForms.length === 0) {
+                error(`${where} (${s.type}): must include exactly one of "body", "html", or "template_id".`);
+            }
+            if (bodyForms.length > 1) {
+                error(`${where} (${s.type}): can only use one of "body", "html", "template_id" — got: ${bodyForms.join(', ')}.`);
+            }
+            if (s.template_vars !== undefined && !s.template_id) {
+                error(`${where} (${s.type}): "template_vars" only makes sense with "template_id".`);
+            }
+            if (s.template_vars !== undefined && (typeof s.template_vars !== 'object' || Array.isArray(s.template_vars))) {
+                error(`${where} (${s.type}): "template_vars" must be a JSON object.`);
+            }
+        }
+        if (s.type === 'slack_message' || s.type === 'slack') {
+            if (!s.webhook_url || typeof s.webhook_url !== 'string') {
+                error(`${where} (${s.type}): missing required field "webhook_url".`);
+            }
+            if (!SLACK_HOOK_RE.test(s.webhook_url)) {
+                error(`${where} (${s.type}): "webhook_url" must look like https://hooks.slack.com/services/T.../B.../xxx — got "${s.webhook_url}".`);
+            }
+            if (!s.text || typeof s.text !== 'string') {
+                error(`${where} (${s.type}): missing required field "text".`);
+            }
         }
     });
 }
@@ -77,6 +117,9 @@ export async function create(nameArg, flags) {
     if (!name || !endpointId || !flags.steps) {
         error('Missing required arguments.\nUsage: myapi workflow create <name> --endpoint-id <id> --steps <json> [--no-enable] [--org <id>]\n   or: myapi workflow create --name <name> --endpoint-id <id> --steps <json> [--no-enable] [--org <id>]');
     }
+    if (!UUID_RE.test(endpointId)) {
+        error(`Invalid --endpoint-id "${endpointId}". Expected a webhook endpoint UUID.\nList your endpoints with: myapi webhook list`);
+    }
     let steps;
     try {
         steps = JSON.parse(flags.steps);
@@ -107,8 +150,13 @@ export async function update(id, flags) {
     const payload = {};
     if (typeof flags.name === 'string')
         payload.name = flags.name;
-    if (typeof flags['endpoint-id'] === 'string')
-        payload.trigger_config = { endpoint_id: flags['endpoint-id'] };
+    if (typeof flags['endpoint-id'] === 'string') {
+        const eid = flags['endpoint-id'];
+        if (!UUID_RE.test(eid)) {
+            error(`Invalid --endpoint-id "${eid}". Expected a webhook endpoint UUID.\nList your endpoints with: myapi webhook list`);
+        }
+        payload.trigger_config = { endpoint_id: eid };
+    }
     if (typeof flags.steps === 'string') {
         try {
             payload.steps = JSON.parse(flags.steps);
@@ -180,19 +228,48 @@ const SUBCOMMAND_USAGE = {
 
 Either form works; the positional name is the recommended shape.
 
---steps is a JSON array of step objects. Supported step types:
-  send_email | email   — fields: from, to, subject, body | template_id, template_vars
-  slack_message | slack — fields: webhook_url, text
+--steps is a JSON array of step objects. Each step has a "type" field
+plus type-specific fields. Two types are supported today:
+
+  type: "send_email"  (alias: "email")
+    Required:
+      from           Sender mailbox address (must be activated for sending)
+      to             Recipient address (templating allowed)
+      subject        Email subject (templating allowed)
+    Body — exactly one of:
+      body           Plain text body
+      html           Raw HTML body
+      template_id    UUID of an AI-generated template (myapi email template
+                     generate). Recommended for nice-looking emails.
+    Optional:
+      template_vars  JSON object of variable substitutions, only with
+                     template_id (e.g. {"name": "{{ payload.name }}"}).
+
+  type: "slack_message"  (alias: "slack")
+    Required:
+      webhook_url    https://hooks.slack.com/services/T.../B.../xxx
+                     Get one from https://api.slack.com/apps → your app →
+                     Incoming Webhooks. Other URLs are rejected.
+      text           Message text (templating allowed)
+
+Templating: any string field can reference the incoming webhook payload
+with {{ payload.field }} (whitespace optional). Example:
+  "to": "{{ payload.email }}"  →  the email field from the form submission.
+
+Unknown step types AND missing/invalid fields are rejected at create
+time — you find out about typos before any workflow run happens.
 
