@myapihq/cli 1.2.9 → 1.3.0

package/dist/commands/email/mailbox.js

@@ -4,6 +4,8 @@ import { success, error, printTable, info } from '../../output.js';
 export const EXPOSES = [
     'POST /email/mailboxes/create',
     'GET /email/mailboxes',
+    'PUT /email/mailboxes/{address}/forwarding',
+    'DELETE /email/mailboxes/{address}/forwarding',
     'POST /email/sending/activate',
 ];
 async function create(addressArg, flags) {
@@ -52,6 +54,22 @@ async function activateSending(flags) {
     const res = await sdkEmail.activateSending(config.api_key, address);
     success(`Sending activated: ${address} (${res.emails_quota_remaining} emails/day quota)`);
 }
+async function setForwarding(address, forwardTo, _flags) {
+    const config = requireConfig();
+    if (!address || !forwardTo) {
+        error('Missing required arguments.\nUsage: myapi email mailbox set-forwarding <user@domain> <forward-to@domain>');
+    }
+    const res = await sdkEmail.setForwarding(config.api_key, address, forwardTo);
+    success(`Forwarding set: ${res.address} → ${res.forward_to}`);
+    info('A copy of every incoming message is redirected; the original is kept in the mailbox.');
+}
+async function clearForwarding(address, _flags) {
+    const config = requireConfig();
+    if (!address)
+        error('Missing required arguments.\nUsage: myapi email mailbox clear-forwarding <user@domain>');
+    await sdkEmail.deleteForwarding(config.api_key, address);
+    success(`Forwarding cleared for ${address}`);
+}
 const USAGE = {
     'create': `myapi email mailbox create <user@domain> [--display-name <name>]
        myapi email mailbox create --username <u> --domain <d> [--display-name <name>]
@@ -65,6 +83,11 @@ matches the rest of the CLI ("first required arg is positional").`,
                         org (orphaned mailboxes — domain was unassigned
                         without first deleting them).`,
     'activate-sending': 'myapi email mailbox activate-sending --address <email>',
+    'set-forwarding': `myapi email mailbox set-forwarding <user@domain> <forward-to@domain>
+
+Redirects a copy of every incoming message to an external address
+(server-side). The original is kept in the mailbox.`,
+    'clear-forwarding': 'myapi email mailbox clear-forwarding <user@domain>',
 };
 export async function run(sub, args, flags) {
     if (!sub || (flags.help && !sub)) {
@@ -73,7 +96,9 @@ export async function run(sub, args, flags) {
 Subcommands:
   create             Create a mailbox (positional <user@domain> or --username/--domain)
   list               List mailboxes on a domain (--domain) or orphaned ones (--filter unassigned)
-  activate-sending   Activate outbound sending for a mailbox`);
+  activate-sending   Activate outbound sending for a mailbox
+  set-forwarding     Forward a copy of incoming mail to an external address
+  clear-forwarding   Stop forwarding for a mailbox`);
         return;
     }
     if (flags.help) {
@@ -88,6 +113,8 @@ Subcommands:
         case 'create': return create(args[0], flags);
         case 'list': return list(flags);
         case 'activate-sending': return activateSending(flags);
+        case 'set-forwarding': return setForwarding(args[0], args[1], flags);
+        case 'clear-forwarding': return clearForwarding(args[0], flags);
         default: error(`Unknown subcommand: ${sub}. Run "myapi email mailbox --help" for the list.`);
     }
 }

package/dist/commands/queue-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/queue-validation.test.js

