@myapihq/cli 1.2.6 → 1.2.7

package/dist/commands/billing.d.ts

@@ -6,6 +6,7 @@ export declare const EXPOSES: Exposes;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;
 export declare function balance(flags: Flags): Promise<void>;
 export declare function history(flags: Flags): Promise<void>;
+export declare function usage(flags: Flags): Promise<void>;
 export declare function topup(amountStr: string, flags: Flags): Promise<void>;
 export declare function setup(_flags: Flags): Promise<void>;
 export declare function spendCap(arg: string | undefined, flags: Flags): Promise<void>;

package/dist/commands/billing.js

@@ -9,6 +9,7 @@ export const SCHEMA = {
 export const EXPOSES = [
     'GET /hq/billing/balance',
     'GET /hq/billing/history',
+    'GET /hq/billing/usage',
     'POST /hq/billing/setup-payment',
     'POST /hq/billing/topup',
     'GET /hq/account/me',
@@ -17,6 +18,11 @@ export const EXPOSES = [
 const SUBCOMMAND_USAGE = {
     'balance': 'myapi billing balance [--json]',
     'history': 'myapi billing history [--json]',
+    'usage': `myapi billing usage [--period month|30d] [--json]
+
+Spend rolled up by service — the accurate "where is my money going" view.
+Aggregates every billing event, unlike the flat history log. Defaults to
+the current calendar month; --period 30d gives the trailing 30 days.`,
     'topup': `myapi billing topup <amount> [--yes]
 
 Amount is in whole dollars (e.g. "10" charges $10).
@@ -44,6 +50,7 @@ export async function run(subcommand, args, flags) {
 Subcommands:
   balance    Check balance, credits, and payment method status
   history    View recent transactions and top-ups
+  usage      Spend rolled up by service (this month, or --period 30d)
   topup      Top up your balance (whole dollars)
   setup      Open a checkout link to add or update payment method
   spend-cap  Set/show/clear the account-level spend ceiling (IAM Layer 2)`);
@@ -60,6 +67,7 @@ Subcommands:
     switch (subcommand) {
         case 'balance': return balance(flags);
         case 'history': return history(flags);
+        case 'usage': return usage(flags);
         case 'topup': return topup(args[0], flags);
         case 'setup': return setup(flags);
         case 'spend-cap': return spendCap(args[0], flags);
@@ -105,6 +113,31 @@ export async function history(flags) {
         empty: 'No transactions yet.',
     });
 }
+// Spend rolled up by service. Aggregates every billing event over the
+// window (current calendar month, or trailing 30 days with --period 30d) —
+// the accurate "where is my money going" view, distinct from `history`.
+export async function usage(flags) {
+    const config = requireConfig();
+    const period = flags.period || 'month';
+    if (period !== 'month' && period !== '30d') {
+        error(`Invalid --period "${period}". Use month or 30d.`);
+    }
+    const res = await hq.getBillingUsage(config.api_key, period);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    info(`Spend by service — ${res.period === '30d' ? 'last 30 days' : 'this month'} (since ${formatDate(res.since)})`);
+    printTable(res.services.map(s => ({
+        Service: s.service,
+        Requests: s.requests,
+        Cost: s.cost_display,
+    })), {
+        flags,
+        empty: 'No usage recorded in this window.',
+    });
+    info(`Total: ${res.total_display}`);
+}
 export async function topup(amountStr, flags) {
     const amount = Math.round(parseFloat(amountStr));
     if (!amountStr || isNaN(amount) || amount <= 0) {

package/dist/commands/container-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/container-validation.test.js

@@ -0,0 +1,45 @@
+// Unit tests for container.ts CLI's pure helpers — name validation
+// (mirrors the backend regex/reserved set) and the --env K=V parser.
+import { describe, it, expect } from 'vitest';
+import { _validateName, _parseEnv, NAME_RE, RESERVED_NAMES } from './container.js';
+describe('_validateName — pure helper', () => {
+    it.each(['a', 'api-server', 'worker-2', '0', 'a'.repeat(50)])('accepts %s', (name) => {
+        expect(_validateName(name)).toBeNull();
+    });
+    it.each([
+        ['empty', ''],
+        ['UPPERCASE', 'BAD'],
+        ['underscore', 'my_app'],
+        ['leading hyphen', '-app'],
+        ['too long', 'a'.repeat(51)],
+        ['space', 'my app'],
+    ])('rejects %s', (_label, name) => {
+        expect(_validateName(name)).toMatch(/Invalid --name/);
+    });
+    it.each([...RESERVED_NAMES])('rejects reserved name %s', (name) => {
+        expect(_validateName(name)).toMatch(/is reserved/);
+    });
+    it('matches the backend regex exactly', () => {
+        expect(NAME_RE.source).toBe('^[a-z0-9][a-z0-9-]{0,49}$');
+    });
+});
+describe('_parseEnv — pure helper', () => {
+    it('parses a single KEY=VALUE pair', () => {
+        expect(_parseEnv('FOO=bar')).toEqual({ FOO: 'bar' });
+    });
+    it('parses comma-separated pairs', () => {
+        expect(_parseEnv('FOO=bar,BAZ=qux')).toEqual({ FOO: 'bar', BAZ: 'qux' });
+    });
+    it('keeps = inside the value', () => {
+        expect(_parseEnv('URL=https://x?a=1')).toEqual({ URL: 'https://x?a=1' });
+    });
+    it('tolerates surrounding whitespace and empty segments', () => {
+        expect(_parseEnv(' FOO=bar , ')).toEqual({ FOO: 'bar' });
+    });
+    it.each([
+        ['no equals', 'FOObar'],
+        ['leading equals (empty key)', '=bar'],
+    ])('rejects %s', (_label, raw) => {
+        expect(_parseEnv(raw)).toMatch(/Invalid --env entry/);
+    });
+});

package/dist/commands/container.d.ts

@@ -0,0 +1,15 @@
+import type { FlagSchema } from '../flags.js';
+import { type Flags } from '../helpers.js';
+import type { Exposes } from '../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare const SCHEMA: FlagSchema;
+export declare const NAME_RE: RegExp;
+export declare const RESERVED_NAMES: Set<string>;
+export declare function _validateName(name: string): string | null;
+export declare function _parseEnv(raw: string): Record<string, string> | string;
+export declare function create(flags: Flags): Promise<void>;
+export declare function list(flags: Flags): Promise<void>;
+export declare function get(id: string, flags: Flags): Promise<void>;
+export declare function del(id: string, flags: Flags): Promise<void>;
+export declare function deploy(id: string, image: string, flags: Flags): Promise<void>;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/container.js