-Either alias works (e.g. type: "email" and type: "send_email" both run
-the same step). Field values support {{ payload.field }} templating to
-reference the incoming webhook payload, e.g. "to": "{{ payload.email }}".
-Unknown step types are rejected at create time, not at execute time.
+There is NO on-failure notification mechanism today. Inspect run history
+with: myapi workflow runs <id> · myapi workflow get-run <run_id>.
 
-Example — fire on every webhook POST, send a thank-you email:
+Examples:
+  # send a thank-you email using an AI template, then ping Slack
   myapi workflow create "Contact handler" --endpoint-id <wid> --steps '[
-    {"type":"send_email","from":"hello@x.com","to":"{{ payload.email }}",
-     "subject":"Thanks!","body":"We got your message."}
+    {"type":"email","from":"hello@x.com","to":"{{ payload.email }}",
+     "subject":"Thanks!","template_id":"<tid>",
+     "template_vars":{"name":"{{ payload.name }}"}},
+    {"type":"slack","webhook_url":"https://hooks.slack.com/services/T0/B0/xxx",
+     "text":"New: {{ payload.message }}"}
   ]'
 
 See the my-workflow-api skill for the full form-to-email recipe.`,

package/dist/flags.js

@@ -16,6 +16,7 @@ export function parseFlags(argv, schema = {}) {
     const merged = { ...GLOBAL_FLAGS, ...schema };
     const args = [];
     const flags = {};
+    const unknownFlags = [];
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         if (arg === '-h') {
@@ -44,9 +45,24 @@ export function parseFlags(argv, schema = {}) {
             }
             const type = merged[key];
             // Unknown flags: tolerate as boolean (with --key=value still honored)
-            // so additions to the schema don't silently break someone's script.
+            // so additions to the schema don't silently break someone's script —
+            // BUT also collect them and emit a stderr warning at the end of
+            // parsing. Surfaces typos and AI-agent hallucinations like
+            // `--on-error <email>` without breaking back-compat.
             if (type === undefined) {
                 flags[key] = inlineValue ?? true;
+                unknownFlags.push(`--${key}`);
+                // If no inline value and the next token doesn't look like another
+                // flag, the user almost certainly intended it as the flag's value
+                // (e.g. `--on-error someone@x.com`). Consume it so it doesn't
+                // become a stray positional arg later.
+                if (inlineValue === undefined) {
+                    const next = argv[i + 1];
+                    if (next !== undefined && !next.startsWith('--') && !next.startsWith('-h') && !next.startsWith('-v')) {
+                        flags[key] = next;
+                        i++;
+                    }
+                }
                 continue;
             }
             if (type === 'boolean') {
@@ -84,5 +100,11 @@ export function parseFlags(argv, schema = {}) {
         }
         args.push(arg);
     }
+    // Surface unknown flags so typos and hallucinated flags don't silently
+    // disappear. Don't block — the value is still in `flags` for any handler
+    // that wants it — just print one line on stderr.
+    if (unknownFlags.length > 0 && !process.env.MYAPI_QUIET_UNKNOWN_FLAGS) {
+        process.stderr.write(`› Note: ignoring unknown flag(s): ${unknownFlags.join(', ')}\n`);
+    }
     return { args, flags };
 }