@@ -0,0 +1,38 @@
+// Unit tests for the queue CLI's pure validators.
+import { describe, it, expect } from 'vitest';
+import { _validateConsumerUrl, _parseDependsOn } from './queue.js';
+describe('_validateConsumerUrl', () => {
+    it.each([
+        'https://example.com/consume',
+        'http://example.com/consume',
+        'https://fn.myapi.com/org/fn_123',
+        'https://example.com:8443/path?q=v',
+    ])('accepts %s', (url) => {
+        expect(_validateConsumerUrl(url)).toBeNull();
+    });
+    it.each([
+        ['ftp://example.com', /http:\/\/ or https:\/\//],
+        ['javascript:alert(1)', /http:\/\/ or https:\/\//],
+        ['file:///etc/passwd', /http:\/\/ or https:\/\//],
+    ])('rejects non-http(s) %s', (url, re) => {
+        expect(_validateConsumerUrl(url)).toMatch(re);
+    });
+    it.each(['not a url', 'just-text', 'http//missing-colon'])('rejects malformed %s', (url) => {
+        expect(_validateConsumerUrl(url)).toMatch(/not a valid URL/);
+    });
+});
+describe('_parseDependsOn', () => {
+    it('returns undefined for empty / non-string input', () => {
+        expect(_parseDependsOn(undefined)).toBeUndefined();
+        expect(_parseDependsOn('')).toBeUndefined();
+        expect(_parseDependsOn('   ')).toBeUndefined();
+        expect(_parseDependsOn(true)).toBeUndefined();
+    });
+    it('splits a comma-separated list and trims', () => {
+        expect(_parseDependsOn('j1,j2,j3')).toEqual(['j1', 'j2', 'j3']);
+        expect(_parseDependsOn(' j1 , j2 ')).toEqual(['j1', 'j2']);
+    });
+    it('drops empty segments', () => {
+        expect(_parseDependsOn('j1,,j2,')).toEqual(['j1', 'j2']);
+    });
+});

package/dist/commands/queue.d.ts

@@ -0,0 +1,14 @@
+import type { FlagSchema } from '../flags.js';
+import { type Flags } from '../helpers.js';
+import type { Exposes } from '../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare const SCHEMA: FlagSchema;
+export declare function _validateConsumerUrl(url: string): string | null;
+export declare function _parseDependsOn(raw: unknown): string[] | undefined;
+export declare function create(name: string, flags: Flags): Promise<void>;
+export declare function list(flags: Flags): Promise<void>;
+export declare function get(name: string, flags: Flags): Promise<void>;
+export declare function enqueue(name: string, flags: Flags): Promise<void>;
+export declare function jobs(name: string, flags: Flags): Promise<void>;
+export declare function job(jobId: string, flags: Flags): Promise<void>;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/queue.js

