@myapihq/cli 1.1.0-wip.4 → 1.2.0

package/dist/skills/my-webhook-api/SKILL.md

@@ -1,138 +1,94 @@
 ---
 name: my-webhook-api
+version: 1.0.0
 description: >
-  Inbound webhook endpoints. Receive HTTP POSTs from third parties (forms, Stripe, GitHub, etc.) and either inspect the deliveries directly or wire them to a workflow.
+  Inbound webhook endpoints. Receive HTTP POSTs from third parties (forms, Stripe, GitHub, etc.) and either inspect deliveries directly or wire them to a workflow.
+triggers: [webhook, inbound, receiver, form submission, stripe events, slack notification, delivery, payload, event ingest]
+checksum: sha256-pending
 ---
 
 # MyWebhookAPI
 
-Per-org HTTP endpoints that accept inbound POSTs and durably store every delivery. A webhook on its own is a passive receiver — pair it with **myworkflowapi** to react to incoming events (send email, post to Slack, etc.).
+Per-org HTTP endpoints that accept inbound POSTs and durably store every delivery. A webhook on its own is a passive receiver — pair it with **myworkflowapi** to react to incoming events.
 
-## How It Fits Together
+## Capabilities
+<!-- llm:start -->
+Each endpoint has a unique inbound URL minted at create time. Anyone who knows the URL can POST to it; the body is stored verbatim along with headers and a timestamp. Deliveries are kept indefinitely (until you delete the endpoint).
 
-- Requires `api_key` and `org_id` from **myapihq**.
-- Each endpoint has a unique inbound URL (returned at create time).
-- Deliveries are stored verbatim — full request body + headers — for inspection.
-- `myworkflowapi` workflows bind to a webhook endpoint via its `id`.
+The inbound URL accepts **any JSON body** — no enforced schema, no required fields. Whatever you POST is what gets stored. Two consequences:
 
-## Quick Start
+1. **You decide the shape.** Form submission, Stripe event, custom payload — all work. Be consistent within one webhook so downstream workflows can reference fields reliably.
+2. **Workflows reference fields with `{{ payload.field }}` templating.** If your form POSTs `{"email":"alice@x.com","message":"hi"}`, a workflow step can do `--to "{{ payload.email }}"` to send a reply.
 
-```bash
-# 1. Create a webhook endpoint
-myapi webhook create "stripe-events" --description "Stripe payment events"
-# → prints: Inbound URL: https://api.myapihq.com/webhook/in/<slug>
-
-# 2. POST to the inbound URL from your service
-curl -X POST https://api.myapihq.com/webhook/in/<slug> \
-  -H "Content-Type: application/json" \
-  -d '{"event":"payment.succeeded"}'
-
-# 3. List endpoints / inspect a delivery
-myapi webhook list
-myapi webhook delivery <delivery_id>
-```
-
-## All Commands
+Treat the webhook slug as a secret — anyone with the URL can POST.
+<!-- llm:end -->
 
+## Commands
+<!-- generated:start -->
 | Command | What it does |
 |---|---|
-| `myapi webhook create` | Create an endpoint, returns id + inbound URL |
+| `myapi webhook create "<name>" [--description "..."]` | Create an endpoint, returns id + inbound URL |
 | `myapi webhook list` | List all endpoints in your org |
 | `myapi webhook delete <id>` | Delete an endpoint and all its deliveries |
 | `myapi webhook delivery <delivery_id>` | Get the full payload + headers for one delivery |
+<!-- generated:end -->
 