package/dist/index.js

@@ -16,6 +16,8 @@ import * as funnelCmd from './commands/funnel.js';
 import * as webhookCmd from './commands/webhook.js';
 import * as workflowCmd from './commands/workflow.js';
 import * as emailCmd from './commands/email/index.js';
+import * as imageCmd from './commands/image.js';
+import * as storageCmd from './commands/storage.js';
 import * as authCmd from './commands/auth.js';
 import * as configCmd from './commands/config.js';
 // Each command file declares the value flags it understands. We union them
@@ -28,8 +30,10 @@ const COMBINED_SCHEMA = {
     ...domainCmd.SCHEMA,
     ...emailCmd.SCHEMA,
     ...funnelCmd.SCHEMA,
+    ...imageCmd.SCHEMA,
     ...keysCmd.SCHEMA,
     ...orgCmd.SCHEMA,
+    ...storageCmd.SCHEMA,
     ...webhookCmd.SCHEMA,
     ...workflowCmd.SCHEMA,
     // Top-level flags
@@ -120,6 +124,12 @@ async function main() {
             case 'email':
                 await emailCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'image':
+                await imageCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'storage':
+                await storageCmd.run(subcommand, restArgs, flags);
+                break;
             // Convenience aliases
             case 'setup':
                 await setupCmd.setup(flags);
@@ -202,6 +212,8 @@ const HELP_TARGETS = {
     webhook: f => webhookCmd.run(undefined, [], f),
     workflow: f => workflowCmd.run(undefined, [], f),
     email: f => emailCmd.run(undefined, [], f),
+    image: f => imageCmd.run(undefined, [], f),
+    storage: f => storageCmd.run(undefined, [], f),
     org: f => orgCmd.run(undefined, [], f),
     billing: f => billingCmd.run(undefined, [], f),
     keys: f => keysCmd.run(undefined, [], f),
@@ -244,6 +256,8 @@ Commands:
   webhook      Manage inbound webhook endpoints and inspect deliveries
   email        Manage mailboxes, send/read email, templates, and campaigns
   workflow     Run actions (send email, post to Slack) when a webhook fires
+  image        Generate AI images and manage them in storage
+  storage      Upload, ingest, list, and serve assets from edge storage
 
 Aliases:
   whoami          → myapi auth whoami

package/dist/output.d.ts

@@ -7,6 +7,7 @@ export declare function info(message: string): void;
 export declare function banner(message: string): void;
 export declare function printJson(data: unknown): void;
 export declare function spinnerFrame(i: number): string;
+export declare function spinnerWrite(s: string): void;
 export declare function clearLine(): void;
 export interface PrintTableOptions {
     /** Pass `flags` so `--json` (any truthy form) routes to JSON output. */

package/dist/output.js

@@ -17,12 +17,19 @@ export function printJson(data) {
 }
 // Spinner / line-clear primitives. Used by polling helpers (utils.pollJob)
 // and any handler that wants its own progress UI.
+//
+// Spinner writes go to STDERR — keeping stdout clean for whatever the
+// command's actual output is (JSON, an id, a URL). Otherwise spinner bytes
+// pollute `--json` parsing or piped output.
 const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
 export function spinnerFrame(i) {
     return SPINNER_FRAMES[i % SPINNER_FRAMES.length];
 }
+export function spinnerWrite(s) {
+    process.stderr.write(s);
+}
 export function clearLine() {
-    process.stdout.write('\r\x1b[K');
+    process.stderr.write('\r\x1b[K');
 }
 // Generic so callers don't need `as unknown as Record<string, unknown>[]`.
 // Field names come from the first row; if SDK renames a field, the projector

package/dist/skills/my-image-api/README.md

@@ -0,0 +1,32 @@
+---
+# my-image-api
+
+Generate AI images from a text prompt. Async — submit, poll, get a public CDN URL. Asset auto-saved to your org's storage.
+
+## What it does
+
+- Text-to-image generation with prompt, aspect ratio, style, colors, optional text
+- Async pipeline (~10–30s typical, 90s timeout)
+- Output stored in mystorageapi automatically
+- Public CDN URL for embedding in funnels, emails, anywhere
+
+## Quickstart
+
+```bash
+myapi image generate "A clean flat-color logo for a sustainable jam company"
+# → polls, then prints the asset URL
+```
+
+## Authentication
+
+```bash
+export MYAPI_KEY=mak_...
+```
+
+Requires `api_key` and `org_id` from **myapihq**. ~$0.05 per generation.
+
+## Documentation
+
+Full command reference, flags, and async semantics: see `SKILL.md`.
+
+Run `myapi image --help` for inline reference.