@@ -0,0 +1,242 @@
+import { container as sdkContainer } from '@myapihq/sdk';
+import { requireConfig } from '../config.js';
+import { success, error, printTable, info, printJson, banner } from '../output.js';
+import { formatDate } from '../utils.js';
+import { requireOrg } from '../helpers.js';
+export const EXPOSES = [
+    'POST /container/orgs/{org_id}/containers',
+    'GET /container/orgs/{org_id}/containers',
+    'GET /container/orgs/{org_id}/containers/{id}',
+    'DELETE /container/orgs/{org_id}/containers/{id}',
+    'POST /container/orgs/{org_id}/containers/{id}/deploy',
+];
+export const SCHEMA = {
+    name: 'string',
+    type: 'string',
+    cron: 'string',
+    cpu: 'string',
+    memory: 'string',
+    'min-instances': 'number',
+    'max-instances': 'number',
+    port: 'number',
+    env: 'string',
+};
+const CONTAINER_TYPES = ['service', 'worker', 'job'];
+// Mirrors validateName in myapi-hq/internal/routes/container/crud.go —
+// identical to functions. Client-side rejection so typos fail before the
+// network call; the backend runs the same regex as defence in depth.
+export const NAME_RE = /^[a-z0-9][a-z0-9-]{0,49}$/;
+export const RESERVED_NAMES = new Set(['www', 'api', 'admin', 'system', 'default']);
+// Returns an error message on failure, or null on success. Pure — no I/O,
+// no process.exit. Tests use this form; the caller wraps it in error().
+export function _validateName(name) {
+    if (!NAME_RE.test(name)) {
+        return `Invalid --name "${name}". Lowercase letters, digits, hyphens; 1-50 chars; starts with a letter or digit.`;
+    }
+    if (RESERVED_NAMES.has(name)) {
+        return `Name "${name}" is reserved. Pick a different one.`;
+    }
+    return null;
+}
+// Parses `--env K=V,K2=V2` into an object. Returns the map or an error
+// message string (pure form, for tests).
+export function _parseEnv(raw) {
+    const env = {};
+    for (const pair of raw.split(',').map(s => s.trim()).filter(Boolean)) {
+        const eq = pair.indexOf('=');
+        if (eq < 1) {
+            return `Invalid --env entry "${pair}". Use KEY=VALUE, comma-separated.`;
+        }
+        env[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+    return env;
+}
+function summarizeContainer(c) {
+    return {
+        id: c.id,
+        name: c.name,
+        type: c.type,
+        status: c.status,
+        url: c.url || '(not deployed)',
+        updated_at: c.updated_at ? formatDate(c.updated_at) : '',
+    };
+}
+export async function create(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container create --name <name> [--type service|worker|job] [--org <id>]');
+    const name = flags.name;
+    if (!name) {
+        error('Missing --name.\nUsage: myapi container create --name <name> [--type service|worker|job] [--org <id>]\n\n→ Name is a kebab-case slug, 1-50 chars (e.g. "my-worker").');
+    }
+    const nameErr = _validateName(name);
+    if (nameErr)
+        error(nameErr);
+    const type = flags.type ?? 'service';
+    if (!CONTAINER_TYPES.includes(type)) {
+        error(`Invalid --type "${type}". Use one of: ${CONTAINER_TYPES.join(', ')}.`);
+    }
+    const cron = flags.cron;
+    if (cron && type !== 'job') {
+        error('--cron is only valid for --type job (services and workers are always-on).');
+    }
+    const payload = { name, type: type };
+    if (cron)
+        payload.cron_schedule = cron;
+    if (typeof flags.cpu === 'string')
+        payload.cpu = flags.cpu;
+    if (typeof flags.memory === 'string')
+        payload.memory = flags.memory;
+    if (typeof flags['min-instances'] === 'number')
+        payload.min_instances = flags['min-instances'];
+    if (typeof flags['max-instances'] === 'number')
+        payload.max_instances = flags['max-instances'];
+    if (typeof flags.port === 'number')
+        payload.port = flags.port;
+    if (typeof flags.env === 'string') {
+        const env = _parseEnv(flags.env);
+        if (typeof env === 'string')
+            error(env);
+        payload.env = env;
+    }
+    const result = await sdkContainer.createContainer(config.api_key, orgId, payload);
+    success(`Container created: ${result.container.id}`);
+    info(`Name:            ${result.container.name}`);
+    info(`Type:            ${result.container.type}${result.container.cron_schedule ? ` (${result.container.cron_schedule})` : ''}`);
+    info(`Resources:       ${result.container.cpu} CPU, ${result.container.memory}, instances ${result.container.min_instances}-${result.container.max_instances}`);
+    // The scoped key is returned ONCE — it's delivered to the running
+    // container as the MYAPI_KEY env var. Deploy rotates it.
+    info('');
+    info(`Scoped API key (returned once — save it if you need it):`);
+    info(`  ${result.scoped_api_key}`);
+    if (!result.container.url) {
+        info('');
+        banner(`Next: deploy an image with  myapi container deploy ${result.container.id} <image-ref>`);
+    }
+}
+export async function list(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container list [--org <id>]');
+    const containers = await sdkContainer.listContainers(config.api_key, orgId);
+    if (flags.json) {
+        printJson(containers);
+        return;
+    }
+    printTable(containers.map(summarizeContainer), {
+        flags,
+        empty: 'No containers yet. Create one with: myapi container create --name <name>',
+    });
+}
+export async function get(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container get <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi container get <id>');
+    const c = await sdkContainer.getContainer(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(c);
+        return;
+    }
+    info(`ID:              ${c.id}`);
+    info(`Name:            ${c.name}`);
+    info(`Type:            ${c.type}${c.cron_schedule ? ` (${c.cron_schedule})` : ''}`);
+    info(`Status:          ${c.status}`);
+    info(`Resources:       ${c.cpu} CPU, ${c.memory}, instances ${c.min_instances}-${c.max_instances}`);
+    if (c.port)
+        info(`Port:            ${c.port}`);
+    info(`URL:             ${c.url || '(not deployed)'}`);
+    info(`Created:         ${c.created_at}`);
+    info(`Updated:         ${c.updated_at}`);
+}
+export async function del(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container delete <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi container delete <id>');
+    await sdkContainer.deleteContainer(config.api_key, orgId, id);
+    success(`Deleted container ${id}`);
+}
+// deploy ships a pre-built image to Cloud Run. The scoped API key is
+// rotated on every deploy — the fresh value is shown once here.
+export async function deploy(id, image, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container deploy <id> <image-ref> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi container deploy <id> <image-ref>');
+    if (!image)
+        error('Missing image ref.\nUsage: myapi container deploy <id> <image-ref>\n\n→ <image-ref> is a pre-built container image (e.g. a registry path).');
+    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image);
+    if (flags.json) {
+        printJson(result);
+        return;
+    }
+    success(`Deployed container ${id} (revision ${result.revision_id})`);
+    info(`Status:          ${result.status}`);
+    info(`URL:             ${result.url}`);
+    info('');
+    info(`Scoped API key was rotated. New value (returned once — save it if you need it):`);
+    info(`  ${result.scoped_api_key}`);
+}
+// ── Dispatcher ───────────────────────────────────────────────────────────────
+const SUBCOMMAND_USAGE = {
+    'create': `myapi container create --name <name> [--type service|worker|job] [--cron <expr>]
+                       [--cpu <n>] [--memory <size>] [--min-instances <n>]
+                       [--max-instances <n>] [--port <n>] [--env K=V,...] [--org <id>]
+
+Persists a container record + issues a scoped API key. Deploy an image
+separately with "myapi container deploy".
+
+Types:
+  service   HTTP server (default) — scales to zero
+  worker    always-on background process (min 1 instance)
+  job       runs to completion — the only type that accepts --cron
+
+Examples:
+  myapi container create --name api --port 8080
+  myapi container create --name nightly --type job --cron "0 3 * * *"
+  myapi container create --name queue-worker --type worker --memory 1Gi`,
+    'deploy': `myapi container deploy <id> <image-ref> [--org <id>] [--json]
+
+Ships a pre-built container image to the runtime. The scoped API key is
+rotated on every deploy — the fresh value is printed once.
+
+Example:
+  myapi container deploy <id> registry.example.com/my-app:v2`,
+    'list': 'myapi container list [--org <id>] [--json]',
+    'get': 'myapi container get <id> [--org <id>] [--json]',
+    'delete': 'myapi container delete <id> [--org <id>]',
+};
+export async function run(subcommand, args, flags) {
+    if (!subcommand || (flags.help && !subcommand)) {
+        info(`Usage: myapi container <subcommand>
+
+Run containers — long-running services, background workers, and scheduled
+jobs. The heavier-duty sibling of edge functions (myapi fn), for native
+dependencies and long execution.
+
+Subcommands:
+  create               Register a container and get its scoped API key (returned once)
+  deploy <id> <image>  Ship a pre-built image and go live
+  list                 List containers in your org
+  get <id>             Inspect a container
+  delete <id>          Soft-delete and revoke its scoped API key
+
+All commands accept --org <id> (or set default: myapi config set-org <id>).`);
+        return;
+    }
+    if (flags.help) {
+        const usage = SUBCOMMAND_USAGE[subcommand];
+        if (usage)
+            info(`Usage: ${usage}`);
+        else
+            info(`Unknown subcommand: ${subcommand}. Run "myapi container --help" for the list.`);
+        return;
+    }
+    switch (subcommand) {
+        case 'create': return create(flags);
+        case 'deploy': return deploy(args[0], args[1], flags);
+        case 'list': return list(flags);
+        case 'get': return get(args[0], flags);
+        case 'delete': return del(args[0], flags);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi container --help" for a list of valid subcommands.`);
+    }
+}

package/dist/commands/email/campaign.js

@@ -35,7 +35,22 @@ async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi email campaign list [--org <id>]');
     const campaigns = await sdkEmail.listCampaigns(config.api_key, orgId);
-    printTable(campaigns, {
+    if (flags.json) {
+        printJson(campaigns);
+        return;
+    }
+    // Drops warmup_config — a nested object that renders as "[object Object]"
+    // in a table. The scalar fields below are what a listing needs; the full
+    // config is in `myapi email campaign get <id>` and `--json`.
+    printTable(campaigns.map(c => ({
+        id: c.id,
+        name: c.name,
+        status: c.status,
+        template_id: c.template_id,
+        from_address: c.from_address,
+        per_day_limit: c.per_day_limit,
+        created_at: c.created_at,
+    })), {
         flags,
         empty: 'No campaigns yet. Create one with: myapi email campaign create',
     });

package/dist/commands/email/message.js

@@ -9,6 +9,17 @@ export const EXPOSES = [
     'GET /email/outbox/{address}',
     'GET /email/message/{message_id}',
 ];
+// Table columns for a message listing. Drops `body` — the full message
+// content is large and belongs in `myapi email message get <id>`, not in a
+// list row. `--json` still returns the complete record.
+function summarizeMessage(m) {
+    return {
+        message_id: m.message_id,
+        from: m.from,
+        subject: m.subject,
+        received_at: m.received_at,
+    };
+}
 async function send(flags) {
     const config = requireConfig();
     if (!flags.from || !flags.to || !flags.subject) {
@@ -50,7 +61,11 @@ async function sent(flags) {
     const limit = flags.limit || 50;
     const offset = flags.offset || 0;
     const emails = await sdkEmail.getSentEmails(config.api_key, limit, offset);
-    printTable(emails, {
+    if (flags.json) {
+        printJson(emails);
+        return;
+    }
+    printTable(emails.map(summarizeMessage), {
         flags,
         empty: 'No sent emails yet.',
     });
@@ -60,7 +75,11 @@ async function inbox(address, flags) {
     if (!address)
         error('Missing required arguments.\nUsage: myapi email message inbox <address>');
     const messages = await sdkEmail.getInbox(config.api_key, address);
-    printTable(messages, {
+    if (flags.json) {
+        printJson(messages);
+        return;
+    }
+    printTable(messages.map(summarizeMessage), {
         flags,
         empty: `No messages in ${address}.`,
     });
@@ -70,7 +89,11 @@ async function outbox(address, flags) {
     if (!address)
         error('Missing required arguments.\nUsage: myapi email message outbox <address>');
     const messages = await sdkEmail.getOutbox(config.api_key, address);
-    printTable(messages, {
+    if (flags.json) {
+        printJson(messages);
+        return;
+    }
+    printTable(messages.map(summarizeMessage), {
         flags,
         empty: `No outbound messages from ${address}.`,
     });

package/dist/commands/email/template.js

@@ -44,7 +44,14 @@ async function list(flags) {
         printJson(templates);
         return;
     }
-    printTable(templates, {
+    // Drops preview_url (a long URL, available via `template get`) and
+    // created_at (updated_at is the field a listing cares about).
+    printTable(templates.map(t => ({
+        id: t.id,
+        name: t.name,
+        subject: t.subject,
+        updated_at: t.updated_at,
+    })), {
         flags,
         empty: 'No templates yet. Generate one with: myapi email template generate --prompt <p> --name <n>',
     });

package/dist/commands/pixel.js

@@ -75,7 +75,13 @@ export async function visits(flags) {
         printJson(res);
         return;
     }
-    printTable(res.visits);
+    // `type` is constant ('visit') across this list — omitted from the table.
+    printTable(res.visits.map(v => ({
+        pixel_id: v.pixel_id,
+        from_url: v.from_url,
+        to_url: v.to_url,
+        ts: v.ts,
+    })));
     info(`Total: ${res.total} | Showing: ${res.limit} | Offset: ${res.offset}`);
 }
 // Engagement events (open / click / page_visit / sent) — filterable by
@@ -106,7 +112,14 @@ export async function events(flags) {
         printJson(res);
         return;
     }
-    printTable(res.events);
+    // `type` is constant ('event') across this list — omitted from the table.
+    printTable(res.events.map(e => ({
+        pixel_id: e.pixel_id,
+        event_type: e.event_type,
+        url: e.url ?? '',
+        campaign_id: e.campaign_id ?? '',
+        ts: e.ts,
+    })));
     info(`Total: ${res.total} | Showing: ${res.limit} | Offset: ${res.offset}`);
 }
 // Geographic distribution sample of the org's pixel audience.

package/dist/commands/update.d.ts

@@ -1,7 +1,7 @@
 import type { Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
+export declare function cachedLatestVersion(): string | null;
 export declare function checkForUpdate(currentVersion: string): Promise<void>;
 export declare function update(flags?: Flags): Promise<void>;
-export declare function latestVersion(): Promise<string | null>;
 export declare function isNewer(latest: string, current: string): boolean;

package/dist/commands/update.js

@@ -1,6 +1,7 @@
 import { execSync } from 'child_process';
-import { existsSync } from 'fs';
-import { loadConfig } from '../config.js';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { join } from 'path';
+import { loadConfig, CONFIG_DIR } from '../config.js';
 import { info, success, banner } from '../output.js';
 import { installSkills } from './setup.js';
 // `myapi update` only talks to the npm registry to check for new CLI versions
@@ -8,6 +9,33 @@ import { installSkills } from './setup.js';
 export const EXPOSES = [];
 const REGISTRY_URL = 'https://registry.npmjs.org/@myapihq/cli/latest';
 const PACKUMENT_URL = 'https://registry.npmjs.org/@myapihq/cli';
+// The update check hits the npm registry. Caching its result means at most
+// one network round-trip per TTL window instead of one on every command —
+// the dominant cost in CLI startup latency.
+const UPDATE_CACHE_FILE = join(CONFIG_DIR, 'update-check.json');
+const CHECK_TTL_MS = 6 * 60 * 60 * 1000; // 6 hours
+function readUpdateCache() {
+    try {
+        return JSON.parse(readFileSync(UPDATE_CACHE_FILE, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+function writeUpdateCache(cache) {
+    try {
+        if (!existsSync(CONFIG_DIR))
+            mkdirSync(CONFIG_DIR, { recursive: true });
+        writeFileSync(UPDATE_CACHE_FILE, JSON.stringify(cache));
+    }
+    catch { /* best-effort — a write failure just means we re-check sooner */ }
+}
+// The last-known published version, read from cache with no network call.
+// `myapi --version` uses this so it can flag an available update without the
+// ~1s registry round-trip blocking the output.
+export function cachedLatestVersion() {
+    return readUpdateCache()?.latest ?? null;
+}
 // Verify the version is listed in the full packument — the same data source
 // `npm install` consults. The /latest endpoint and the tarball URL are on
 // different CDN caches and can update before the packument does, causing
@@ -48,42 +76,48 @@ function npmInstallArgs(version) {
     }
 }
 // checkForUpdate runs silently in the background on every command.
-// Auto-installs if a newer version is available.
+// Auto-installs if a newer version is available. The registry is consulted
+// at most once per CHECK_TTL_MS; runs within that window reuse the cache.
 // Suppress entirely with MYAPI_NO_UPDATE=1 or when stdout is not a TTY.
 export async function checkForUpdate(currentVersion) {
     if (process.env.MYAPI_NO_UPDATE === '1' || !process.stdout.isTTY)
         return;
+    const cache = readUpdateCache();
+    let latest = cache?.latest;
+    if (!cache || Date.now() - cache.checkedAt >= CHECK_TTL_MS) {
+        try {
+            const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(3000) });
+            if (res.ok)
+                latest = (await res.json()).version ?? latest;
+        }
+        catch {
+            // Network errors are silently ignored — keep the last known `latest`.
+        }
+        // Record the attempt regardless of outcome so a slow or unreachable
+        // registry isn't re-hit on the very next command.
+        writeUpdateCache({ checkedAt: Date.now(), latest });
+    }
+    if (!latest || !isNewer(latest, currentVersion))
+        return;
+    // Verify the version is actually installable before attempting install —
+    // the /latest endpoint can report a new version before the packument
+    // (which `npm install` consults) has propagated through the CDN.
+    if (!(await isVersionInstallable(latest)))
+        return;
+    banner(`\n› New version available (${currentVersion} → ${latest}) — installing…`);
     try {
-        const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(3000) });
-        if (!res.ok)
-            return;
-        const data = await res.json();
-        const latest = data.version;
-        if (latest && isNewer(latest, currentVersion)) {
-            // Verify the version is actually installable before attempting install —
-            // the /latest endpoint can report a new version before the packument
-            // (which `npm install` consults) has propagated through the CDN.
-            if (!(await isVersionInstallable(latest)))
-                return;
-            banner(`\n› New version available (${currentVersion} → ${latest}) — installing…`);
-            try {
-                const { bin, args } = npmInstallArgs(latest);
-                execSync(`"${bin}" ${args.map(a => `"${a}"`).join(' ')}`, { stdio: 'pipe' });
-                const config = loadConfig();
-                if (config?.skills_installed) {
-                    await installSkills();
-                }
-                banner(`› Updated to ${latest} — active after this command completes.\n`);
-            }
-            catch (installErr) {
-                const msg = installErr?.stderr?.toString?.() || installErr?.message || String(installErr);
-                banner(`› Auto-update failed: ${msg.trim()}`);
-                banner(`› Run manually: npm install -g @myapihq/cli@latest`);
-            }
+        const { bin, args } = npmInstallArgs(latest);
+        execSync(`"${bin}" ${args.map(a => `"${a}"`).join(' ')}`, { stdio: 'pipe' });
+        const config = loadConfig();
+        if (config?.skills_installed) {
+            await installSkills();
         }
+        banner(`› Updated to ${latest} — active after this command completes.\n`);
     }
-    catch {
-        // Network errors are silently ignored.
+    catch (installErr) {
+        const msg = installErr?.stderr?.toString?.() || installErr?.message || String(installErr);
+        banner(`› Auto-update failed: ${msg.trim()}`);
+        banner(`› Run manually: npm install -g @myapihq/cli@latest`);
     }
 }
 // myapi update — explicit update, same logic as auto-update.
@@ -100,8 +134,10 @@ export async function update(flags = {}) {
             throw new Error(`registry returned ${res.status}`);
         const data = await res.json();
         latest = data.version ?? '';
-        if (latest)
+        if (latest) {
+            writeUpdateCache({ checkedAt: Date.now(), latest });
             info(`› Installing @myapihq/cli@${latest}…`);
+        }
     }
     catch { /* proceed anyway */ }
     try {
@@ -116,19 +152,6 @@ export async function update(flags = {}) {
     await installSkills();
     success('Up to date.');
 }
-// latestVersion fetches the current published version for --version display.
-export async function latestVersion() {
-    try {
-        const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(3000) });
-        if (!res.ok)
-            return null;
-        const data = await res.json();
-        return data.version ?? null;
-    }
-    catch {
-        return null;
-    }
-}
 // Stable-only semver comparison (1.2.3). Prerelease versions (1.2.3-wip.0)
 // produce NaN in the patch slot, and `n > NaN` is always false — which is
 // what we want: a prerelease user should not be auto-rolled back to stable.