-## Wiring to a Workflow
-
-Webhooks become useful when a workflow fires on each inbound POST. See **myworkflowapi**:
-
+## Examples
+<!-- llm:start -->
 ```bash
-# Create the webhook
-WID=$(myapi webhook create "leads" --json | jq -r .id)
-
-# Bind a workflow that sends an email each time the webhook fires
-myapi workflow create "Notify on lead" \
-  --endpoint-id $WID \
-  --steps '[{"type":"send_email","to":"sales@yourdomain.com","subject":"New lead"}]'
-```
-
-## Payload contract
-
-The inbound URL accepts **any JSON body** — there's no enforced schema, no
-required fields. Whatever you POST is stored verbatim alongside the headers
-and a timestamp. The shape is whatever the sender chooses to send.
-
-That has two consequences:
+# 1. Create a webhook
+myapi webhook create "stripe-events" --description "Stripe payment events"
+# → prints: Inbound URL: https://api.mywebhookapi.com/webhook/in/<slug>
 
-1. **You decide the shape.** A form, a Stripe event, a custom payload — all
-   work. Be consistent within one webhook so downstream workflows can
-   reference fields reliably.
-2. **Workflows reference fields with `{{ payload.field }}` templating.**
-   If your form POSTs `{"email": "alice@x.com", "message": "hi"}`, a
-   workflow step can do `--to "{{ payload.email }}"` to send a reply to
-   whoever submitted.
+# 2. POST to it from your service
+curl -X POST https://api.mywebhookapi.com/webhook/in/<slug> \
+  -H "Content-Type: application/json" \
+  -d '{"event":"payment.succeeded"}'
+# → responds with {"delivery_id":"<uuid>"} — capture this to inspect later
 
-Inbound responses: 200 OK on success, 4xx if the endpoint is missing or
-the body isn't valid JSON.
+# 3. Inspect a delivery by id (there is no list-deliveries route)
+myapi webhook delivery <delivery_id>
+```
 
-## End-to-end recipe — contact form on your website
+### End-to-end recipe — contact form on your site
 
-Goal: a contact form on yoursite.com. When someone submits, send a
-thank-you email to them and a Slack ping to your team.
+A contact form on yoursite.com that sends a thank-you email and a Slack ping when submitted:
 
 ```bash
-# 1. Create a webhook to receive form submissions
 WID=$(myapi webhook create "contact-form" --json | jq -r .id)
 WURL=$(myapi webhook list --json | jq -r ".[] | select(.id==\"$WID\") | .url")
 