package/dist/skills/my-image-api/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: my-image-api
+description: >
+  Generate AI images from a text prompt. Async — submit a prompt, the CLI polls until the image is ready, then returns a public CDN URL. Image lands automatically in your org's storage.
+---
+
+# MyImageAPI
+
+Text-to-image generation. Submit a prompt with optional aspect ratio, style, color palette, and "allow text" hint. The job is asynchronous — the CLI polls until completion (typically 10–30s, capped at 90s).
+
+## How It Fits Together
+
+- Requires `api_key` and `org_id` from **myapihq**.
+- Each generation costs ~$0.05 (deducted from your balance).
+- The output asset is stored in your org's **mystorageapi** bucket — `myapi storage list` and `myapi storage get` can fetch it later by id.
+- Generated images can be referenced from a **myfunnelapi** page or embedded in a **myemailapi** template.
+
+## Quick Start
+
+```bash
+# Generate (positional prompt is the recommended shape)
+myapi image generate "A clean flat-color logo for a sustainable jam company"
+
+# Same with options
+myapi image generate "Hero image, 16:9, mountains at dawn" \
+  --ratio 16:9 --style "watercolor" --colors "#ff6600,#003366"
+
+# List your generations
+myapi image list
+
+# Inspect or fetch a specific job
+myapi image get <job_id>
+
+# Delete the asset (the job history record stays)
+myapi image delete <job_id>
+```
+
+## All Commands
+
+| Command | What it does |
+|---|---|
+| `myapi image generate <prompt>` | Async generate, polls up to 90s, returns id + URL |
+| `myapi image list` | List all generated images for the org |
+| `myapi image get <job_id>` | Get full job details (status, URL, prompt, aspect ratio) |
+| `myapi image delete <job_id>` | Delete the asset (job record kept for history) |
+
+## Generate Flags
+
+| Flag | Allowed | Default | Notes |
+|---|---|---|---|
+| `--ratio` | `1:1`, `16:9`, `9:16`, `4:3`, `3:4` | `1:1` | Aspect ratio of the output |
+| `--style` | free-form string | none | Style hint, e.g. `"watercolor"`, `"cyberpunk neon"` |
+| `--colors` | hex list, comma-separated | none | e.g. `"#ff6600,#003366"` — the model will bias toward these |
+| `--text` | flag (no value) | off | Allow text in the image. Off by default — text rarely renders well, use only when you specifically want a logo or sign |
+
+## Async Behavior
+
+Generation is async. The CLI:
+1. Submits the prompt → gets a `job_id` immediately.
+2. Polls `GET /image/orgs/<org>/jobs/<job_id>` every 3 seconds.
+3. Returns when status is `completed` (success) or `failed` (errors out).
+4. If 90 seconds elapse without completion, the CLI prints a timeout message but **the job keeps running server-side**. Check back with:
+   ```
+   myapi image get <job_id>
+   ```
+
+## Notes
+
+- Generations cost $0.05 each. Failed jobs aren't charged.
+- The asset URL is public (anyone with the URL can view) — don't generate sensitive content.
+- Prompts with explicit text usually fail; for branded text use a separate text overlay step or a real designer.
+- Delete is permanent for the asset; the job's prompt + metadata stays for your history (`image list` will still show it with an empty URL).
+
+Run `myapi image --help` or `myapi image <subcommand> --help` for full flag reference.

package/dist/skills/my-image-api/claude/.claude-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "my-image-api",
+  "description": "Generate AI images from a text prompt. Async, polls until ready, returns a public CDN URL.",
+  "version": "1.0.0",
+  "published": true
+}

package/dist/skills/my-storage-api/README.md

@@ -0,0 +1,35 @@
+---
+# my-storage-api
+
+Edge-hosted asset storage. Upload local files or ingest from URLs. Each asset gets a stable public CDN URL.
+
+## What it does
+
+- Direct multipart upload of `.png` / `.jpg` files
+- Ingest from any public URL (server pulls)
+- Public CDN delivery — stable URL until deletion
+- Used automatically by my-image-api for generated images
+
+## Quickstart
+
+```bash
+myapi storage upload ./logo.png
+# → asset uploaded! URL: https://api.mystorageapi.com/storage/<id>
+
+# Or fetch via curl
+curl -O "$(myapi storage get <asset_id>)"
+```
+
+## Authentication
+
+```bash
+export MYAPI_KEY=mak_...
+```
+
+Requires `api_key` and `org_id` from **myapihq**.
+
+## Documentation
+
+Full command reference, upload-vs-ingest tradeoffs, and naming conventions: see `SKILL.md`.
+
+Run `myapi storage --help` for inline reference.

