@myapihq/cli 1.2.1 → 1.2.4

package/dist/commands/domain.d.ts

@@ -11,6 +11,8 @@ export declare function list(flags: Flags): Promise<void>;
 export declare function assign(domainArg: string, flags: Flags): Promise<void>;
 export declare function unassign(domainArg: string, flags: Flags): Promise<void>;
 export declare function status(domainArg: string, flags: Flags): Promise<void>;
+export declare function emailSetup(domainArg: string, flags: Flags): Promise<void>;
+export declare function retryProvisioning(domainArg: string, flags: Flags): Promise<void>;
 export declare function settings(domainArg: string, flags: Flags): Promise<void>;
 export declare function updateSettings(domainArg: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/domain.js

@@ -14,6 +14,8 @@ export const EXPOSES = [
     'GET /domain/orgs/{org_id}/{domain}/settings',
     'POST /domain/orgs/{org_id}/{domain}/settings',
     'GET /domain/orgs/{org_id}/{domain}/status',
+    'POST /domain/orgs/{org_id}/{domain}/email-infra',
+    'POST /domain/orgs/{org_id}/{domain}/retry-provisioning',
 ];
 export const SCHEMA = {
     org: 'string',
@@ -38,6 +40,16 @@ export const SCHEMA = {
     'registrant-postal-code': 'string',
     'registrant-country': 'string',
     'registrant-organization': 'string',
+    // DNS records sub-surface
+    type: 'string',
+    name: 'string',
+    content: 'string',
+    ttl: 'number',
+    priority: 'number',
+    proxied: 'boolean',
+    yes: 'boolean',
+    // Email-infra opt-in
+    subdomain: 'string',
 };
 export async function check(domainArg, flags) {
     const config = requireConfig();
@@ -161,8 +173,10 @@ export async function unassign(domainArg, flags) {
     await sdkDomain.unassignDomain(config.api_key, orgId, domainArg);
     success(`Unassigned ${domainArg} from org ${orgId}`);
 }
-// Terminal states — stop polling under --watch.
-const TERMINAL_STATUSES = new Set(['active', 'failed', 'error', 'expired']);
+// Terminal states — stop polling under --watch. `infra_error` is included
+// because watching past it is pointless — the user has to act (retry or
+// contact support); a re-watch after retry is the natural next step.
+const TERMINAL_STATUSES = new Set(['active', 'failed', 'error', 'expired', 'infra_error']);
 export async function status(domainArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi domain status <domain> [--org <id>] [--watch]');
@@ -204,13 +218,63 @@ function renderStatus(res) {
     info(`Status:  ${res.status}`);
     if (res.expires_at)
         info(`Expires: ${formatDate(res.expires_at)}`);
+    if (res.dns_active !== undefined)
+        info(`DNS:     ${res.dns_active ? 'active' : 'pending'}`);
+    if (res.email_infra) {
+        const where = res.email_subdomain ? ` on ${res.email_subdomain}` : '';
+        info(`Email:   ${res.email_infra}${where}`);
+    }
     if (res.status === 'pending_ns_change') {
         info('Waiting for you to change nameservers at your current registrar. Each poll re-checks Cloudflare.');
     }
+    if (res.status === 'infra_error' && res.error_detail) {
+        info(`  Failed step:  ${res.error_detail.failed_step}`);
+        info(`  Message:      ${res.error_detail.message}`);
+        if (res.error_detail.attempt_count !== undefined) {
+            const last = res.error_detail.last_attempt_at ? `; last try ${res.error_detail.last_attempt_at}` : '';
+            info(`  Attempts:     ${res.error_detail.attempt_count}${last}`);
+        }
+        if (res.error_detail.retryable) {
+            info(`  → myapi domain retry-provisioning ${res.domain}`);
+        }
+        else {
+            info('  Not retryable — contact support.');
+        }
+    }
     if (res.status === 'active') {
         info('Note: if recently activated, the SSL certificate may still be provisioning — allow a few minutes before the site is reachable over HTTPS.');
     }
 }
+// ── Email infra opt-in + retry-provisioning ──────────────────────────────────
+export async function emailSetup(domainArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain email-setup <domain> [--subdomain <label>] [--org <id>]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain email-setup <domain> [--subdomain <label>] [--org <id>]');
+    const subdomain = typeof flags.subdomain === 'string' ? flags.subdomain : undefined;
+    const res = await sdkDomain.setupEmailInfra(config.api_key, orgId, domain, subdomain);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Email infra provisioning on ${res.email_subdomain} (state: ${res.email_infra})`);
+    if (res.next_step)
+        info(res.next_step);
+    info(`Track with: myapi domain status ${domain} --watch`);
+}
+export async function retryProvisioning(domainArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain retry-provisioning <domain> [--org <id>]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain retry-provisioning <domain> [--org <id>]');
+    const res = await sdkDomain.retryProvisioning(config.api_key, orgId, domain);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Retry triggered for ${res.domain}`);
+    if (res.next_step)
+        info(res.next_step);
+    info(`Track with: myapi domain status ${domain} --watch`);
+}
 export async function settings(domainArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi domain settings <domain> [--org <id>]');
@@ -235,6 +299,157 @@ export async function updateSettings(domainArg, flags) {
     const res = await sdkDomain.updateDomainSettings(config.api_key, orgId, domain, payload);
     success(`Updated settings for ${domain}!\n${JSON.stringify(res, null, 2)}`);
 }
+// ── DNS records sub-surface (`myapi domain records ...`) ────────────────────
+const ALLOWED_RECORD_TYPES = new Set(['A', 'AAAA', 'CNAME', 'MX', 'TXT']);
+function parseRecordType(raw, where) {
+    if (typeof raw !== 'string' || !ALLOWED_RECORD_TYPES.has(raw.toUpperCase())) {
+        error(`${where}: --type must be one of A, AAAA, CNAME, MX, TXT (got: ${raw ?? '(missing)'}).`);
+    }
+    return raw.toUpperCase();
+}
+function recordRow(r) {
+    return {
+        id: r.id,
+        type: r.type,
+        name: r.name,
+        content: r.content,
+        ttl: r.ttl === 1 ? 'auto' : String(r.ttl),
+        priority: r.priority ?? '—',
+        proxied: r.proxied === null ? '—' : (r.proxied ? 'yes' : 'no'),
+    };
+}