-# 2. Create the workflow that fires on every submission
 myapi workflow create "Contact form handler" \
   --endpoint-id $WID \
-  --steps "$(cat <<'JSON'
-[
-  {
-    "type": "send_email",
-    "from": "hello@yoursite.com",
-    "to": "{{ payload.email }}",
-    "subject": "Thanks for reaching out, {{ payload.name }}!",
-    "body": "We got your message and will reply within 24 hours."
-  },
-  {
-    "type": "slack",
-    "webhook_url": "https://hooks.slack.com/services/T.../B.../xxx",
-    "text": "New contact form submission from {{ payload.name }} ({{ payload.email }}): {{ payload.message }}"
-  }
-]
-JSON
-)"
-
-# 3. Drop this form in your HTML — it POSTs JSON to the webhook
-echo "<form id='contact'>
+  --steps '[
+    {"type":"send_email","from":"hello@yoursite.com","to":"{{ payload.email }}","subject":"Thanks, {{ payload.name }}!","body":"We got your message."},
+    {"type":"slack","webhook_url":"https://hooks.slack.com/...","text":"New form submission from {{ payload.name }}"}
+  ]'
+
+# Drop this in your HTML — POSTs JSON to $WURL
+echo "<form id='c'>
   <input name='name' required>
   <input name='email' type='email' required>
   <textarea name='message' required></textarea>
   <button>Send</button>
 </form>
 <script>
-document.getElementById('contact').addEventListener('submit', async e => {
+document.getElementById('c').onsubmit = async e => {
   e.preventDefault();
-  const data = Object.fromEntries(new FormData(e.target));
-  await fetch('$WURL', {
-    method: 'POST',
-    headers: {'Content-Type': 'application/json'},
-    body: JSON.stringify(data),
-  });
-  alert('Thanks! Check your inbox.');
-});
+  await fetch('$WURL', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(Object.fromEntries(new FormData(e.target)))});
+  alert('Thanks!');
+};
 </script>"
 ```
 
-The form sends `{"name": "...", "email": "...", "message": "..."}` →
-webhook stores it → workflow fires → email goes out → Slack gets pinged.
+The form sends `{name, email, message}` → webhook stores it → workflow runs both steps → email + Slack ping.
+<!-- llm:end -->
 
 ## Notes
 
-- The inbound URL is public — anyone with the URL can POST to it. Treat the slug as a secret.
+- The inbound URL is public — anyone with it can POST. Treat the slug as a secret.
 - Deliveries are kept indefinitely. Delete the endpoint to purge them.
-- Failed workflow runs do not affect the delivery record — the inbound POST is always saved.
+- Failed workflow runs don't affect the delivery record — the inbound POST is always saved.
+- Inbound responses: `200` on success, `4xx` if the endpoint is missing or body isn't valid JSON.
 
 Run `myapi webhook --help` for full flag reference.

package/dist/skills/my-workflow-api/SKILL.md

@@ -1,109 +1,83 @@
 ---
 name: my-workflow-api
+version: 1.0.0
 description: >
   Run actions when a webhook fires. Trigger emails, Slack notifications, or HTTP calls in response to inbound webhook deliveries — without writing a backend.
+triggers: [workflow, automation, on webhook, send email on, slack notification, payload templating, drip, trigger, run]
+checksum: sha256-pending
 ---
 
 # MyWorkflowAPI
 
-Workflows bind a list of steps to a webhook endpoint. Every time the webhook receives a POST, the workflow runs its steps in order. Each run is recorded with its status, attempt count, and any error.
+Workflows bind a list of steps to a webhook endpoint. Every time the webhook receives a POST, the workflow runs its steps in order. Each run is recorded with status, attempt count, and any error.
 
-## How It Fits Together
+## Capabilities
+<!-- llm:start -->
+A workflow is the "do something when X happens" layer. The trigger is always a **mywebhookapi** endpoint. Steps run sequentially per inbound delivery; failed runs don't block subsequent runs and don't affect the stored webhook delivery.
 