@@ -0,0 +1,215 @@
+import { queue as sdkQueue } from '@myapihq/sdk';
+import { requireConfig } from '../config.js';
+import { success, error, printTable, info, printJson } from '../output.js';
+import { formatDate } from '../utils.js';
+import { requireOrg, requireArg } from '../helpers.js';
+export const EXPOSES = [
+    'POST /queue/orgs/{org_id}/queues',
+    'GET /queue/orgs/{org_id}/queues',
+    'GET /queue/orgs/{org_id}/queues/{name}',
+    'POST /queue/orgs/{org_id}/queues/{name}/jobs',
+    'GET /queue/orgs/{org_id}/queues/{name}/jobs',
+    'GET /queue/orgs/{org_id}/jobs/{id}',
+];
+export const SCHEMA = {
+    name: 'string',
+    'consumer-url': 'string',
+    'max-attempts': 'number',
+    'max-concurrency': 'number',
+    payload: 'string',
+    'dedup-key': 'string',
+    delay: 'number',
+    'depends-on': 'string',
+    status: 'string',
+    limit: 'number',
+};
+// Pure validator — returns an error message or null. Mirrors
+// webhook.ts's _validateForwardUrl so it's unit-testable.
+export function _validateConsumerUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return `consumer URL "${url}" is not a valid URL.`;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return `consumer URL must use http:// or https:// — got "${url}".`;
+    }
+    return null;
+}
+// Parses a comma-separated --depends-on flag into a clean id array.
+export function _parseDependsOn(raw) {
+    if (typeof raw !== 'string' || raw.trim() === '')
+        return undefined;
+    return raw.split(',').map(s => s.trim()).filter(Boolean);
+}
+// ── Queues ───────────────────────────────────────────────────────────────────
+export async function create(name, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi queue create <name> --consumer-url <url> [--org <id>]');
+    const queueName = name || flags.name;
+    requireArg(queueName, 'name', 'myapi queue create <name> --consumer-url <url>');
+    const consumerUrl = flags['consumer-url'];
+    if (typeof consumerUrl !== 'string' || consumerUrl === '') {
+        error('Missing --consumer-url.\nUsage: myapi queue create <name> --consumer-url <url> [--max-attempts <n>] [--max-concurrency <n>]');
+    }
+    const urlErr = _validateConsumerUrl(consumerUrl);
+    if (urlErr)
+        error(urlErr);
+    const q = await sdkQueue.createQueue(config.api_key, orgId, {
+        name: queueName,
+        consumerUrl,
+        maxAttempts: typeof flags['max-attempts'] === 'number' ? flags['max-attempts'] : undefined,
+        maxConcurrency: typeof flags['max-concurrency'] === 'number' ? flags['max-concurrency'] : undefined,
+    });
+    if (flags.json) {
+        printJson(q);
+        return;
+    }
+    success(`Queue created: ${q.name}`);
+    info(`Consumer:        ${q.consumer_url}`);
+    info(`Max attempts:    ${q.max_attempts}`);
+    info(`Max concurrency: ${q.max_concurrency}`);
+}
+export async function list(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi queue list [--org <id>]');
+    const queues = await sdkQueue.listQueues(config.api_key, orgId);
+    if (flags.json) {
+        printJson(queues);
+        return;
+    }
+    printTable(queues.map(q => ({ name: q.name })), {
+        flags,
+        empty: 'No queues yet. Create one with: myapi queue create <name> --consumer-url <url>',
+    });
+}
+export async function get(name, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi queue get <name> [--org <id>]');
+    requireArg(name, 'name', 'myapi queue get <name>');
+    const q = await sdkQueue.getQueue(config.api_key, orgId, name);
+    if (flags.json) {
+        printJson(q);
+        return;
+    }
+    info(`Name:            ${q.name}`);
+    info(`Consumer:        ${q.consumer_url}`);
+    info(`Max attempts:    ${q.max_attempts}`);
+    info(`Max concurrency: ${q.max_concurrency}`);
+}
+// ── Jobs ─────────────────────────────────────────────────────────────────────
+export async function enqueue(name, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi queue enqueue <name> --payload <json> [--org <id>]');
+    requireArg(name, 'name', 'myapi queue enqueue <name> --payload <json>');
+    let payload;
+    if (typeof flags.payload === 'string') {
+        try {
+            payload = JSON.parse(flags.payload);
+        }
+        catch (e) {
+            error(`--payload is not valid JSON: ${e?.message ?? e}`);
+        }
+    }
+    else if (flags.payload === true) {
+        error('--payload needs a JSON value, e.g. --payload \'{"order_id":42}\'');
+    }
+    const job = await sdkQueue.enqueueJob(config.api_key, orgId, name, {
+        payload,
+        dedupKey: typeof flags['dedup-key'] === 'string' ? flags['dedup-key'] : undefined,
