@myapihq/cli 1.1.0-wip.4 → 1.2.0

package/dist/skills/my-crm-api/SKILL.md

@@ -0,0 +1,165 @@
+---
+name: my-crm-api
+version: 1.0.0
+description: >
+  The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
+triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
+checksum: sha256-pending
+---
+
+# MyCRMAPI
+
+The store that closes the funnel. Today's loop without CRM: discover people (Goldfox) → save audience → send email → track pixel → form-fill via webhook → … nothing. People who *engage* live nowhere. CRM is where they land — automatically.
+
+## Capabilities
+<!-- llm:start -->
+
+### Where CRM sits in the stack
+
+- **mypeopleapi / mycompanyapi** — read-only Goldfox global lead universe (the crawl)
+- **myaudienceapi** — saved filter snapshots over Goldfox
+- **mycrmapi** — engaged contacts + companies, *private to your org*, with engagement history
+
+A Goldfox row becomes a CRM contact when:
+1. You explicitly **promote** it (`myapi crm contacts promote <goldfox_person_id>`)
+2. *Or* a downstream service receives engagement for that email and auto-upserts the contact
+
+### Lifecycle stages (fixed enum — same for contacts and companies)
+
+```
+cold | warm | qualified | customer | churned
+```
+
+Move stage with `myapi crm contacts update <id> --stage qualified`. Every stage change emits a `stage_changed` event with `{from, to}` so the timeline shows the journey.
+
+### Contact sources (fixed enum)
+
+```
+goldfox | email | pixel | webhook | manual
+```
+
+Set automatically based on how the contact entered the CRM. Useful filter when you want "only contacts I've personally added" (`--source manual`) vs "warmed via Goldfox outreach" (`--source goldfox`).
+
+### Event timeline — reserved kinds
+
+```
+created | promoted | stage_changed
+email_sent | email_opened | email_clicked | email_replied
+pixel_visit | webhook_received
+```
+
+Agents cannot write events directly — the closed enum is intentional. If you need custom state, use **mydatabaseapi** (KV) keyed on the contact id; the curated timeline stays authoritative for engagement.
+
+**Engagement-event kinds bump `last_engagement_at`**: email_sent/opened/clicked/replied, pixel_visit, webhook_received. Admin kinds (created, promoted, stage_changed) don't. That's the right semantics — promoting a Goldfox lead into the CRM is not engagement.
+
+### Auto-ingest
+
+Today (v1):
+- **Webhook**: configurable per endpoint via `crm_email_path` — a JSON dot-path. Default `"email"` ingests `{"email":"x@y.com"}`. For Stripe, set `data.object.customer_email`; for GitHub, `sender.email`. Empty string disables ingest for that endpoint.
+
+Coming next (backend wiring in progress):
+- **Email**: every `myapi email message send` writes `email_sent`; opens/clicks fire `email_opened`/`email_clicked`
+- **Pixel**: `identify` calls with an email write `pixel_visit`
+
+If a contact doesn't exist for the matched email, it's auto-created with `source=` matching the originating service. The contact's company is auto-linked by email domain (creates the company on first sight).
+
+### Soft delete + restore
+
+`myapi crm contacts delete <id>` sets `deleted_at` but **retains the event timeline**. By default soft-deleted contacts are excluded from search — pass `--include-deleted` to see them. Restore with `myapi crm contacts restore <id>`.
+
+### Goldfox enrichment (deferred)
+
+A CRM contact promoted from Goldfox carries a `goldfox_person_id` reference. In v2 the GET response will join to Goldfox live, embedding the latest row inline as `goldfox_person`. Today that field is null until the BQ get-by-id helper lands. Search filters that hit Goldfox-only fields are not yet wired into CRM search.
+
+### Search filter — re-engagement semantics
+
+`--max-last-engagement-days N` returns contacts last engaged *more than* N days ago. This intentionally **includes contacts with no engagement at all** (promoted-but-never-emailed Goldfox leads), because those are exactly the natural targets of a re-engagement campaign. If you want to distinguish "never tried" from "tried and went cold," layer `--source goldfox` (never engaged after promotion) or post-filter the JSON.
+
+### Failure modes
+
+- `404 CONTACT_NOT_FOUND` / `COMPANY_NOT_FOUND`
+- `409` on duplicate email/domain in the same org
+- `400 INVALID_STAGE` if you pass a value outside the enum
+- `400 GOLDFOX_PERSON_NOT_FOUND` on promote with an unknown id
+<!-- llm:end -->
+
+## Commands
+<!-- generated:start -->
+
+### Contacts
+| Command | What it does |
+|---|---|
+| `myapi crm contacts list [--limit N]` | List all contacts (newest engagement first) |
+| `myapi crm contacts search [--stage ...] [--source ...] [--email ...] [--min/max-last-engagement-days N]` | Filter contacts |
+| `myapi crm contacts create <email> [--first-name ...] [--last-name ...] [--stage ...] [--custom-json ...]` | Manually create (source='manual') |
+| `myapi crm contacts get <id>` | Fetch one contact (with embedded Goldfox enrichment when available) |
+| `myapi crm contacts update <id> [--stage ...] [...]` | Patch fields. Stage change emits `stage_changed` event |
+| `myapi crm contacts delete <id>` | Soft delete (events retained) |
+| `myapi crm contacts restore <id>` | Restore a soft-deleted contact |
+| `myapi crm contacts promote <goldfox_person_id>` | Idempotent Goldfox → CRM promotion |
+| `myapi crm contacts events <id> [--kind ...]` | Timeline (newest first), filter by kind |
+
+### Companies
+| Command | What it does |
+|---|---|
+| `myapi crm companies list / search / create / get / update / delete / restore` | Same shape as contacts |
+| `myapi crm companies promote <domain>` | Goldfox company id IS its domain — pass the domain |
+
+<!-- generated:end -->
+
+All commands accept `--org <id>` (or set default: `myapi config set-org <id>`) and `--json` for machine-readable output.
+
+## Examples
+<!-- llm:start -->
+```bash
+# Discover → promote → engage workflow
+myapi people search --keyword saas --has-c-level --country US --limit 5 --json \
+  | jq -r '.people[].id' \
+  | while read pid; do myapi crm contacts promote "$pid"; done
+
+# Find everyone in 'qualified' for a follow-up email
+myapi crm contacts search --stage qualified --json | jq -r '.contacts[].email'
+
+# Re-engagement: contacts last engaged > 30 days ago (or never engaged at all)
+myapi crm contacts search --max-last-engagement-days 30
+
+# Manual add + tag with custom fields
+myapi crm contacts create alice@acme.com \
+  --first-name Alice --stage warm \
+  --custom-json '{"intro_via":"riccardo","topic":"video editing"}'
+
+# Update stage as the deal progresses — emits a stage_changed event
+myapi crm contacts update <id> --stage qualified
+myapi crm contacts update <id> --stage customer
+
+# See the full engagement timeline
+myapi crm contacts events <id>
+
+# What landed in CRM from this Stripe webhook?
+myapi crm contacts search --source webhook --json \
+  | jq '.contacts[] | {email, last_engagement_at}'
+```
+
+### End-to-end recipe — configure a webhook that auto-creates CRM contacts
+
+```bash
+# Endpoint that ingests Stripe customer.created events
+WH=$(myapi webhook create stripe --crm-email-path 'data.object.customer_email' --json)
+URL=$(echo "$WH" | jq -r .url)
+echo "Point Stripe at: $URL"
+
+# Later, after Stripe fires...
+myapi crm contacts search --source webhook --email "$STRIPE_CUSTOMER_EMAIL"
+myapi crm contacts events <id> --kind webhook_received
+```
+<!-- llm:end -->
+
+## Notes
+
+- **Reserved event kinds — no custom events in v1.** If an agent needs custom state per contact, use `myapi database` keyed by contact id. The curated timeline stays the authoritative engagement record.
+- **Event payloads carry an `external_id`** field used by the backend's idempotency index — same value as the natural id of the underlying action (`goldfox_person_id` for `promoted`, `delivery_id` for `webhook_received`, future `message_id` for `email_sent`). Read the semantic field (e.g. `goldfox_person_id`); `external_id` is a backend-internal duplicate. Old rows may still carry a legacy `message_id` field — same value as `external_id`; safe to ignore.
+- **Goldfox enrichment field deferred** — the live join lands once the BQ get-by-id helper is wired backend-side. CLI treats it as optional today.
+- **Email + Pixel auto-ingest not yet wired**. Only `webhook_received` events fire today. Email and pixel ingest are coming — the CLI surface stays unchanged when they land.
+- **Free in v1.** Metered later if usage shows a need.
+
+Run `myapi crm --help` or `myapi crm <namespace> --help` for inline reference.

package/dist/skills/my-crm-api/claude/.claude-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "my-crm-api",
+  "description": "The canonical store of engaged people + companies. Auto-ingest from inbound webhooks (configurable dot-path). Fixed lifecycle_stage enum, soft delete, event timeline.",
+  "version": "1.0.0",
+  "published": true
+}

package/dist/skills/my-database-api/README.md

@@ -0,0 +1,41 @@
+# my-database-api
+
+Per-org KV store with namespaces. JSON values up to 256 KB per key. Compare-and-swap via `If-Match` etags. The substrate for stateful agent-built apps on MyAPI.
+
+## What it does
+
+- Explicit, named namespaces (containers for keys)
+- `get` / `set` / `del` / list keys (with prefix + cursor pagination)
+- Inline values on list via `--values`
+- Optimistic concurrency: `--if-match <etag>` returns an error if another writer raced
+
+## Quickstart
+
+```bash
+myapi database create my-app
+myapi database set users '{"alice":{"plan":"pro"}}' --ns my-app
+myapi database get users --ns my-app
+myapi database keys --ns my-app --values
+```
+
+## Authentication
+
+```bash
+export MYAPI_KEY=mak_...
+```
+
+Requires `api_key` and `org_id` from **myapihq**.
+
+## When to use
+
+- Application state for a function or workflow: sessions, lookup tables, idempotency keys, lightweight counters
+- Storing the state behind a CRM-like product an agent builds (the user table, the per-user URL ownership map)
+- Anything where you'd reach for Redis but don't need its perf envelope
+
+When **not** to use: blobs/binary (use `myapi storage`), large rows (>256 KB), complex queries (no secondary indexes today — prefix scans only).
+
+## Documentation
+
+Per-key size limit, CAS semantics, pagination model: see `SKILL.md`.
+
+Run `myapi database --help` for inline reference.

package/dist/skills/my-database-api/SKILL.md

@@ -0,0 +1,107 @@
+---
+name: my-database-api
+version: 1.0.0
+description: >
+  Per-org KV store with named namespaces, JSON values up to 256 KB, prefix-scan listing, and compare-and-swap via etag. The substrate for any stateful agent-built app on MyAPI — user tables, session stores, idempotency keys, per-user lookup maps.
+triggers: [database, kv, key value, namespace, store, state, etag, cas, session, idempotency]
+checksum: sha256-pending
+---
+
+# MyDatabaseAPI
+
+A small KV primitive scoped to your MyAPI org. Two resources: namespaces (containers) and keys (the actual values). Values are JSON; binary belongs in `myapi storage`. Compare-and-swap via etags is supported on day one.
+
+## Capabilities
+<!-- llm:start -->
+Use this when you need **state behind a workflow or a function** — the user table for a SaaS the agent is building on MyAPI primitives, a per-customer settings store, idempotency keys for webhook handlers, a session cache. Anything where Redis is overkill but raw env-var configuration isn't enough.
+
+### Model
+- An **organization** owns many **namespaces**
+- A **namespace** owns many **keys**
+- A **key** points to one JSON **value** (≤ 256 KB serialized)
+- Every value has an opaque **etag** that changes on every successful write
+
+### Limits
+- **Key** ≤ 512 bytes (UTF-8)
+- **Value** ≤ 256 KB serialized JSON. For blobs/binary, use `myapi storage`.
+- **Namespace name** matches `^[a-z0-9][a-z0-9_-]{0,62}$`; the `__myapi_` prefix is reserved.
+
+### Compare-and-swap
+Pass `--if-match <etag>` from a previous `get` to make `set` or `del` conditional. Returns an error if another writer changed the value between your read and write. Without `--if-match`, last-write-wins.
+
+### Listing
+- Default: keys only, one per line
+- `--values` adds inline values + etags (cost: a bigger response payload)
+- `--prefix foo` for prefix-scoped listing
+- `--limit N` (1–1000, default 50)
+- Paginates via `--cursor` — the previous response's `next_cursor`
+
+### Failure modes
+- `412 ETAG_MISMATCH` on CAS conflict (CLI surfaces it as a friendly error)
+- `404 NAMESPACE_NOT_FOUND` / `KEY_NOT_FOUND`
+- `409 NAMESPACE_EXISTS` on re-create
+- `400 VALUE_NOT_JSON` if the body's `value` isn't valid JSON
+- `413 VALUE_TOO_LARGE` if you exceed 256 KB (CLI also pre-flight checks)
+<!-- llm:end -->
+
+## Commands
+<!-- generated:start -->
+| Command | What it does |
+|---|---|
+| `myapi database namespaces [--json]` | List namespaces in the org |
+| `myapi database create <name>` | Create a namespace |
+| `myapi database delete-namespace <name>` | Delete namespace AND all its keys (irreversible) |
+| `myapi database keys --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>]` | List keys, optionally with inline values |
+| `myapi database get <key> --ns <ns>` | Get value + etag (etag printed to stderr) |
+| `myapi database set <key> <value-json> --ns <ns> [--if-match <etag>] [--file <path>]` | Set key. CAS via --if-match |
+| `myapi database del <key> --ns <ns> [--if-match <etag>]` | Delete key. CAS via --if-match |
+<!-- generated:end -->
+
+Pass `-` as `<value-json>` to read the value from stdin, or `--file <path>` to read from a file.
+
+## Examples
+<!-- llm:start -->
+```bash
+# Create a namespace, set a key, read it back
+myapi database create my-app
+myapi database set user:alice '{"plan":"pro","trial_ends":"2026-06-01"}' --ns my-app
+myapi database get user:alice --ns my-app
+# stdout: {"plan":"pro","trial_ends":"2026-06-01"}
+# stderr: — etag=A1B2C3 · updated=2026-05-12T17:00:00Z
+
+# List keys with a prefix
+myapi database keys --ns my-app --prefix user: --values
+
+# Compare-and-swap update
+ETAG=$(myapi database get user:alice --ns my-app --json | jq -r .etag)
+myapi database set user:alice '{"plan":"enterprise"}' --ns my-app --if-match "$ETAG"
+
+# Idempotency keys for a webhook handler
+myapi database set "delivery:$DELIVERY_ID" 'true' --ns idempotency --if-match '"00000000"' \
+  || { echo "already processed"; exit 0; }
+```
+
+### End-to-end recipe — user table for an agent-built SaaS
+
+```bash
+# Bootstrap a "users" namespace
+myapi database create users
+
+# Sign-up handler: webhook receives { email, name } → store the user
+myapi database set "by-email:$EMAIL" "$(jq -nc --arg n "$NAME" '{name:$n, plan:"trial"}')" \
+  --ns users
+
+# Login handler: look up by email
+myapi database get "by-email:$EMAIL" --ns users --json | jq -r .value
+```
+<!-- llm:end -->
+
+## Notes
+
+- **No transactions across keys.** Each key is independently atomic; multi-key updates aren't atomic. Use a single composite-JSON value if you need joint atomicity.
+- **No secondary indexes today.** Prefix scans are the only query primitive. Design your keys for the access pattern (`user:by-email:alice@x.com`, `user:by-plan:pro:alice@x.com`, etc.).
+- **No TTL today.** Keys live until deleted. If you need expiry, store `expires_at` in the value and let your reader drop stale rows.
+- **Eventual `key_count`.** The `keys` field on a namespace is approximate; don't use it for strict pagination math.
+- **Free in v1.** Metered later if usage shows a need. Cost discipline still applies — store data, not blobs.
+
+Run `myapi database --help` for inline reference.

package/dist/skills/my-database-api/claude/.claude-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "my-database-api",
+  "description": "Per-org KV store with namespaces + compare-and-swap. JSON values up to 256 KB. The substrate for stateful agent-built apps.",
+  "version": "1.0.0",
+  "published": true
+}

package/dist/skills/my-domain-api/SKILL.md

@@ -1,62 +1,89 @@
 ---
 name: my-domain-api
+version: 1.0.0
 description: >
   Register new domains and manage edge settings. Required before a funnel can go live on a custom URL.
+triggers: [domain, register domain, dns, custom domain, edge, cdn, security level, browser check, renew, namecheap]
+checksum: sha256-pending
 ---
 
 # MyDomainAPI
 
 Handles domain registration, assignment to orgs, and edge (CDN/security) settings. DNS is fully managed — you never touch nameservers manually.
 
-## How It Fits Together
+## Capabilities
+<!-- llm:start -->
+Domains are how you take a funnel from `your-org.makeautonomous.com` to `your-real-brand.com`. The flow is: check availability, register (deducts credits), assign to an org, watch status until DNS propagates. From that point, your org's funnel serves at `https://yourdomain.com`. SSL provisions automatically a few minutes after status flips to `active`.
 
-- Requires `api_key` and `org_id` from **myapihq**.
-- A domain assigned to an org is the prerequisite for a **myfunnelapi** funnel to be reachable at a custom URL.
-- Without a domain, funnels still work on the free `*.makeautonomous.com` preview subdomain.
+You can also import existing domains (without re-registering) and tune CDN/security settings per-domain.
 
-## Typical Flow
+Without a domain, funnels still work on the free `*.makeautonomous.com` preview subdomain.
+
+### Registrant (ICANN requirement)
+
+Every `myapi domain register` call needs WHOIS contact info — name, email, phone, address, country code (ISO alpha-2). State is required for US/CA registrants.
+
+The CLI stores this locally so you only enter it once:
 
 ```bash
-myapi domain check example.com          # check availability + price
-myapi domain register example.com       # register it (deducts credits)
-myapi domain assign example.com         # assign to your default org
-myapi domain status example.com         # watch until status = active
+# One-time interactive setup (human)
+myapi auth registrant set
+
+# Or non-interactive (agent)
+myapi auth registrant set --registrant-json '{
+  "name":"Simon Janin", "email":"simon@example.com", "phone":"+33612345678",
+  "street":"1 rue de la Paix", "city":"Paris",
+  "postal_code":"75001", "country_code":"FR"
+}'
 ```
 
-After `status` shows `active`, your funnel will be live at `https://example.com`. SSL provisioning takes a few extra minutes after activation.
-
-## All Commands
+Resolution at register time (highest wins): `--registrant-json` → per-field flags (`--registrant-name`, …) → stored config → interactive TTY prompt → error. Stored contact info is never sent to the backend except as a per-request field on register.
+<!-- llm:end -->
 
+## Commands
+<!-- generated:start -->
 | Command | What it does |
 |---|---|
 | `myapi domain check <domain>` | Check availability and yearly price |
-| `myapi domain register <domain> [--years N]` | Register a new domain (explicit domain required) |
+| `myapi domain register <domain> [--years N] <registrant flags>` | Register a new domain (deducts credits). Requires ICANN WHOIS contact info — store once with `myapi auth registrant set`, or pass per-call via `--registrant-json` / `--registrant-*` flags |
+| `myapi domain renew <domain>` | Renew a registered domain for another period |
 | `myapi domain list [--filter all\|unassigned\|org]` | List domains in your account |
-| `myapi domain assign <domain>` | Assign domain to the default (or `--org`) org (explicit domain required) |
-| `myapi domain unassign <domain>` | Remove domain from its org (explicit domain required) |
-| `myapi domain status <domain>` | Check registration + DNS propagation status |
+| `myapi domain assign <domain>` | Assign domain to your default (or `--org`) org |
+| `myapi domain unassign <domain>` | Remove domain from its org |
+| `myapi domain status <domain>` | Registration + DNS propagation status |
 | `myapi domain settings <domain>` | View edge/CDN settings |
-| `myapi domain update-settings <domain>` | Update edge settings (security level, browser check, cache purge) |
+| `myapi domain update-settings <domain>` | Change security level, browser check, purge cache |
+<!-- generated:end -->
 
-`register`, `assign`, and `unassign` always require an explicit domain argument — they do not fall back to any stored default, to prevent accidental destructive actions.
+## Examples
+<!-- llm:start -->
+```bash
+# One-time: store your WHOIS contact info (used by every register call)
+myapi auth registrant set
 
-## Edge Settings
+# Register and bring online
+myapi domain check example.com
+myapi domain register example.com
+myapi domain assign example.com
+myapi domain status example.com   # poll until status = active
 
-Fine-tune CDN/security behavior per domain:
+# Renew before expiry
+myapi domain renew example.com
 
-```bash
+# Tune the edge for AI bot traffic
 myapi domain update-settings example.com \
-  --security=essentially_off \
-  --browser-check=off \
-  --purge-cache
+  --security=essentially_off --browser-check=off --purge-cache
 ```
 
-Security levels: `essentially_off` · `low` · `medium` · `high` · `under_attack`.  
+Security levels: `essentially_off` · `low` · `medium` · `high` · `under_attack`.
+
 Set `essentially_off` + `browser-check=off` to allow AI crawlers and training bots through without challenge pages.
+<!-- llm:end -->
 
 ## Notes
 
-- All commands default to `--org` from your saved config. Set it once with `myapi auth config set-org <id>`.
+- `register`, `renew`, `assign`, and `unassign` always require an explicit domain argument — they don't fall back to a stored default, to prevent accidental destructive actions.
+- All commands default to `--org` from your saved config (set with `myapi config set-org <id>`).
 - `402` errors mean insufficient credits — run `myapi billing topup <amount>`.
 
 Run `myapi domain --help` or `myapi domain <subcommand> --help` for full flag reference.

package/dist/skills/my-email-verify-api/README.md

@@ -0,0 +1,33 @@
+---
+# my-email-verify-api
+
+Synchronous single-address email verification — syntax + DNS + Microsoft probe. Pre-send quality gate for outbound campaigns.
+
+## What it does
+
+- Validates email syntax (instant)
+- Looks up DNS / MX records (sub-second)
+- Probes Microsoft GetCredentialType for Microsoft-hosted domains
+- Returns `deliverable` / `undeliverable` / `unknown` with confidence score
+- Sets `smtp_recommended: true` when the cheap layer was inconclusive
+
+## Quickstart
+
+```bash
+myapi email verify alice@example.com
+myapi email verify alice@example.com --json    # full check breakdown
+```
+
+## Authentication
+
+```bash
+export MYAPI_KEY=mak_...
+```
+
+Requires `api_key` and `org_id` from **myapihq**.
+
+## Documentation
+
+Verdicts, confidence semantics, and pre-send filter recipe: see `SKILL.md`.
+
+Run `myapi email verify --help` for inline reference.

package/dist/skills/my-email-verify-api/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: my-email-verify-api
+version: 1.0.0
+description: >
+  Synchronous single-address email verification — syntax + DNS + Microsoft GetCredentialType probe. Returns a verdict in <1s for ~50% of inputs; the rest get verdict='unknown' with smtp_recommended=true. The pre-send quality gate for any outbound campaign.
+triggers: [email verify, email validation, deliverability, smtp, syntax check, dns mx, microsoft, mx lookup, bounce prevention]
+checksum: sha256-pending
+---
+
+# MyEmailVerifyAPI
+
+A cheap, fast quality gate for a single email address. Runs three layers in sequence: syntax check (instant) → DNS / MX lookup (sub-second) → Microsoft GetCredentialType probe (sub-second for non-Microsoft, slower for federated domains). Returns a definitive `deliverable` / `undeliverable` verdict for about half of inputs; the rest get `verdict: 'unknown'` with `smtp_recommended: true`, suggesting a downstream SMTP probe that isn't part of this API today.
+
+## Capabilities
+<!-- llm:start -->
+Use this before any campaign send — pipe the audience members through `verify` and drop the undeliverable ones to protect your sender reputation.
+
+Verdicts:
+- **`deliverable`** — high-confidence acceptance. Safe to send.
+- **`undeliverable`** — high-confidence reject. Skip. Most common causes: malformed syntax (`missing '@'`), no MX records, Microsoft positively returns "no such mailbox".
+- **`unknown`** — couldn't determine cheaply. The `smtp_recommended` flag will be `true`; in practice, treat as "send but watch the bounce signal" or run a more expensive SMTP probe externally.
+
+Response shape (full check breakdown available via `--json`):
+```json
+{
+  "email": "alice@example.com",
+  "verdict": "deliverable" | "undeliverable" | "unknown",
+  "confidence": 0.0..1.0,
+  "smtp_recommended": true,
+  "checks": {
+    "syntax":    { "valid": true, "detail": "missing '@'" },
+    "dns":       { "valid": true, "mx_records": ["mx1.example.com", ...] },
+    "microsoft": { "verdict": "...", "if_exists_result": 0, "domain_type": 4, "federated": false }
+  },
+  "elapsed_ms": 124
+}
+```
+
+Latency notes: syntax + DNS are <100ms. Microsoft GetCredentialType is fast for non-Microsoft domains, can take 5–8s on federated (custom) Microsoft tenants while it walks redirects. Set call timeouts ≥10s for safety.
+<!-- llm:end -->
+
+## Commands
+<!-- generated:start -->
+| Command | What it does |
+|---|---|
+| `myapi email verify <email> [--json]` | Run all three verification layers on one address; print verdict + confidence + key checks |
+<!-- generated:end -->
+
+Pass `--json` for the full check breakdown (syntax detail, MX records, Microsoft probe result). The default human render shows the verdict + a one-line summary per check that fired.
+
+## Examples
+<!-- llm:start -->
+```bash
+# Clear undeliverable — syntax fails instantly
+myapi email verify not-an-email
+# → Verdict: ✗ undeliverable  (confidence 1.00)
+# → Syntax: missing '@'
+# → Took: 0ms
+
+# Generic domain — unknown verdict, MX visible, confidence 0.5
+myapi email verify hello@gmail.com
+# → Verdict: ? unknown  (confidence 0.50)
+# → SMTP next: yes — consider an SMTP probe
+# → MX: gmail-smtp-in.l.google.com, alt1...
+
+# Full breakdown
+myapi email verify alice@corp.com --json | jq '.checks'
+```
+
+### End-to-end recipe — filter an audience before send
+
+```bash
+# Pull all members from a saved audience
+AID=$(myapi audience list --json | jq -r '.[0].id')
+myapi audience members $AID --limit 100 --json | jq -r '.people[].email' > emails.txt
+
+# Verify each in parallel (modest concurrency to be polite)
+while read email; do
+  myapi email verify "$email" --json | jq -r '"\(.email) \(.verdict)"'
+done < emails.txt | grep -v ' undeliverable$' > verified.txt
+```
+<!-- llm:end -->
+
+## Notes
+
+- This is the **cheap layer only**. The full pipeline at outreach scale typically chains: this verify (free signal) → SMTP probe (medium cost) → catch-all detector (slow). Only the first is exposed today.
+- The `confidence` field is a hint, not a guarantee. A `deliverable` verdict at 0.95 confidence is still ≈5% bounce risk in practice.
+- For bulk verification, call this in parallel from your code with throttling — there is no batch endpoint today. A batch + async-job endpoint is on the backend roadmap.
+- Verification is per-org; you'll get rate-limited if you blast more than ~1 req/sec per key.
+
+Run `myapi email verify --help` for inline reference.

package/dist/skills/my-email-verify-api/claude/.claude-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "my-email-verify-api",
+  "description": "Sync single-address email verification — syntax + DNS + Microsoft probe. Pre-send quality gate for campaigns.",
+  "version": "1.0.0",
+  "published": true
+}