package/dist/skills/my-storage-api/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: my-storage-api
+description: >
+  Edge-hosted asset storage. Upload local files (.png/.jpg) directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
+---
+
+# MyStorageAPI
+
+Per-org asset storage with edge CDN delivery. Two ways in:
+- **Direct upload** — push a local file (multipart upload)
+- **Ingest from URL** — server fetches a public URL and stores the file
+
+Both produce a stable public URL like `https://api.mystorageapi.com/storage/<id>`.
+
+## How It Fits Together
+
+- Requires `api_key` and `org_id` from **myapihq**.
+- Upload supports `.png`, `.jpg`, `.jpeg` today. (Add more via `mystorageapi`'s backend if you need them.)
+- Assets are public — anyone with the URL can fetch.
+- **myimageapi** automatically uses storage for generated images, so generated images appear in `myapi storage list` too.
+
+## Quick Start
+
+```bash
+# Direct upload
+myapi storage upload ./logo.png --name "brand-logo"
+
+# Ingest a public URL (server pulls)
+myapi storage ingest https://example.com/hero.jpg --name "hero"
+
+# List
+myapi storage list
+
+# Get the public URL (curl-friendly)
+curl -O "$(myapi storage get <asset_id>)"
+
+# Delete
+myapi storage delete <asset_id>
+```
+
+## All Commands
+
+| Command | What it does |
+|---|---|
+| `myapi storage list` | List all stored assets |
+| `myapi storage upload <file>` | Direct multipart upload of a local file |
+| `myapi storage ingest <url>` | Server fetches a public URL into storage |
+| `myapi storage get <asset_id>` | Print the public CDN URL (no API call) |
+| `myapi storage delete <asset_id>` | Permanently delete the asset |
+
+## Upload vs Ingest
+
+Pick based on where the file is:
+
+- **`upload`** — file is on your machine. Multipart POST. Constraint: `.png` / `.jpg` / `.jpeg` only today.
+- **`ingest`** — file is at a public HTTP(S) URL. Server downloads and stores. Useful for migrating assets from another host or pulling in third-party images you have rights to.
+
+Both produce identical asset records — `list` doesn't distinguish them.
+
+## Naming
+
+Both `upload` and `ingest` accept `--name <display>` for a human-friendly label. If omitted:
+- `upload` defaults to the filename's basename.
+- `ingest` defaults to the URL path's filename or empty.
+
+The display name is for your reference only — the public URL uses the auto-generated id.
+
+## Public URLs
+
+`myapi storage get <id>` is a pure-local URL constructor — no API call, no auth, no rate limit. The output is exactly:
+```
+https://api.mystorageapi.com/storage/<id>
+```
+(or whatever `MYAPI_STORAGE_URL` is set to). Pipe it directly into curl:
+```bash
+curl -O "$(myapi storage get abc123)"
+```
+
+The URL itself is permanent until you `myapi storage delete <id>` — embed it freely in your funnels, emails, or anywhere else.
+
+## Notes
+
+- Assets are public by default. Don't store sensitive files.
+- Delete is immediate and unrecoverable.
+- Generated images from **myimageapi** show up in `storage list` under their job id.
+- If you need a non-image format (PDF, video, etc.), `ingest` works as long as the server-side storage accepts it; `upload` is restricted to image types.
+
+Run `myapi storage --help` for full flag reference.

package/dist/skills/my-storage-api/claude/.claude-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "my-storage-api",
+  "description": "Edge-hosted asset storage. Upload local files or ingest from URLs, each gets a stable public CDN URL.",
+  "version": "1.0.0",
+  "published": true
+}

package/dist/utils.js

@@ -1,4 +1,4 @@
-import { spinnerFrame, clearLine, error } from './output.js';
+import { spinnerFrame, spinnerWrite, clearLine, error } from './output.js';
 export function sleep(ms) {
     return new Promise(resolve => setTimeout(resolve, ms));
 }
@@ -23,7 +23,7 @@ export function formatDate(str) {
 export async function pollJob(opts) {
     const timeoutMs = opts.timeoutMs ?? 90_000;
     const intervalMs = opts.intervalMs ?? 3_000;
-    process.stdout.write(`${opts.label} `);
+    spinnerWrite(`${opts.label} `);
     let i = 0;
     let elapsed = 0;
     while (elapsed < timeoutMs) {
@@ -36,7 +36,7 @@ export async function pollJob(opts) {
             clearLine();
             error(opts.failedMessage ?? `${opts.label} failed`);
         }
-        process.stdout.write(`\r${opts.label} ${spinnerFrame(i++)}`);
+        spinnerWrite(`\r${opts.label} ${spinnerFrame(i++)}`);
         await sleep(intervalMs);
         elapsed += intervalMs;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myapihq/cli",
-  "version": "1.1.0-wip.2",
+  "version": "1.1.0-wip.4",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [