@myapihq/cli 1.1.0-wip.5 → 1.2.1

package/dist/flags.test.js

@@ -70,4 +70,88 @@ describe('parseFlags', () => {
         const { flags } = parseFlags(['--mystery=42'], SCHEMA);
         expect(flags.mystery).toBe('42');
     });
+    // ── S-405: Strict flag validation behavior ────────────────────────────────
+    //
+    // The CLI is intentionally LENIENT on unknown flags: they're tolerated as
+    // boolean/string values, with a stderr warning. This is by design — agents
+    // hallucinate flags occasionally, and breaking their script with a hard
+    // error on `--unknown-flag` is worse UX than warning + continuing.
+    //
+    // These tests lock in the documented behavior so it can't drift.
+    it('unknown flag with a following value-shaped token consumes that token', () => {
+        const { args, flags } = parseFlags(['funnel', 'create', '--on-error', 'simon@x.com'], SCHEMA);
+        expect(flags['on-error']).toBe('simon@x.com');
+        expect(args).toEqual(['funnel', 'create']);
+    });
+    it('unknown flag with no following token defaults to boolean true', () => {
+        const { flags } = parseFlags(['--mystery'], SCHEMA);
+        expect(flags.mystery).toBe(true);
+    });
+    it('unknown flag does not consume a token that looks like another flag', () => {
+        const { flags } = parseFlags(['--mystery', '--json'], SCHEMA);
+        expect(flags.mystery).toBe(true);
+        expect(flags.json).toBe(true);
+    });
+    it('emits a stderr warning when unknown flags are present', () => {
+        const stderrChunks = [];
+        const origWrite = process.stderr.write.bind(process.stderr);
+        process.stderr.write = (chunk) => { stderrChunks.push(String(chunk)); return true; };
+        try {
+            parseFlags(['--mystery', '--also-unknown'], SCHEMA);
+        }
+        finally {
+            process.stderr.write = origWrite;
+        }
+        const out = stderrChunks.join('');
+        expect(out).toMatch(/ignoring unknown flag/i);
+        expect(out).toMatch(/--mystery/);
+        expect(out).toMatch(/--also-unknown/);
+    });
+    it('respects MYAPI_QUIET_UNKNOWN_FLAGS to suppress the warning', () => {
+        const stderrChunks = [];
+        const origWrite = process.stderr.write.bind(process.stderr);
+        const origEnv = process.env.MYAPI_QUIET_UNKNOWN_FLAGS;
+        process.env.MYAPI_QUIET_UNKNOWN_FLAGS = '1';
+        process.stderr.write = (chunk) => { stderrChunks.push(String(chunk)); return true; };
+        try {
+            parseFlags(['--mystery'], SCHEMA);
+        }
+        finally {
+            process.stderr.write = origWrite;
+            if (origEnv === undefined)
+                delete process.env.MYAPI_QUIET_UNKNOWN_FLAGS;
+            else
+                process.env.MYAPI_QUIET_UNKNOWN_FLAGS = origEnv;
+        }
+        const out = stderrChunks.join('');
+        expect(out).not.toMatch(/ignoring unknown flag/);
+    });
+    it('emits no warning when there are no unknown flags', () => {
+        const stderrChunks = [];
+        const origWrite = process.stderr.write.bind(process.stderr);
+        process.stderr.write = (chunk) => { stderrChunks.push(String(chunk)); return true; };
+        try {
+            parseFlags(['--name', 'Acme', '--yes'], SCHEMA);
+        }
+        finally {
+            process.stderr.write = origWrite;
+        }
+        expect(stderrChunks.join('')).toBe('');
+    });
+    it('declared number flag with non-numeric value falls back to the raw string', () => {
+        const { flags } = parseFlags(['--years', 'not-a-number'], SCHEMA);
+        expect(flags.years).toBe('not-a-number');
+    });
+    it('declared boolean flag with --key=false sets it to false', () => {
+        const { flags } = parseFlags(['--no-enable=false'], SCHEMA);
+        expect(flags['no-enable']).toBe(false);
+    });
+    it('declared boolean flag with --key=0 sets it to false', () => {
+        const { flags } = parseFlags(['--no-enable=0'], SCHEMA);
+        expect(flags['no-enable']).toBe(false);
+    });
+    it('declared boolean flag with --key=true is truthy', () => {
+        const { flags } = parseFlags(['--no-enable=true'], SCHEMA);
+        expect(flags['no-enable']).toBe(true);
+    });
 });

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { error, info, success } from './output.js';
+import { error, info, success, banner } from './output.js';
 import { loadConfig } from './config.js';
 import { MyApiError } from '@myapihq/sdk';
 import * as fs from 'fs';
@@ -18,8 +18,18 @@ import * as workflowCmd from './commands/workflow.js';
 import * as emailCmd from './commands/email/index.js';
 import * as imageCmd from './commands/image.js';
 import * as storageCmd from './commands/storage.js';
+import * as pixelCmd from './commands/pixel.js';
+import * as urlCmd from './commands/url.js';
 import * as authCmd from './commands/auth.js';
 import * as configCmd from './commands/config.js';
+import * as statusCmd from './commands/status.js';
+import * as peopleCmd from './commands/people.js';
+import * as companyCmd from './commands/company.js';
+import * as audienceCmd from './commands/audience.js';
+import * as llmCmd from './commands/llm.js';
+import * as databaseCmd from './commands/database.js';
+import * as crmCmd from './commands/crm/index.js';
+import { initCompletion, installCompletion, uninstallCompletion } from './completion.js';
 // Each command file declares the value flags it understands. We union them
 // into a single schema for the upfront parse, so adding a new value flag in
 // one command means editing one file (its SCHEMA), not a global allowlist.
@@ -33,7 +43,16 @@ const COMBINED_SCHEMA = {
     ...imageCmd.SCHEMA,
     ...keysCmd.SCHEMA,
     ...orgCmd.SCHEMA,
+    ...pixelCmd.SCHEMA,
+    ...statusCmd.SCHEMA,
+    ...peopleCmd.SCHEMA,
+    ...companyCmd.SCHEMA,
+    ...audienceCmd.SCHEMA,
+    ...llmCmd.SCHEMA,
+    ...databaseCmd.SCHEMA,
+    ...crmCmd.SCHEMA,
     ...storageCmd.SCHEMA,
+    ...urlCmd.SCHEMA,
     ...webhookCmd.SCHEMA,
     ...workflowCmd.SCHEMA,
     // Top-level flags
@@ -62,6 +81,7 @@ const ERROR_MESSAGES = {
     RATE_LIMITED: 'Too many requests. Please wait a moment and try again.',
     INSUFFICIENT_BALANCE: 'Insufficient balance. Run: myapi billing topup <amount>',
     INVALID_AMOUNT: 'Amount out of range. Maximum single top-up is $100. Run: myapi billing topup <amount>',
+    SERVICE_NOT_LAUNCHED: 'This service is disabled pre-launch. Track availability via: myapi status',
     // invalid_json_response intentionally absent — the SDK's MyApiError now
     // builds a useful detailed message for that case (status + URL + body
     // snippet), and friendlyError(err.code) would override it.
@@ -70,6 +90,9 @@ function friendlyError(code) {
     return ERROR_MESSAGES[code] || code;
 }
 async function main() {
+    // Shell autocomplete: if invoked by the shell with completion env vars,
+    // omelette short-circuits before normal dispatch. Always cheap on a real run.
+    initCompletion();
     const { args, flags } = parseFlags(process.argv.slice(2), COMBINED_SCHEMA);
     if (flags.version || flags.v || flags.V) {
         const latest = await updateCmd.latestVersion();
@@ -130,6 +153,30 @@ async function main() {
             case 'storage':
                 await storageCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'pixel':
+                await pixelCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'people':
+                await peopleCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'company':
+                await companyCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'audience':
+                await audienceCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'llm':
+                await llmCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'database':
+                await databaseCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'crm':
+                await crmCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'url':
+                await urlCmd.run(subcommand, restArgs, flags);
+                break;
             // Convenience aliases
             case 'setup':
                 await setupCmd.setup(flags);
@@ -137,6 +184,9 @@ async function main() {
             case 'whoami':
                 await authCmd.whoami(flags);
                 break;
+            case 'status':
+                await statusCmd.run(subcommand, restArgs, flags);
+                break;
             case 'keys':
                 await keysCmd.run(subcommand, restArgs, flags);
                 break;
@@ -151,6 +201,20 @@ async function main() {
                 await setupCmd.installSkills();
                 success('› Skills installed.');
                 break;
+            case 'completion':
+                // Order matters: omelette's setup/cleanup helpers call process.exit()
+                // unconditionally, so anything we want to show has to print first.
+                if (subcommand === 'uninstall') {
+                    success('› Removing completion from shell init file…');
+                    info('  Restart your shell (or `source ~/.bashrc` / `~/.zshrc`) to take effect.');
+                    uninstallCompletion();
+                }
+                else {
+                    success('› Installing tab completion…');
+                    info('  Restart your shell (or `source ~/.bashrc` / `~/.zshrc`) to enable.');
+                    installCompletion();
+                }
+                break;
             case 'help':
                 await dispatchHelp(subcommand);
                 break;
@@ -167,8 +231,16 @@ async function main() {
                     error('A verified email is required. Run: myapi auth link');
                 else if (err.code === 'NO_PAYMENT_METHOD')
                     error('No payment method on file. Run: myapi billing setup');
-                else
+                else {
+                    // Anonymous accounts can't top up (no payment surface). The
+                    // natural unblock is to link an email — the upgrade grants the
+                    // free credit and opens the paid surface.
+                    const cfg = loadConfig();
+                    if (cfg?.is_anonymous) {
+                        error('Insufficient balance. Anonymous accounts have no free credit — link an email to unlock $5: myapi auth link <email>');
+                    }
                     error('Insufficient balance. Run: myapi billing topup <amount>');
+                }
             }
             else
                 error(friendlyError(err.code) || err.message);
@@ -193,6 +265,9 @@ async function dispatchAuth(subcommand, restArgs, flags) {
         case 'link': return authCmd.link(flags, restArgs[0]);
         case 'switch': return authCmd.switchCmd(flags, restArgs[0]);
         case 'install-skills':
+            // DEPRECATED: install-skills is now a top-level command. The auth subcommand
+            // form is kept for one minor version with a warning, then will be removed.
+            banner('› Note: `myapi auth install-skills` is deprecated. Use `myapi install-skills` instead.');
             if (flags.help) {
                 info(authCmd.INSTALL_SKILLS_HELP);
                 return;
@@ -201,6 +276,7 @@ async function dispatchAuth(subcommand, restArgs, flags) {
             success('› Skills installed.');
             return;
         case 'config': return configCmd.run(restArgs[0], restArgs.slice(1), flags);
+        case 'registrant': return authCmd.registrant(restArgs[0], flags);
         case 'api-keys':
         case 'keys': return keysCmd.runApiKeys(restArgs[0], restArgs.slice(1), flags);
         default: info('Unknown subcommand. Run: myapi auth --help');
@@ -214,6 +290,13 @@ const HELP_TARGETS = {
     email: f => emailCmd.run(undefined, [], f),
     image: f => imageCmd.run(undefined, [], f),
     storage: f => storageCmd.run(undefined, [], f),
+    status: f => statusCmd.run(undefined, [], f),
+    people: f => peopleCmd.run(undefined, [], f),
+    company: f => companyCmd.run(undefined, [], f),
+    audience: f => audienceCmd.run(undefined, [], f),
+    llm: f => llmCmd.run(undefined, [], f),
+    database: f => databaseCmd.run(undefined, [], f),
+    crm: f => crmCmd.run(undefined, [], f),
     org: f => orgCmd.run(undefined, [], f),
     billing: f => billingCmd.run(undefined, [], f),
     keys: f => keysCmd.run(undefined, [], f),
@@ -247,24 +330,33 @@ Usage: myapi <command> [subcommand] [args]
        myapi --version
 
 Commands:
-  auth         Manage account · setup · whoami · link
-  billing      Check balance and manage billing
-  org          Manage organizations (tip: myapi org create "name" --yes to auto-set as default)
-  update       Update CLI and skills to the latest version
-  domain       Manage domain configurations
-  funnel       Manage websites (publish pages, custom domains, funnels)
-  webhook      Manage inbound webhook endpoints and inspect deliveries
-  email        Manage mailboxes, send/read email, templates, and campaigns
-  workflow     Run actions (send email, post to Slack) when a webhook fires
-  image        Generate AI images and manage them in storage
-  storage      Upload, ingest, list, and serve assets from edge storage
+  auth            Manage account · setup · whoami · link
+  status          Single-screen view of account + resources in the default org
+  install-skills  Install or update the MyAPI skills pack for AI agents
+  billing         Check balance and manage billing
+  org             Manage organizations (tip: myapi org create "name" --yes to auto-set as default)
+  update          Update CLI and skills to the latest version
+  domain          Manage domain configurations
+  funnel          Manage websites (publish pages, custom domains, funnels)
+  webhook         Manage inbound webhook endpoints and inspect deliveries
+  email           Manage mailboxes, send/read email, templates, and campaigns
+  workflow        Run actions (send email, post to Slack) when a webhook fires
+  image           Generate AI images and manage them in storage
+  storage         Upload, ingest, list, and serve assets from edge storage
+  pixel           Read pixel analytics: visits, events, identity resolution
+  people          Search the contact database (filter by industry, seniority, country, ...)
+  company         Search the company database (filter by industry, size, country, ...)
+  audience        Save filter snapshots as named audiences (people or companies)
+  llm             Run LLM completions and embeddings (chat + embed, with usage/cost)
+  database        KV store with namespaces + CAS — the substrate for stateful agent apps
+  crm             Canonical store of engaged contacts + companies, with auto-ingest from webhooks
+  url             Shorten URLs to compact myurlto.com links
 
 Aliases:
   whoami          → myapi auth whoami
   keys            → myapi auth api-keys
   setup           → myapi auth setup
   config          → myapi auth config
-  install-skills  → myapi auth install-skills
 
 Run "myapi <command> --help" for subcommand help.
 

package/dist/prompt.d.ts

@@ -1,4 +1,19 @@
 import * as readline from 'readline';
+/**
+ * True when no human is available to answer prompts.
+ *
+ * Detects three cases:
+ * - Piped / redirected stdin (most CI runners, shell pipes)
+ * - `CI=true` (GitHub Actions, GitLab CI, CircleCI, etc.)
+ * - `MYAPI_NON_INTERACTIVE=1` (explicit opt-out, used by agent harnesses
+ *   that allocate a PTY for output but have no human at the keyboard)
+ *
+ * Some agent test-harnesses allocate a PTY for the child process so its
+ * coloured output renders correctly. In that case `process.stdin.isTTY`
+ * is true but there's no human to type 'y'/'n' — the prompt would hang
+ * until timeout. The env-var escape hatches handle that case.
+ */
+export declare function isNonInteractive(): boolean;
 /**
  * Ask a free-form question on stdin. Returns the trimmed answer.
  *

package/dist/prompt.js

@@ -1,4 +1,23 @@
 import * as readline from 'readline';
+/**
+ * True when no human is available to answer prompts.
+ *
+ * Detects three cases:
+ * - Piped / redirected stdin (most CI runners, shell pipes)
+ * - `CI=true` (GitHub Actions, GitLab CI, CircleCI, etc.)
+ * - `MYAPI_NON_INTERACTIVE=1` (explicit opt-out, used by agent harnesses
+ *   that allocate a PTY for output but have no human at the keyboard)
+ *
+ * Some agent test-harnesses allocate a PTY for the child process so its
+ * coloured output renders correctly. In that case `process.stdin.isTTY`
+ * is true but there's no human to type 'y'/'n' — the prompt would hang
+ * until timeout. The env-var escape hatches handle that case.
+ */
+export function isNonInteractive() {
+    return (!process.stdin.isTTY ||
+        process.env.CI === 'true' ||
+        process.env.MYAPI_NON_INTERACTIVE === '1');
+}
 /**
  * Ask a free-form question on stdin. Returns the trimmed answer.
  *
@@ -6,6 +25,14 @@ import * as readline from 'readline';
  * inline. Replaces five copies of the same boilerplate across commands.
  */
 export async function ask(question) {
+    // Non-interactive contexts (CI, agent subshells, piped stdin) used to
+    // hang here forever waiting for input that never arrives. Return an
+    // empty answer immediately so callers can fall back to their default.
+    if (isNonInteractive()) {
+        process.stdout.write(question);
+        process.stdout.write('\n');
+        return '';
+    }
     return withReadline(rl => new Promise(resolve => {
         rl.question(question, ans => resolve(ans.trim()));
     }));

package/dist/registrant.d.ts

@@ -0,0 +1,6 @@
+import type { domain as sdkDomain } from '@myapihq/sdk';
+import { type Config } from './config.js';
+import type { Flags } from './helpers.js';
+export type Registrant = sdkDomain.Registrant;
+export declare function resolveRegistrantForRegister(flags: Flags, config: Config): Promise<Registrant>;
+export declare function promptAndSave(config: Config, prefill?: Partial<Registrant>): Promise<Registrant>;

package/dist/registrant.js

@@ -0,0 +1,155 @@
+// Resolution + prompting helpers for the ICANN WHOIS registrant required
+// at `myapi domain register` time.
+//
+// Sources, in priority order:
+//   1. --registrant-json '<inline JSON>'
+//   2. Per-field flags (--registrant-name, --registrant-email, …)
+//   3. Stored on the active account (set via `myapi auth registrant set`)
+//   4. Interactive TTY prompt — offers to save to config
+//   5. Hard error in non-interactive contexts
+//
+// Validation is intentionally light. We trust the backend to enforce
+// ICANN rules (E.164 phone, ISO country code, state-required-for-US/CA).
+// Local validation here would silently diverge from server-side as rules
+// evolve. We only catch obvious typos (empty required fields, invalid
+// country length).
+import { error } from './output.js';
+import { ask, confirm, isNonInteractive } from './prompt.js';
+import { saveConfig } from './config.js';
+// ── Flag-based extraction ──────────────────────────────────────────────────
+// Returns a partial registrant from per-field flags. Caller decides
+// whether the partial is "complete enough" (we require all six base
+// fields plus country_code; state is optional).
+function fromFlags(flags) {
+    return {
+        name: typeof flags['registrant-name'] === 'string' ? flags['registrant-name'] : undefined,
+        email: typeof flags['registrant-email'] === 'string' ? flags['registrant-email'] : undefined,
+        phone: typeof flags['registrant-phone'] === 'string' ? flags['registrant-phone'] : undefined,
+        street: typeof flags['registrant-street'] === 'string' ? flags['registrant-street'] : undefined,
+        city: typeof flags['registrant-city'] === 'string' ? flags['registrant-city'] : undefined,
+        state: typeof flags['registrant-state'] === 'string' ? flags['registrant-state'] : undefined,
+        postal_code: typeof flags['registrant-postal-code'] === 'string' ? flags['registrant-postal-code'] : undefined,
+        country_code: typeof flags['registrant-country'] === 'string' ? flags['registrant-country'] : undefined,
+        organization: typeof flags['registrant-organization'] === 'string' ? flags['registrant-organization'] : undefined,
+    };
+}
+function fromJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch (e) {
+        error(`--registrant-json is not valid JSON: ${e.message}`);
+    }
+}
+// Merge sources, later sources win on a per-field basis. Empty strings are
+// ignored so a partial flag set doesn't clobber config values.
+function merge(...sources) {
+    const out = {};
+    for (const src of sources) {
+        if (!src)
+            continue;
+        for (const [k, v] of Object.entries(src)) {
+            if (v !== undefined && v !== '')
+                out[k] = v;
+        }
+    }
+    return out;
+}
+// Required fields (state is conditional — backend validates US/CA specifically).
+const REQUIRED = ['name', 'email', 'phone', 'street', 'city', 'postal_code', 'country_code'];
+function missingFields(r) {
+    return REQUIRED.filter(k => !r[k]);
+}
+function validate(r) {
+    if (r.country_code.length !== 2) {
+        return `country_code "${r.country_code}" must be ISO 3166-1 alpha-2 (e.g. "US", "DE", "FR")`;
+    }
+    if ((r.country_code === 'US' || r.country_code === 'CA') && !r.state) {
+        return `state is required for US and CA registrants`;
+    }
+    return null;
+}
+// ── Interactive prompt ─────────────────────────────────────────────────────
+const FIELDS = [
+    { key: 'name', label: 'Full name', required: true },
+    { key: 'email', label: 'Email', required: true },
+    { key: 'phone', label: 'Phone (E.164, e.g. +33612345678)', required: true },
+    { key: 'street', label: 'Street', required: true },
+    { key: 'city', label: 'City', required: true },
+    { key: 'postal_code', label: 'Postal code', required: true },
+    { key: 'country_code', label: 'Country code (ISO alpha-2, e.g. "US")', required: true },
+    { key: 'state', label: 'State (US/CA only — press Enter to skip)', required: false },
+    { key: 'organization', label: 'Organization (optional — press Enter to skip)', required: false },
+];
+// Walk the field list interactively. `existing` fills the default for each
+// prompt (Enter accepts) so the user can re-confirm without retyping.
+async function promptRegistrant(existing = {}) {
+    const out = { ...existing };
+    for (const f of FIELDS) {
+        const current = out[f.key];
+        const suffix = current ? ` [${current}]` : '';
+        let ans = await ask(`  ${f.label}${suffix}: `);
+        if (!ans && current)
+            ans = String(current);
+        if (!ans && f.required) {
+            error(`${f.key} is required.`);
+        }
+        if (ans)
+            out[f.key] = ans.trim();
+    }
+    // Validate the assembled record; bail with a clear message on common issues.
+    const reason = validate(out);
+    if (reason)
+        error(reason);
+    return out;
+}
+// ── Public resolver — called by `myapi domain register` ────────────────────
+export async function resolveRegistrantForRegister(flags, config) {
+    // 1 + 2: flags
+    const jsonSource = typeof flags['registrant-json'] === 'string' ? fromJson(flags['registrant-json']) : undefined;
+    const flagSource = fromFlags(flags);
+    // 3: stored config
+    const stored = config.registrant;
+    // Merge: stored < json < per-flag (later wins).
+    const merged = merge(stored, jsonSource, flagSource);
+    const missing = missingFields(merged);
+    if (missing.length === 0) {
+        const reason = validate(merged);
+        if (reason)
+            error(reason);
+        return merged;
+    }
+    // 4: TTY prompt if available.
+    if (!isNonInteractive()) {
+        console.error('› Domain registration requires WHOIS contact info (ICANN). Filling in missing fields:');
+        const r = await promptRegistrant(merged);
+        if (!stored) {
+            const save = await confirm('  Save as your default for future domain registrations? (Y/n) ', true);
+            if (save) {
+                saveConfig({ ...config, registrant: r });
+                console.error('  ✓ Saved. Manage with: myapi auth registrant <get|clear>');
+            }
+        }
+        return r;
+    }
+    // 5: hard error.
+    error(`Missing registrant field(s): ${missing.join(', ')}\n\n` +
+        `Provide them via one of:\n` +
+        `  myapi auth registrant set                  (one-time interactive setup)\n` +
+        `  --registrant-json '{"name":"...","email":"...","phone":"...","street":"...","city":"...","postal_code":"...","country_code":"DE"}'\n` +
+        `  Per-field flags: --registrant-name, --registrant-email, --registrant-phone,\n` +
+        `                   --registrant-street, --registrant-city, --registrant-postal-code,\n` +
+        `                   --registrant-country, --registrant-state (US/CA only)`);
+}
+// ── Used by `myapi auth registrant set` ────────────────────────────────────
+// Public so the auth subcommand can drive the same prompt sequence without
+// going through the register flow.
+export async function promptAndSave(config, prefill = {}) {
+    if (isNonInteractive()) {
+        error('myapi auth registrant set requires a TTY. Use --json \'{...}\' instead.');
+    }
+    console.error('› Setting your WHOIS registrant info (used at every domain register call):');
+    const r = await promptRegistrant(prefill);
+    saveConfig({ ...config, registrant: r });
+    return r;
+}

package/dist/services-sync.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services-sync.test.js

@@ -0,0 +1,32 @@
+// CI enforcement that every skills/<name>/claude/.claude-plugin/plugin.json
+// is regenerable from packages/sdk/src/services.ts without drift.
+//
+// If this test fails, run from the repo root:
+//   node scripts/canonical-sync.mjs
+//
+// That regenerates the affected plugin.json files; commit and the test
+// passes again.
+import { describe, it, expect } from 'vitest';
+import { execFileSync } from 'node:child_process';
+import * as path from 'node:path';
+import * as url from 'node:url';
+const __filename = url.fileURLToPath(import.meta.url);
+const REPO_ROOT = path.resolve(path.dirname(__filename), '..', '..', '..');
+describe('canonical-sync: services.ts → skills/*/plugin.json', () => {
+    it('every plugin.json matches its services.ts entry', () => {
+        let out = '';
+        let exitCode = 0;
+        try {
+            out = execFileSync('node', ['scripts/canonical-sync.mjs', '--check'], {
+                cwd: REPO_ROOT,
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+        }
+        catch (err) {
+            exitCode = err.status ?? 1;
+            out = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
+        }
+        expect(exitCode, `canonical-sync --check failed (exit ${exitCode}). Output:\n${out}\n\nRun \`node scripts/canonical-sync.mjs\` from the repo root to regenerate the affected plugin.json files, then commit.`).toBe(0);
+    });
+});