+async function recordsList(domainArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain records list <domain> [--type <T>] [--org <id>]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain records list <domain> [--type <T>] [--org <id>]');
+    const type = flags.type ? parseRecordType(flags.type, 'records list') : undefined;
+    const records = await sdkDomain.listDnsRecords(config.api_key, orgId, domain, type);
+    if (flags.json) {
+        printJson(records);
+        return;
+    }
+    printTable(records.map(recordRow), { flags, empty: 'No records in this zone.' });
+}
+async function recordsGet(domainArg, recordId, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain records get <domain> <record-id> [--org <id>]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain records get <domain> <record-id> [--org <id>]');
+    if (!recordId)
+        error('Missing record id.\nUsage: myapi domain records get <domain> <record-id>');
+    const r = await sdkDomain.getDnsRecord(config.api_key, orgId, domain, recordId);
+    if (flags.json) {
+        printJson(r);
+        return;
+    }
+    printJson(r);
+}
+async function recordsCreate(domainArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain records create <domain> --type <T> --name <n> --content <c> [...]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain records create <domain> --type <T> --name <n> --content <c> [...]');
+    const type = parseRecordType(flags.type, 'records create');
+    const name = typeof flags.name === 'string' ? flags.name : '';
+    const content = typeof flags.content === 'string' ? flags.content : '';
+    if (!name)
+        error('Missing --name. For apex, pass --name=@ or --name=<domain>.');
+    if (!content)
+        error('Missing --content.');
+    const input = { type, name, content };
+    if (typeof flags.ttl === 'number')
+        input.ttl = flags.ttl;
+    if (typeof flags.priority === 'number')
+        input.priority = flags.priority;
+    if (typeof flags.proxied === 'boolean')
+        input.proxied = flags.proxied;
+    if (type === 'MX' && input.priority === undefined)
+        error('Missing --priority. Required for MX records (typical value: 10).');
+    const r = await sdkDomain.createDnsRecord(config.api_key, orgId, domain, input);
+    success(`Created ${r.type} record ${r.id}`);
+    printJson(r);
+}
+async function recordsUpdate(domainArg, recordId, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain records update <domain> <record-id> [--content ...] [...]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain records update <domain> <record-id> [--content ...] [...]');
+    if (!recordId)
+        error('Missing record id.\nUsage: myapi domain records update <domain> <record-id> [flags]');
+    const patch = {};
+    if (typeof flags.name === 'string')
+        patch.name = flags.name;
+    if (typeof flags.content === 'string')
+        patch.content = flags.content;
+    if (typeof flags.ttl === 'number')
+        patch.ttl = flags.ttl;
+    if (typeof flags.priority === 'number')
+        patch.priority = flags.priority;
+    if (typeof flags.proxied === 'boolean')
+        patch.proxied = flags.proxied;
+    if (Object.keys(patch).length === 0)
+        error('Nothing to update. Pass at least one of --name, --content, --ttl, --priority, --proxied.');
+    const r = await sdkDomain.updateDnsRecord(config.api_key, orgId, domain, recordId, patch);
+    success(`Updated record ${r.id}`);
+    printJson(r);
+}
+async function recordsDelete(domainArg, recordId, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain records delete <domain> <record-id> [--yes] [--org <id>]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain records delete <domain> <record-id> [--yes] [--org <id>]');
+    if (!recordId)
+        error('Missing record id.\nUsage: myapi domain records delete <domain> <record-id> [--yes]');
+    if (!flags.yes) {
+        info(`About to delete record ${recordId} from ${domain}. Re-run with --yes to confirm.`);
+        return;
+    }
+    await sdkDomain.deleteDnsRecord(config.api_key, orgId, domain, recordId);
+    success(`Deleted record ${recordId}`);
+}
+const RECORDS_HELP = `Usage: myapi domain records <subcommand> <domain> [...]
+
+Subcommands:
+  list <domain> [--type A|AAAA|CNAME|MX|TXT]
+  get <domain> <record-id>
+  create <domain> --type <T> --name <n> --content <c> [--ttl <n>]
+                                                       [--priority <n>] [--proxied]
+  update <domain> <record-id> [--content ...] [--ttl ...] [--priority ...] [--proxied]
+  delete <domain> <record-id> [--yes]
+
+Name normalization:
+  --name=@                       Apex (e.g. example.com)
+  --name=mail                    Host-only — backend appends the zone
+  --name=mail.example.com        FQDN
+  --name=""                      Apex (empty == @)
+
+Notes:
+  --ttl defaults to 1 (Cloudflare "automatic"). Explicit range: [60, 86400].
+  --priority is required for MX (typical: 10).
+  --proxied (CF "orange-cloud") applies to A/AAAA/CNAME only.
+
+Examples:
+  Fix the broken SPF on x80security.com:
+    myapi domain records list x80security.com --type TXT
+    myapi domain records delete x80security.com <bad-record-id> --yes
+    myapi domain records create x80security.com --type TXT --name @ \\
+      --content 'v=spf1 include:_spf.mailersend.net include:_spf.google.com ~all'
+    myapi domain records create x80security.com --type TXT --name @ \\
+      --content 'google-site-verification=...'`;
+async function recordsRun(sub, args, flags) {
+    if (!sub || (flags.help && !sub)) {
+        info(RECORDS_HELP);
+        return;
+    }
+    if (flags.help) {
+        info(RECORDS_HELP);
+        return;
+    }
+    switch (sub) {
+        case 'list': return recordsList(args[0], flags);
+        case 'get': return recordsGet(args[0], args[1], flags);
+        case 'create': return recordsCreate(args[0], flags);
+        case 'update': return recordsUpdate(args[0], args[1], flags);
+        case 'delete': return recordsDelete(args[0], args[1], flags);
+        default: error(`Unknown records subcommand: ${sub}. Run "myapi domain records --help".`);
+    }
+}
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     'list': `myapi domain list [--filter=all|unassigned|org] [--org <id>] [--json]
@@ -312,6 +527,25 @@ To transfer to a different org: unassign first, then assign to the new org.`,
 
 Gets current edge/CDN settings (security level, browser check, cache).
 Use "myapi domain update-settings" to change them.`,
+    'records': RECORDS_HELP,
+    'email-setup': `myapi domain email-setup <domain> [--subdomain <label>] [--org <id>]
+
+Opts in to MyAPI-managed outbound email on a subdomain of the domain.
+The apex is never touched — this is safe to run on a domain whose apex
+email is served by Google Workspace / Microsoft 365 / your existing provider.
+
+Defaults the subdomain to "mail" (i.e. mail.<domain>). Pass --subdomain to
+override (e.g. --subdomain=notifications for notifications.<domain>).
+
+Backend provisions an SES identity on <subdomain>.<domain> and writes
+DKIM / SPF / DMARC records to the CF zone. Track readiness via:
+  myapi domain status <domain> --watch`,
+    'retry-provisioning': `myapi domain retry-provisioning <domain> [--org <id>]
+
+Re-runs domain provisioning when status=infra_error and error_detail.retryable=true.
+The CLI surfaces the retry hint automatically when status renders infra_error.
+
+After triggering retry, poll: myapi domain status <domain> --watch`,
     'update-settings': `myapi domain update-settings <domain> [--security=<level>] [--browser-check=on|off] [--purge-cache] [--org <id>]
 
   --security=<level>       essentially_off | low | medium | high | under_attack  (default: medium)
@@ -336,6 +570,9 @@ Subcommands:
   status           Get domain status
   settings         Get edge/CDN settings
   update-settings  Update edge/CDN settings
+  records          Manage DNS records in the zone (list / get / create / update / delete)
+  email-setup      Opt in to MyAPI-managed email on a subdomain (default: mail.<domain>)
+  retry-provisioning  Re-run provisioning when status=infra_error and the failure is retryable
 
 Tip: Set defaults with "myapi config set-org <id>" / "set-domain <domain>" to skip flags on every command.`);
         return;
@@ -359,6 +596,9 @@ Tip: Set defaults with "myapi config set-org <id>" / "set-domain <domain>" to sk
         case 'status': return status(args[0], flags);
         case 'settings': return settings(args[0], flags);
         case 'update-settings': return updateSettings(args[0], flags);
+        case 'records': return recordsRun(args[0], args.slice(1), flags);
+        case 'email-setup': return emailSetup(args[0], flags);
+        case 'retry-provisioning': return retryProvisioning(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi domain --help" for a list of valid subcommands.`);
     }
 }

package/dist/index.js

@@ -82,12 +82,32 @@ const ERROR_MESSAGES = {
     INSUFFICIENT_BALANCE: 'Insufficient balance. Run: myapi billing topup <amount>',
     INVALID_AMOUNT: 'Amount out of range. Maximum single top-up is $100. Run: myapi billing topup <amount>',
     SERVICE_NOT_LAUNCHED: 'This service is disabled pre-launch. Track availability via: myapi status',
+    RECORD_NOT_FOUND: 'DNS record not found in this zone.',
+    INVALID_RECORD_TYPE: 'Unsupported record type. Allowed: A, AAAA, CNAME, MX, TXT.',
+    MX_PRIORITY_REQUIRED: 'MX records require --priority (typical value: 10).',
+    INVALID_TTL: 'Invalid TTL. Use the auto sentinel (1) or a value between 60 and 86400 seconds.',
+    INVALID_RECORD_CONTENT: 'Invalid record content for this type.',
+    RECORD_LIMIT_EXCEEDED: 'Cloudflare per-zone record limit reached.',
+    CF_API_ERROR: 'Cloudflare API error.',
     // invalid_json_response intentionally absent — the SDK's MyApiError now
     // builds a useful detailed message for that case (status + URL + body
     // snippet), and friendlyError(err.code) would override it.
 };
-function friendlyError(code) {
-    return ERROR_MESSAGES[code] || code;
+function friendlyError(err) {
+    const body = err.body ?? {};
+    // CF_API_ERROR: the cf_message already includes a "Cloudflare API error"
+    // prefix, so use it verbatim (with cf_status if present) instead of doubling.
+    if (err.code === 'CF_API_ERROR' && typeof body.cf_message === 'string') {
+        return typeof body.cf_status === 'number'
+            ? `${body.cf_message} (HTTP ${body.cf_status})`
+            : body.cf_message;
+    }
+    const base = ERROR_MESSAGES[err.code] || err.code;
+    // Generic fallback: append the backend's `message` when it adds info beyond
+    // the friendly mapping. Future per-service detail fields can be added here.
+    if (err.detail && err.detail !== base)
+        return `${base} — ${err.detail}`;
+    return base;
 }
 async function main() {
     // Shell autocomplete: if invoked by the shell with completion env vars,
@@ -243,7 +263,7 @@ async function main() {
                 }
             }
             else
-                error(friendlyError(err.code) || err.message);
+                error(friendlyError(err) || err.message);
         }
         else {
             // Don't JSON.stringify Error instances — that returns "{}" because

package/dist/skills/my-domain-api/SKILL.md

@@ -50,9 +50,17 @@ Resolution at register time (highest wins): `--registrant-json` → per-field fl
 | `myapi domain list [--filter all\|unassigned\|org]` | List domains in your account |
 | `myapi domain assign <domain>` | Assign domain to your default (or `--org`) org |
 | `myapi domain unassign <domain>` | Remove domain from its org |
-| `myapi domain status <domain>` | Registration + DNS propagation status |
+| `myapi domain import <domain>` | Bring-your-own-domain. Snapshots current DNS, returns nameservers to set at your existing registrar — no registrar credentials needed |
+| `myapi domain status <domain> [--watch]` | Registration + DNS propagation status. `--watch` polls until terminal (10s × 30 → 30s × 60) |
 | `myapi domain settings <domain>` | View edge/CDN settings |
 | `myapi domain update-settings <domain>` | Change security level, browser check, purge cache |
+| `myapi domain records list <domain> [--type T]` | List DNS records in the zone |
+| `myapi domain records get <domain> <id>` | Fetch one record |
+| `myapi domain records create <domain> --type T --name n --content c` | Create a record (priority required for MX) |
+| `myapi domain records update <domain> <id> [--content c] [...]` | Update a record (type cannot change) |
+| `myapi domain records delete <domain> <id> --yes` | Delete a record |
+| `myapi domain email-setup <domain> [--subdomain <label>]` | Opt in to MyAPI-managed email on a subdomain (default: `mail.<domain>`). Apex is never touched |
+| `myapi domain retry-provisioning <domain>` | Re-run provisioning when status=infra_error and error_detail.retryable=true |
 <!-- generated:end -->
 
 ## Examples
@@ -73,6 +81,26 @@ myapi domain renew example.com
 # Tune the edge for AI bot traffic
 myapi domain update-settings example.com \
   --security=essentially_off --browser-check=off --purge-cache
+
+# Bring an existing domain — works with any registrar (Namecheap, GoDaddy, CF Registrar, etc.)
+myapi domain import example.com
+# → Returns nameservers; set them at your current registrar.
+myapi domain status example.com --watch
+# → Polls until active. Backend live-checks Cloudflare each poll.
+
+# Fix a record after import (e.g. clean up SPF)
+myapi domain records list example.com --type TXT
+myapi domain records delete example.com <bad-id> --yes
+myapi domain records create example.com --type TXT --name @ \
+  --content 'v=spf1 include:_spf.google.com ~all'
+
+# Opt in to MyAPI email on a subdomain (apex Google Workspace stays untouched)
+myapi domain email-setup example.com                # → mail.example.com
+myapi domain email-setup example.com --subdomain=notifications
+
+# Recover from infra_error
+myapi domain status example.com                     # CLI prints the retry hint
+myapi domain retry-provisioning example.com
 ```
 
 Security levels: `essentially_off` · `low` · `medium` · `high` · `under_attack`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.2.1",
+  "version": "1.2.4",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -27,7 +27,7 @@
     "lint:changelog": "node ../../scripts/lint-changelog.js"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.2.1",
+    "@myapihq/sdk": "^1.2.4",
     "omelette": "^0.4.17"
   },
   "devDependencies": {