package/dist/commands/webhook.js

@@ -25,7 +25,16 @@ export async function list(flags) {
         printJson(endpoints);
         return;
     }
-    printTable(endpoints, {
+    // Curated columns: org_id is the query scope (identical every row), and
+    // url is mechanically derivable from slug — both omitted here to keep the
+    // table token-dense. `myapi webhook get <id>` shows the full record.
+    printTable(endpoints.map(e => ({
+        id: e.id,
+        name: e.name,
+        slug: e.slug,
+        crm_email_path: e.crm_email_path ?? '',
+        created_at: e.created_at,
+    })), {
         flags,
         empty: 'No webhook endpoints yet. Create one with: myapi webhook create --name <name>',
     });

package/dist/completion.d.ts

@@ -1,3 +1,5 @@
-export declare function initCompletion(): void;
+export declare const COMMANDS: string[];
+export declare const SUBCOMMANDS: Record<string, string[]>;
+export declare function handleCompletionRequest(): void;
 export declare function installCompletion(): void;
 export declare function uninstallCompletion(): void;

package/dist/completion.js

@@ -1,24 +1,46 @@
-// Shell autocomplete via omelette. Quietly active on every CLI run — when
-// the shell invokes us with the magic completion env vars, omelette's
-// init() handles the request and exits before we hit normal command
-// dispatch. On any other run, init() returns immediately.
+// Shell tab-completion — hand-rolled, zero third-party dependencies.
 //
-// User installs the shell hook with `myapi completion install` (or
-// uninstalls with `myapi completion uninstall`). Supports bash, zsh, and
-// fish (handled internally by omelette).
+// This previously used the `omelette` package. It was removed for
+// supply-chain safety: `myapi` is installed globally and reads the user's
+// live API key from ~/.myapi/config.json on every run, so an unmaintained
+// dependency on this path is an unacceptable compromise vector — one bad
+// release would exfiltrate every user's key. This module reproduces only
+// what we used (completion-request handling + shell init-file wiring) as
+// audited first-party code.
 //
-// The tree below mirrors the dispatcher in index.ts and the per-command
-// switch statements. When you add a new top-level command or subcommand,
-// extend it here too — there's no automatic discovery.
-import omelette from 'omelette';
-const TREE = {
-    auth: ['link', 'switch', 'whoami', 'config', 'registrant'],
-    registrant: ['set', 'get', 'clear'],
+// Protocol: the shell init snippet generated below calls back
+//   myapi --comp{bash,zsh,fish} --compgen <cword> <prev> <line>
+// We parse <line>, compute the candidate list, print it newline-separated,
+// and exit. The shell itself narrows the list to the partial word.
+//
+// This module is imported lazily (see index.ts) — only when argv carries a
+// --comp* marker — so it never loads on a normal command run.
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+const PROGRAM = 'myapi';
+const COMPLETION_DIR = path.join(os.homedir(), '.myapi');
+const BLOCK_BEGIN = `# begin ${PROGRAM} completion`;
+const BLOCK_END = `# end ${PROGRAM} completion`;
+// Top-level commands — what `myapi <TAB>` offers. Kept honest by
+// test/smoke/completion.test.ts, which fails if a command in `myapi --help`
+// is missing here.
+export const COMMANDS = [
+    'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
+    'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'help', 'image',
+    'install-skills', 'keys', 'llm', 'org', 'payments', 'people', 'pixel',
+    'setup', 'status', 'storage', 'update', 'url', 'webhook', 'whoami',
+    'workflow',
+];
+// command → subcommands, for `myapi <command> <TAB>`. Mirrors each
+// command's dispatcher; commands absent here take no subcommand.
+export const SUBCOMMANDS = {
+    auth: ['setup', 'import-key', 'whoami', 'link', 'switch', 'install-skills', 'config', 'registrant', 'api-keys'],
     org: ['create', 'delete', 'get', 'import', 'list', 'sync-brand', 'update'],
-    billing: ['balance', 'history', 'setup', 'topup'],
-    domain: ['assign', 'check', 'list', 'register', 'renew', 'settings', 'status', 'unassign', 'update-settings'],
-    funnel: ['create', 'delete', 'get', 'list', 'pages', 'push', 'verify'],
-    webhook: ['create', 'delete', 'delivery', 'list'],
+    billing: ['balance', 'history', 'usage', 'setup', 'topup', 'spend-cap'],
+    domain: ['assign', 'check', 'email-setup', 'import', 'list', 'records', 'register', 'renew', 'retry-provisioning', 'settings', 'status'],
+    funnel: ['create', 'delete', 'get', 'list', 'pages', 'publish', 'push', 'verify'],
+    webhook: ['create', 'delete', 'delivery', 'list', 'update'],
     workflow: ['create', 'delete', 'disable', 'enable', 'get', 'get-run', 'list', 'runs', 'update'],
     email: ['mailbox', 'message', 'warmup', 'template', 'campaign', 'verify'],
     image: ['delete', 'generate', 'get', 'get-url', 'list', 'models'],
@@ -30,49 +52,132 @@ const TREE = {
     llm: ['complete', 'embed', 'models'],
     database: ['namespaces', 'create', 'delete-namespace', 'keys', 'get', 'set', 'del'],
     crm: ['contacts', 'companies'],
-    contacts: ['list', 'search', 'create', 'get', 'update', 'delete', 'restore', 'promote', 'events'],
-    companies: ['list', 'search', 'create', 'get', 'update', 'delete', 'restore', 'promote'],
     url: ['shorten'],
-    keys: ['create', 'list', 'revoke'],
-    'api-keys': ['create', 'list', 'revoke'],
+    keys: ['create', 'list', 'revoke', 'revoke-all'],
     config: ['view', 'set-org', 'set-funnel', 'set-domain'],
-    setup: [],
-    'import-key': [],
-    whoami: [],
-    status: [],
-    'install-skills': [],
-    update: [],
+    fn: ['create', 'deploy', 'env', 'runs', 'list', 'get', 'delete'],
+    payments: ['connect', 'status', 'charge', 'list', 'get', 'refund'],
+    container: ['create', 'deploy', 'list', 'get', 'delete'],
     completion: ['install', 'uninstall'],
-    help: [],
 };
-const TOP_LEVEL = Object.keys(TREE).sort();
-const completion = omelette('myapi <command> <subcommand>');
-completion.on('command', ({ reply }) => reply(TOP_LEVEL));
-completion.on('subcommand', ({ before, reply, line }) => {
-    // omelette's `before` is the LAST word of the line, not the previous
-    // word. When the user has started typing a partial subcommand (e.g.
-    // "myapi audience l"), `before` is "l", not "audience" — so a naive
-    // `TREE[before]` returns undefined and tab completion silently fails.
-    // Detect the real parent command by checking whether the line ends in
-    // whitespace (no partial in flight → use `before`) vs. mid-word (partial
-    // in flight → use the previous word from the line).
-    const endsInSpace = /\s$/.test(line);
-    const parent = endsInSpace
-        ? before
-        : (line.trim().split(/\s+/).slice(-2, -1)[0] ?? before);
-    reply(TREE[parent] ?? []);
-});
-// Quiet no-op when shell isn't asking for completion. The first thing
-// index.ts should do is call this — omelette will short-circuit and
-// process.exit if a completion request is in flight.
-export function initCompletion() {
-    completion.init();
+// ── Completion request handling ──────────────────────────────────────────────
+// Entry point for a shell-initiated completion request. index.ts calls this
+// (via a lazy import) whenever argv carries a --comp* marker. Always exits.
+export function handleCompletionRequest() {
+    const argv = process.argv;
+    // `myapi --completion[-fish]` — emit the shell init script (zsh/fish
+    // source it live; bash sources the copy written by installCompletion).
+    if (argv.includes('--completion')) {
+        process.stdout.write(shellScript());
+        process.exit(0);
+    }
+    if (argv.includes('--completion-fish')) {
+        process.stdout.write(fishScript());
+        process.exit(0);
+    }
+    // `myapi --comp{bash,zsh} --compgen <cword> <prev> <line...>`
+    const gen = argv.indexOf('--compgen');
+    if (gen < 0)
+        process.exit(0);
+    // zsh's cursor index is one higher than bash's for the same position.
+    const isZsh = argv.includes('--compzsh');
+    const cword = (parseInt(argv[gen + 1], 10) || 0) - (isZsh ? 1 : 0);
+    const line = argv.slice(gen + 3).join(' ');
+    const words = line.trim().split(/\s+/);
+    let candidates = [];
+    if (cword <= 1)
+        candidates = COMMANDS;
+    else if (cword === 2)
+        candidates = SUBCOMMANDS[words[1]] ?? [];
+    // Print the full list; the shell narrows it to the partial word.
+    process.stdout.write(candidates.join(os.EOL) + os.EOL);
+    process.exit(0);
+}
+// ── Shell init scripts ───────────────────────────────────────────────────────
+// bash + zsh completion function. The `if compdef / elif complete` guard
+// picks the right registration at source time, so one script serves both.
+function shellScript() {
+    return `### ${PROGRAM} completion ###
+if type compdef &>/dev/null; then
+  _${PROGRAM}_completion() {
+    compadd -- \`${PROGRAM} --compzsh --compgen "$CURRENT" "\${words[CURRENT-1]}" "$BUFFER"\`
+  }
+  compdef _${PROGRAM}_completion ${PROGRAM}
+elif type complete &>/dev/null; then
+  _${PROGRAM}_completion() {
+    local cur="\${COMP_WORDS[COMP_CWORD]}" prev="\${COMP_WORDS[COMP_CWORD-1]}"
+    COMPREPLY=( $(compgen -W '$(${PROGRAM} --compbash --compgen "$COMP_CWORD" "$prev" "$COMP_LINE")' -- "$cur") )
+  }
+  complete -F _${PROGRAM}_completion ${PROGRAM}
+fi
+`;
+}
+function fishScript() {
+    return `### ${PROGRAM} completion ###
+function _${PROGRAM}_completion
+  ${PROGRAM} --compfish --compgen (count (commandline -poc)) (commandline -pt) (commandline -pb)
+end
+complete -f -c ${PROGRAM} -a '(_${PROGRAM}_completion)'
+`;
+}
+// ── Install / uninstall ──────────────────────────────────────────────────────
+function activeShell() {
+    const s = process.env.SHELL ?? '';
+    if (s.includes('zsh'))
+        return 'zsh';
+    if (s.includes('fish'))
+        return 'fish';
+    if (s.includes('bash'))
+        return 'bash';
+    throw new Error(`Could not detect a supported shell (SHELL="${s}"). Supported: bash, zsh, fish.`);
+}
+function initFile(shell) {
+    const home = os.homedir();
+    if (shell === 'zsh')
+        return path.join(home, '.zshrc');
+    if (shell === 'fish')
+        return path.join(home, '.config', 'fish', 'config.fish');
+    return path.join(home, process.platform === 'darwin' ? '.bash_profile' : '.bashrc');
+}
+// The source line appended to the shell's rc file.
+function initBlock(shell) {
+    let cmd;
+    if (shell === 'bash')
+        cmd = `source "${path.join(COMPLETION_DIR, 'completion.sh')}"`;
+    else if (shell === 'zsh')
+        cmd = `. <(${PROGRAM} --completion)`;
+    else
+        cmd = `${PROGRAM} --completion-fish | source`;
+    return `\n${BLOCK_BEGIN}\n${cmd}\n${BLOCK_END}\n`;
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-// Wire/unwire the shell rc snippet. Omelette writes a single eval line
-// into ~/.bashrc / ~/.zshrc / ~/.config/fish/config.fish.
 export function installCompletion() {
-    completion.setupShellInitFile();
+    const shell = activeShell();
+    // bash can't reliably source a process substitution from .bashrc, so the
+    // script is written to a file the rc line sources.
+    if (shell === 'bash') {
+        fs.mkdirSync(COMPLETION_DIR, { recursive: true });
+        fs.writeFileSync(path.join(COMPLETION_DIR, 'completion.sh'), shellScript());
+    }
+    const file = initFile(shell);
+    const existing = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+    if (existing.includes(BLOCK_BEGIN))
+        return; // idempotent — already installed
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, initBlock(shell));
 }
 export function uninstallCompletion() {
-    completion.cleanupShellInitFile();
+    const shell = activeShell();
+    const file = initFile(shell);
+    if (fs.existsSync(file)) {
+        const cleaned = fs.readFileSync(file, 'utf8').replace(new RegExp(`\\n?${escapeRe(BLOCK_BEGIN)}[\\s\\S]*?${escapeRe(BLOCK_END)}\\n?`, 'g'), '');
+        fs.writeFileSync(file, cleaned);
+    }
+    if (shell === 'bash') {
+        const sh = path.join(COMPLETION_DIR, 'completion.sh');
+        if (fs.existsSync(sh))
+            fs.unlinkSync(sh);
+    }
 }

package/dist/exposes.test.js

@@ -39,6 +39,7 @@ const COMMAND_MODULES = [
     './commands/workflow.js',
     './commands/fn.js',
     './commands/payments.js',
+    './commands/container.js',
 ];
 const ENDPOINT_PATTERN = /^(GET|POST|PATCH|PUT|DELETE) \/[A-Za-z0-9_\-./{}]*$/;
 describe('every CLI command exports a typed EXPOSES array (S-101)', () => {

package/dist/index.js

@@ -31,7 +31,7 @@ import * as databaseCmd from './commands/database.js';
 import * as crmCmd from './commands/crm/index.js';
 import * as fnCmd from './commands/fn.js';
 import * as paymentsCmd from './commands/payments.js';
-import { initCompletion, installCompletion, uninstallCompletion } from './completion.js';
+import * as containerCmd from './commands/container.js';
 // Each command file declares the value flags it understands. We union them
 // into a single schema for the upfront parse, so adding a new value flag in
 // one command means editing one file (its SCHEMA), not a global allowlist.
@@ -59,6 +59,7 @@ const COMBINED_SCHEMA = {
     ...workflowCmd.SCHEMA,
     ...fnCmd.SCHEMA,
     ...paymentsCmd.SCHEMA,
+    ...containerCmd.SCHEMA,
     // Top-level flags
     version: 'boolean',
     V: 'boolean',
@@ -114,12 +115,20 @@ function friendlyError(err) {
     return base;
 }
 async function main() {
-    // Shell autocomplete: if invoked by the shell with completion env vars,
-    // omelette short-circuits before normal dispatch. Always cheap on a real run.
-    initCompletion();
+    // Shell tab-completion: when the shell invokes us for completion it passes
+    // a --comp* marker. Handle it via a lazily-imported module so completion
+    // code (and its file I/O) never loads on a normal command run.
+    if (process.argv.some(a => a === '--compgen' || a === '--completion' || a === '--completion-fish')) {
+        const { handleCompletionRequest } = await import('./completion.js');
+        handleCompletionRequest(); // computes candidates / emits the script, then exits
+        return;
+    }
     const { args, flags } = parseFlags(process.argv.slice(2), COMBINED_SCHEMA);
     if (flags.version || flags.v || flags.V) {
-        const latest = await updateCmd.latestVersion();
+        // Read the last-known published version from cache — no network call, so
+        // `myapi --version` stays instant. The cache is refreshed by the
+        // background update check on regular commands.
+        const latest = updateCmd.cachedLatestVersion();
         const updateNote = latest && updateCmd.isNewer(latest, pkg.version)
             ? ` (update available: ${latest})`
             : '';
@@ -207,6 +216,9 @@ async function main() {
             case 'payments':
                 await paymentsCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'container':
+                await containerCmd.run(subcommand, restArgs, flags);
+                break;
             // Convenience aliases
             case 'setup':
                 await setupCmd.setup(flags);
@@ -231,20 +243,20 @@ async function main() {
                 await setupCmd.installSkills();
                 success('› Skills installed.');
                 break;
-            case 'completion':
-                // Order matters: omelette's setup/cleanup helpers call process.exit()
-                // unconditionally, so anything we want to show has to print first.
+            case 'completion': {
+                const { installCompletion, uninstallCompletion } = await import('./completion.js');
                 if (subcommand === 'uninstall') {
-                    success('› Removing completion from shell init file…');
-                    info('  Restart your shell (or `source ~/.bashrc` / `~/.zshrc`) to take effect.');
                     uninstallCompletion();
+                    success('› Completion removed from your shell init file.');
+                    info('  Restart your shell (or re-source your rc file) for it to take effect.');
                 }
                 else {
-                    success('› Installing tab completion…');
-                    info('  Restart your shell (or `source ~/.bashrc` / `~/.zshrc`) to enable.');
                     installCompletion();
+                    success('› Tab completion installed.');
+                    info('  Restart your shell (or re-source your rc file) to enable it.');
                 }
                 break;
+            }
             case 'help':
                 await dispatchHelp(subcommand);
                 break;
@@ -329,6 +341,7 @@ const HELP_TARGETS = {
     crm: f => crmCmd.run(undefined, [], f),
     fn: f => fnCmd.run(undefined, [], f),
     payments: f => paymentsCmd.run(undefined, [], f),
+    container: f => containerCmd.run(undefined, [], f),
     org: f => orgCmd.run(undefined, [], f),
     billing: f => billingCmd.run(undefined, [], f),
     keys: f => keysCmd.run(undefined, [], f),
@@ -371,6 +384,7 @@ Commands:
   domain          Manage domain configurations
   funnel          Manage websites (publish pages, custom domains, funnels)
   fn              Create and deploy functions on the edge runtime
+  container       Run containers — services, workers, and scheduled jobs
   payments        Take payments with Stripe Checkout (connect, charge, refund)
   webhook         Manage inbound webhook endpoints and inspect deliveries
   email           Manage mailboxes, send/read email, templates, and campaigns

package/dist/sdk-billing-usage.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-billing-usage.test.js

@@ -0,0 +1,74 @@
+// SDK-level unit tests for hq.getBillingUsage — the spend-by-service
+// rollup backed by the backend's detailed metering
+// (GET /hq/billing/usage). Mocks global fetch — does NOT hit the network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { hq } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+let fetchMock;
+function ok(data, status = 200) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status = 400) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+const SAMPLE = {
+    period: 'month',
+    since: '2026-05-01T00:00:00Z',
+    services: [
+        { service: 'llm', requests: 1240, cost_display: '$3.10' },
+        { service: 'image', requests: 22, cost_display: '$0.44' },
+    ],
+    total_display: '$3.54',
+};
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('hq.getBillingUsage', () => {
+    it('GETs /hq/billing/usage with bearer auth and no query by default', async () => {
+        fetchMock.mockResolvedValueOnce(ok(SAMPLE));
+        const res = await hq.getBillingUsage(API_KEY);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toMatch(/\/hq\/billing\/usage$/);
+        expect(init.method).toBe('GET');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        expect(res.total_display).toBe('$3.54');
+        expect(res.services).toHaveLength(2);
+        expect(res.services[0]).toEqual({ service: 'llm', requests: 1240, cost_display: '$3.10' });
+    });
+    it('appends ?period=30d when the trailing-30-days window is requested', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ ...SAMPLE, period: '30d' }));
+        await hq.getBillingUsage(API_KEY, '30d');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/hq\/billing\/usage\?period=30d$/);
+    });
+    it('sends period=month explicitly when asked', async () => {
+        fetchMock.mockResolvedValueOnce(ok(SAMPLE));
+        await hq.getBillingUsage(API_KEY, 'month');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\?period=month$/);
+    });
+    it('returns an empty services list cleanly (no spend in the window)', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ period: 'month', since: '2026-05-01T00:00:00Z', services: [], total_display: '$0.00' }));
+        const res = await hq.getBillingUsage(API_KEY);
+        expect(res.services).toEqual([]);
+        expect(res.total_display).toBe('$0.00');
+    });
+    it('surfaces a bad period (400) as a typed MyApiError', async () => {
+        fetchMock.mockResolvedValueOnce(fail('bad_request', "period must be 'month' or '30d'", 400));
+        await expect(hq.getBillingUsage(API_KEY, 'month'))
+            .rejects.toMatchObject({ name: 'MyApiError', status: 400 });
+    });
+});
+describe('hq.EXPOSES', () => {
+    it('lists GET /hq/billing/usage', () => {
+        expect(hq.EXPOSES).toContain('GET /hq/billing/usage');
+    });
+});

package/dist/sdk-container.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-container.test.js

@@ -0,0 +1,115 @@
+// SDK-level unit tests for the container module. Verifies request
+// URL/body shape, response parsing, and error envelopes against
+// myapi-hq/internal/routes/container/. Mocks global fetch — no network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { container } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const C_ID = '55555555-5555-4555-8555-555555555555';
+let fetchMock;
+function ok(data, status = 200) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status = 422) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+const SAMPLE = {
+    id: C_ID, org_id: ORG_ID, name: 'api', type: 'service', env: {},
+    cpu: '1', memory: '512Mi', min_instances: 0, max_instances: 3, port: 8080,
+    status: 'created', created_at: 't', updated_at: 't',
+};
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('container.createContainer', () => {
+    it('POSTs the payload with bearer auth + JSON body', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ container: SAMPLE, scoped_api_key: 'hq_live_x', scoped_api_key_id: 'key_x' }, 201));
+        const res = await container.createContainer(API_KEY, ORG_ID, { name: 'api', type: 'service', port: 8080 });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/container/orgs/${ORG_ID}/containers`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        expect(JSON.parse(init.body)).toEqual({ name: 'api', type: 'service', port: 8080 });
+        expect(res.container.id).toBe(C_ID);
+        expect(res.scoped_api_key).toBe('hq_live_x');
+    });
+    it('surfaces INVALID_TYPE (422) and NAME_TAKEN (409)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_TYPE', 'cron_schedule is only valid for type=job', 422));
+        await expect(container.createContainer(API_KEY, ORG_ID, { name: 'x', type: 'service', cron_schedule: '* * * * *' }))
+            .rejects.toMatchObject({ code: 'INVALID_TYPE', status: 422 });
+        fetchMock.mockResolvedValueOnce(fail('NAME_TAKEN', 'already used', 409));
+        await expect(container.createContainer(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'NAME_TAKEN', status: 409 });
+    });
+});
+describe('container.listContainers / getContainer', () => {
+    it('GETs the container list', async () => {
+        fetchMock.mockResolvedValueOnce(ok([SAMPLE]));
+        const list = await container.listContainers(API_KEY, ORG_ID);
+        expect(list).toHaveLength(1);
+        expect(fetchMock.mock.calls[0][1].method).toBe('GET');
+    });
+    it('GETs a single container', async () => {
+        fetchMock.mockResolvedValueOnce(ok(SAMPLE));
+        const c = await container.getContainer(API_KEY, ORG_ID, C_ID);
+        expect(c.name).toBe('api');
+        expect(fetchMock.mock.calls[0][0]).toContain(`/container/orgs/${ORG_ID}/containers/${C_ID}`);
+    });
+    it('surfaces container_not_found (404)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('container_not_found', 'not found', 404));
+        await expect(container.getContainer(API_KEY, ORG_ID, C_ID))
+            .rejects.toMatchObject({ code: 'container_not_found', status: 404 });
+    });
+});
+describe('container.deleteContainer', () => {
+    it('DELETEs and resolves on 204', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        await container.deleteContainer(API_KEY, ORG_ID, C_ID);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/container/orgs/${ORG_ID}/containers/${C_ID}`);
+        expect(init.method).toBe('DELETE');
+    });
+});
+describe('container.deployContainer', () => {
+    it('POSTs {image} and returns the rotated key + url', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            container_id: C_ID, revision_id: 'rev_1', url: 'https://c.run.app', status: 'active', scoped_api_key: 'hq_live_rotated',
+        }));
+        const res = await container.deployContainer(API_KEY, ORG_ID, C_ID, 'registry/app:v2');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/container/orgs/${ORG_ID}/containers/${C_ID}/deploy`);
+        expect(init.method).toBe('POST');
+        expect(JSON.parse(init.body)).toEqual({ image: 'registry/app:v2' });
+        expect(res.scoped_api_key).toBe('hq_live_rotated');
+        expect(res.url).toBe('https://c.run.app');
+    });
+    it('surfaces RUNTIME_UNAVAILABLE (503) and IMAGE_REQUIRED (422)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('RUNTIME_UNAVAILABLE', 'Cloud Run not configured', 503));
+        await expect(container.deployContainer(API_KEY, ORG_ID, C_ID, 'img'))
+            .rejects.toMatchObject({ code: 'RUNTIME_UNAVAILABLE', status: 503 });
+        fetchMock.mockResolvedValueOnce(fail('IMAGE_REQUIRED', 'image ref required', 422));
+        await expect(container.deployContainer(API_KEY, ORG_ID, C_ID, ''))
+            .rejects.toMatchObject({ code: 'IMAGE_REQUIRED', status: 422 });
+    });
+});
+describe('container.EXPOSES', () => {
+    it('covers the 5 container endpoints', () => {
+        expect(container.EXPOSES).toEqual([
+            'POST /container/orgs/{org_id}/containers',
+            'GET /container/orgs/{org_id}/containers',
+            'GET /container/orgs/{org_id}/containers/{id}',
+            'DELETE /container/orgs/{org_id}/containers/{id}',
+            'POST /container/orgs/{org_id}/containers/{id}/deploy',
+        ]);
+    });
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -29,12 +29,10 @@
     "lint:changelog": "node ../../scripts/lint-changelog.js"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.2.6",
-    "omelette": "^0.4.17"
+    "@myapihq/sdk": "^1.2.7"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
-    "@types/omelette": "^0.4.5",
     "typescript": "^5.4.0",
     "vitest": "^4.1.5"
   }