-- Requires `api_key` and `org_id` from **myapihq**.
-- Requires a webhook endpoint id from **mywebhookapi** as the trigger.
-- Steps can reference other services — e.g. send an email via **myemailapi**.
+Step types today:
 
-## Quick Start
-
-```bash
-# 1. Create the webhook that will trigger the workflow
-WID=$(myapi webhook create "leads" --json | jq -r .id)
-
-# 2. Create a workflow bound to that webhook
-myapi workflow create "Slack on new lead" \
-  --endpoint-id $WID \
-  --steps '[{"type":"slack","webhook_url":"https://hooks.slack.com/..."}]'
+| Type | Aliases | Required fields |
+|---|---|---|
+| `send_email` | `email` | `from`, `to`, `subject`, plus one of `body` / `html` / `template_id` |
+| `slack_message` | `slack` | `webhook_url`, `text` |
 
-# 3. POST to the webhook → workflow fires
-curl -X POST <webhook-inbound-url> -d '{"name":"Alice"}'
+Both step types support **payload templating** with `{{ payload.fieldname }}`. The webhook payload is the entire POST body; named fields are accessed dotted. Whitespace inside braces is fine — both `{{ payload.email }}` and `{{payload.email}}` work.
 
-# 4. Inspect runs
-myapi workflow runs <workflow_id>
-myapi workflow get-run <run_id>
-```
+Unknown step types are rejected at create time, so typos surface immediately rather than after 3 failed retries during execution.
 
-## All Commands
+Workflows can be created `--no-enable` so you can test the flow before going live.
+<!-- llm:end -->
 
+## Commands
+<!-- generated:start -->
 | Command | What it does |
 |---|---|
-| `myapi workflow create` | Create a new workflow (`--name --endpoint-id --steps`) |
+| `myapi workflow create "<name>" --endpoint-id <id> --steps '<json>' [--no-enable]` | Create a workflow |
 | `myapi workflow list` | List workflows in your org |
-| `myapi workflow get <id>` | Inspect a workflow's steps + trigger config |
+| `myapi workflow get <id>` | Inspect steps + trigger config |
 | `myapi workflow update <id>` | Change name, endpoint, or steps |
 | `myapi workflow enable <id>` | Enable firing |
 | `myapi workflow disable <id>` | Stop firing without deleting |
 | `myapi workflow delete <id>` | Permanently remove workflow + run history |
 | `myapi workflow runs <id>` | List recent runs (status, attempt, errors) |
 | `myapi workflow get-run <run_id>` | Get full run details + step output |
+<!-- generated:end -->
 
-## Steps
+## Examples
+<!-- llm:start -->
+```bash
+# 1. Webhook to act on
+WID=$(myapi webhook create "leads" --json | jq -r .id)
 
-`--steps` is a JSON array of step objects. Each step has a `type` and type-specific fields.
+# 2. Workflow that pings Slack on every inbound POST
+myapi workflow create "Slack on new lead" \
+  --endpoint-id $WID \
+  --steps '[{"type":"slack","webhook_url":"https://hooks.slack.com/...","text":"new lead!"}]'
 
-Supported step types (alias forms in parentheses):
+# 3. Trigger it
+curl -X POST <webhook-inbound-url> -d '{"name":"Alice"}'
 
-| `type` | Aliases | Required fields |
-|---|---|---|
-| `send_email` | `email` | `from`, `to`, `subject`, plus one of `body` / `html` / `template_id` |
-| `slack_message` | `slack` | `webhook_url`, `text` |
+# 4. Inspect runs
+myapi workflow runs <workflow_id>
+myapi workflow get-run <run_id>
 
-```json
-[
-  {
-    "type": "email",
-    "from": "hello@yourdomain.com",
-    "to": "{{ payload.email }}",
-    "subject": "Welcome, {{ payload.name }}",
-    "template_id": "<template_id>"
-  },
-  {
-    "type": "slack",
-    "webhook_url": "https://hooks.slack.com/services/T.../B.../xxx",
-    "text": "New submission from {{ payload.name }}"
-  }
-]
+# Test before going live
+myapi workflow create "X" --endpoint-id $WID --steps '...' --no-enable
+# ... iterate ...
+myapi workflow enable <id>
 ```
 
-Unknown step types are rejected at workflow create time, so typos surface
-immediately instead of after 3 failed retries during execution.
-
-The webhook payload is available as `{{ payload }}` and individual fields
-as `{{ payload.fieldname }}`. Whitespace inside the braces is fine —
-both `{{ payload.email }}` and `{{payload.email}}` work.
-
-## End-to-end recipe — react to a contact form submission
-
-Goal: form on yoursite.com posts to a webhook → workflow sends a thank-you
-email and pings Slack. Full HTML + commands:
-
-```bash
-# 1. Create the webhook to receive submissions
-WID=$(myapi webhook create "contact-form" --json | jq -r .id)
-WURL=$(myapi webhook list --json | jq -r ".[] | select(.id==\"$WID\") | .url")
+### Multi-step example with payload templating
 
-# 2. Workflow that fires on each submission. Two steps: thank-you email
-#    + Slack ping. Both reference fields from the form payload via {{ }}.
-myapi workflow create "Contact form handler" \
-  --endpoint-id $WID \
-  --steps "$(cat <<'JSON'
+```json
 [
   {
     "type": "send_email",
     "from": "hello@yoursite.com",
     "to": "{{ payload.email }}",
-    "subject": "Thanks for reaching out, {{ payload.name }}!",
-    "body": "We got your message and will reply within 24 hours."
+    "subject": "Thanks, {{ payload.name }}",
+    "template_id": "<template_id>"
   },
   {
     "type": "slack",
@@ -111,57 +85,14 @@ myapi workflow create "Contact form handler" \
     "text": "New submission from {{ payload.name }} ({{ payload.email }}): {{ payload.message }}"
   }
 ]
-JSON
-)"
-
-# 3. The HTML form on yoursite.com — POSTs JSON to the webhook
-echo "<form id='contact'>
-  <input name='name' required>
-  <input name='email' type='email' required>
-  <textarea name='message' required></textarea>
-  <button>Send</button>
-</form>
-<script>
-document.getElementById('contact').addEventListener('submit', async e => {
-  e.preventDefault();
-  const data = Object.fromEntries(new FormData(e.target));
-  await fetch('$WURL', {
-    method: 'POST',
-    headers: {'Content-Type': 'application/json'},
-    body: JSON.stringify(data),
-  });
-  alert('Thanks! Check your inbox.');
-});
-</script>"
-```
-
-The form sends `{"name": "...", "email": "...", "message": "..."}`. The
-webhook stores it. The workflow runs both steps in order: the user gets
-an email at the address they typed, your team gets a Slack ping with the
-message. Each invocation is recorded — `myapi workflow runs <id>` shows
-the history.
-
-## Lifecycle
-
-```bash
-# Create disabled, test, then enable
-myapi workflow create "X" --endpoint-id $WID --steps '...' --no-enable
-
-# Trigger via webhook POST, inspect
-myapi workflow runs <id>
-
-# When ready
-myapi workflow enable <id>
-
-# To temporarily stop
-myapi workflow disable <id>
 ```
+<!-- llm:end -->
 
 ## Notes
 
 - Workflows fire on every webhook delivery. Failed runs don't block subsequent runs.
-- Each run records its attempt number, started_at/finished_at, and any error.
-- A workflow can be disabled to stop firing without losing the configuration.
+- Each run records attempt number, started_at/finished_at, and any error.
+- Disable to stop firing without losing the configuration.
 - Deleting a workflow purges its run history; the webhook endpoint remains.
 
 Run `myapi workflow --help` for full flag reference.

package/dist/telemetry.d.ts

@@ -0,0 +1,12 @@
+declare function resolveHqBase(): string;
+export interface SkillsInstallEvent {
+    agents_targeted: string[];
+    cli_version: string;
+}
+export declare function emitSkillsInstall(agentsTargeted: string[], cliVersion: string): void;
+export declare const __TELEMETRY_INTERNAL__: {
+    resolveHqBase: typeof resolveHqBase;
+    ENDPOINT_PATH: string;
+    TIMEOUT_MS: number;
+};
+export {};

package/dist/telemetry.js

@@ -0,0 +1,80 @@
+// Telemetry client — emits the single `skills.install` event to the backend
+// so the north-star metric (skills installations) can be aggregated.
+//
+// Design (per integrations PRD FR-013 + architecture Subsystem C):
+//   - Single event: only fires when `myapi install-skills` succeeds.
+//     Every other meaningful CLI operation already calls the backend
+//     under the user's auth, so backend access logs cover those for free.
+//   - Authenticated: bearer-token from ~/.myapi/config. If the user
+//     isn't authenticated, silently skip (no anonymous events).
+//   - Fire-and-forget: 200 ms timeout, `req.unref()` so it never blocks
+//     process exit. Errors swallowed.
+//   - No PII: only `agents_targeted` (a closed-set array of "claude" |
+//     "gemini" | "cursor") and the CLI version. The bearer already
+//     identifies the account; the backend handles any anonymization.
+import * as http from 'node:http';
+import * as https from 'node:https';
+import { URL } from 'node:url';
+import { loadConfig } from './config.js';
+// Resolved per-call so tests / local dev can override via env var without
+// having to reset the module. Default matches the SDK's HQ_BASE convention.
+function resolveHqBase() {
+    return process.env.MYAPI_HQ_URL ?? process.env.MYAPI_API_BASE ?? 'https://api.myapihq.com';
+}
+const ENDPOINT_PATH = '/v1/integrations/skills-install';
+const TIMEOUT_MS = 200;
+// Emit the event. Returns immediately; the request runs in the background
+// (unref'd) and silently dies on error/timeout. Never throws.
+export function emitSkillsInstall(agentsTargeted, cliVersion) {
+    const config = loadConfig();
+    if (!config?.api_key)
+        return; // not authenticated → no event, by design
+    let target;
+    try {
+        target = new URL(ENDPOINT_PATH, resolveHqBase());
+    }
+    catch {
+        return;
+    } // bad URL → silently no-op
+    const lib = target.protocol === 'https:' ? https : http;
+    const payload = {
+        agents_targeted: agentsTargeted,
+        cli_version: cliVersion,
+    };
+    const body = JSON.stringify(payload);
+    let req;
+    try {
+        req = lib.request({
+            hostname: target.hostname,
+            port: target.port ? Number(target.port) : (target.protocol === 'https:' ? 443 : 80),
+            path: target.pathname,
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${config.api_key}`,
+                'content-type': 'application/json',
+                'content-length': Buffer.byteLength(body),
+            },
+            timeout: TIMEOUT_MS,
+        }, 
+        // We don't care about the response; consume it so the socket can close.
+        (res) => { res.resume(); });
+    }
+    catch {
+        return; // hostname parse error etc.
+    }
+    req.on('error', () => { });
+    req.on('timeout', () => req.destroy());
+    // unref the underlying socket so the request never blocks process exit.
+    // ClientRequest itself doesn't expose unref(); the socket does.
+    req.on('socket', (socket) => { try {
+        socket.unref();
+    }
+    catch { } });
+    req.end(body);
+}
+// Exposed for tests.
+export const __TELEMETRY_INTERNAL__ = {
+    resolveHqBase,
+    ENDPOINT_PATH,
+    TIMEOUT_MS,
+};

package/dist/telemetry.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/telemetry.test.js

@@ -0,0 +1,101 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as http from 'node:http';
+// Mock the config module so we can inject api_key per-test without
+// touching the real ~/.myapi/config.json.
+let mockedConfig = null;
+vi.mock('./config.js', () => ({
+    loadConfig: () => mockedConfig,
+}));
+import { emitSkillsInstall } from './telemetry.js';
+function withTestServer() {
+    return new Promise((resolve) => {
+        const received = [];
+        const server = http.createServer((req, res) => {
+            const chunks = [];
+            req.on('data', (c) => chunks.push(c));
+            req.on('end', () => {
+                received.push({
+                    method: req.method ?? '',
+                    url: req.url ?? '',
+                    headers: Object.fromEntries(Object.entries(req.headers).map(([k, v]) => [k, Array.isArray(v) ? v.join(',') : (v ?? '')])),
+                    body: Buffer.concat(chunks).toString('utf-8'),
+                });
+                res.statusCode = 204;
+                res.end();
+            });
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (!addr || typeof addr === 'string')
+                throw new Error('bad address');
+            const url = `http://127.0.0.1:${addr.port}`;
+            resolve({
+                url,
+                received,
+                close: () => server.close(),
+            });
+        });
+    });
+}
+function wait(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+describe('emitSkillsInstall', () => {
+    let originalHqUrl;
+    let originalApiBase;
+    let server;
+    beforeEach(async () => {
+        server = await withTestServer();
+        originalHqUrl = process.env.MYAPI_HQ_URL;
+        originalApiBase = process.env.MYAPI_API_BASE;
+        process.env.MYAPI_HQ_URL = server.url;
+        delete process.env.MYAPI_API_BASE;
+        mockedConfig = null;
+    });
+    afterEach(() => {
+        server.close();
+        if (originalHqUrl === undefined)
+            delete process.env.MYAPI_HQ_URL;
+        else
+            process.env.MYAPI_HQ_URL = originalHqUrl;
+        if (originalApiBase === undefined)
+            delete process.env.MYAPI_API_BASE;
+        else
+            process.env.MYAPI_API_BASE = originalApiBase;
+    });
+    it('posts to /v1/integrations/skills-install with bearer + JSON body when authenticated', async () => {
+        mockedConfig = { api_key: 'hq_live_TESTKEY' };
+        emitSkillsInstall(['claude', 'gemini'], '1.2.3');
+        await wait(150);
+        expect(server.received).toHaveLength(1);
+        const r = server.received[0];
+        expect(r.method).toBe('POST');
+        expect(r.url).toBe('/v1/integrations/skills-install');
+        expect(r.headers.authorization).toBe('Bearer hq_live_TESTKEY');
+        expect(r.headers['content-type']).toBe('application/json');
+        const body = JSON.parse(r.body);
+        expect(body).toEqual({ agents_targeted: ['claude', 'gemini'], cli_version: '1.2.3' });
+    });
+    it('silently skips emission when config has no api_key', async () => {
+        mockedConfig = null; // no config
+        emitSkillsInstall(['claude'], '1.2.3');
+        await wait(50);
+        expect(server.received).toHaveLength(0);
+    });
+    it('silently skips emission when config has empty api_key', async () => {
+        mockedConfig = {};
+        emitSkillsInstall(['claude'], '1.2.3');
+        await wait(50);
+        expect(server.received).toHaveLength(0);
+    });
+    it('does not throw on connection failure (fire-and-forget guarantee)', () => {
+        mockedConfig = { api_key: 'hq_live_TESTKEY' };
+        process.env.MYAPI_HQ_URL = 'http://127.0.0.1:1'; // unreachable
+        expect(() => emitSkillsInstall(['claude'], '1.2.3')).not.toThrow();
+    });
+    it('does not throw on malformed URL', () => {
+        mockedConfig = { api_key: 'hq_live_TESTKEY' };
+        process.env.MYAPI_HQ_URL = 'not-a-url';
+        expect(() => emitSkillsInstall(['claude'], '1.2.3')).not.toThrow();
+    });
+});

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@myapihq/cli",
-  "version": "1.1.0-wip.4",
+  "license": "Apache-2.0",
+  "version": "1.2.0",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -14,20 +15,24 @@
     "prebuild": "node scripts/copy-skills.js",
     "build": "tsc && rm -rf dist/skills && cp -r src/skills dist/skills",
     "dev": "tsc --watch",
-    "test": "vitest run src",
-    "test:smoke": "npm run build && vitest run src test/smoke",
+    "test": "vitest run src test/scripts",
+    "test:smoke": "npm run build && vitest run src test/smoke test/scripts",
     "test:online": "npm run build && MYAPI_RUN_RESET=1 vitest run test/online",
-    "test:all": "npm run build && MYAPI_RUN_RESET=1 vitest run src test/smoke test/online"
+    "test:all": "npm run build && MYAPI_RUN_RESET=1 vitest run src test/smoke test/scripts test/online",
+    "check-coverage": "npm run build && node scripts/check-coverage.js",
+    "check-coverage:live": "npm run build && node scripts/check-coverage.js --live",
+    "update-schema": "node scripts/update-schema.js",
+    "lint:skills": "node scripts/lint-skills.js",
+    "lint:skills:strict": "node scripts/lint-skills.js --strict",
+    "lint:changelog": "node ../../scripts/lint-changelog.js"
   },
   "dependencies": {
-    "@myapihq/sdk": "1.1.0-wip.0",
-    "omelette": "^0.4.17",
-    "update-notifier": "^7.3.1"
+    "@myapihq/sdk": "^1.2.0",
+    "omelette": "^0.4.17"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
     "@types/omelette": "^0.4.5",
-    "@types/update-notifier": "^6.0.8",
     "typescript": "^5.4.0",
     "vitest": "^4.1.5"
   }