+        delaySeconds: typeof flags.delay === 'number' ? flags.delay : undefined,
+        dependsOn: _parseDependsOn(flags['depends-on']),
+    });
+    if (flags.json) {
+        printJson(job);
+        return;
+    }
+    success(`Job enqueued: ${job.id}`);
+    info(`Status: ${job.status}`);
+}
+export async function jobs(name, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi queue jobs <name> [--status <s>] [--limit <n>] [--org <id>]');
+    requireArg(name, 'name', 'myapi queue jobs <name>');
+    const list = await sdkQueue.listJobs(config.api_key, orgId, name, {
+        status: typeof flags.status === 'string' ? flags.status : undefined,
+        limit: typeof flags.limit === 'number' ? flags.limit : undefined,
+    });
+    if (flags.json) {
+        printJson(list);
+        return;
+    }
+    printTable(list.map(j => ({
+        id: j.id,
+        status: j.status,
+        attempt: j.attempt,
+        created: j.created_at ? formatDate(j.created_at) : '',
+    })), { flags, empty: 'No jobs in this queue.' });
+}
+export async function job(jobId, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi queue job <job_id> [--org <id>]');
+    requireArg(jobId, 'job_id', 'myapi queue job <job_id>');
+    const j = await sdkQueue.getJob(config.api_key, orgId, jobId);
+    if (flags.json) {
+        printJson(j);
+        return;
+    }
+    info(`Job:      ${j.id}`);
+    info(`Queue:    ${j.queue_id}`);
+    info(`Status:   ${j.status}`);
+    info(`Attempt:  ${j.attempt} / ${j.max_attempts}`);
+    if (j.last_error)
+        info(`Error:    ${j.last_error}`);
+}
+// ── Dispatcher ───────────────────────────────────────────────────────────────
+const SUBCOMMAND_USAGE = {
+    'create': 'myapi queue create <name> --consumer-url <url> [--max-attempts <n>] [--max-concurrency <n>] [--org <id>]',
+    'list': 'myapi queue list [--org <id>] [--json]',
+    'get': 'myapi queue get <name> [--org <id>] [--json]',
+    'enqueue': 'myapi queue enqueue <name> --payload <json> [--dedup-key <k>] [--delay <seconds>] [--depends-on <id,id>] [--org <id>]',
+    'jobs': 'myapi queue jobs <name> [--status <s>] [--limit <n>] [--org <id>] [--json]',
+    'job': 'myapi queue job <job_id> [--org <id>] [--json]',
+};
+export async function run(subcommand, args, flags) {
+    if (!subcommand || (flags.help && !subcommand)) {
+        info(`Usage: myapi queue <subcommand>
+
+A durable HTTP-consumer job queue — jobs are POSTed to the queue's
+consumer_url with retry/backoff, a concurrency cap, and a dependency DAG.
+
+Queues:
+  create <name>     Create a queue (--consumer-url, --max-attempts, --max-concurrency)
+  list              List queues
+  get <name>        Show a queue's policy
+
+Jobs:
+  enqueue <name>    Enqueue a job (--payload, --dedup-key, --delay, --depends-on)
+  jobs <name>       List a queue's jobs (--status, --limit)
+  job <job_id>      Show a single job's status
+
+For "needs a decision" work (agent/human), see: myapi task --help
+
+All commands accept --org <id> (or set default: myapi config set-org <id>).`);
+        return;
+    }
+    if (flags.help) {
+        const usage = SUBCOMMAND_USAGE[subcommand];
+        if (usage)
+            info(`Usage: ${usage}`);
+        else
+            info(`Unknown subcommand: ${subcommand}. Run "myapi queue --help" for the list.`);
+        return;
+    }
+    switch (subcommand) {
+        case 'create': return create(args[0], flags);
+        case 'list': return list(flags);
+        case 'get': return get(args[0], flags);
+        case 'enqueue': return enqueue(args[0], flags);
+        case 'jobs': return jobs(args[0], flags);
+        case 'job': return job(args[0], flags);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi queue --help" for a list of valid subcommands.`);
+    }
+}

package/dist/commands/task-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/task-validation.test.js

@@ -0,0 +1,37 @@
+// Unit tests for the task CLI's pure parsers.
+import { describe, it, expect } from 'vitest';
+import { _parseResolveOn, _splitList } from './task.js';
+describe('_parseResolveOn', () => {
+    it('parses a bare event type', () => {
+        expect(_parseResolveOn('payment.succeeded')).toEqual({ event_type: 'payment.succeeded' });
+    });
+    it('parses event_type:field=value', () => {
+        expect(_parseResolveOn('payment.succeeded:order_id=o_42')).toEqual({
+            event_type: 'payment.succeeded', field: 'order_id', value: 'o_42',
+        });
+    });
+    it('keeps = signs inside the value', () => {
+        expect(_parseResolveOn('evt:token=a=b=c')).toEqual({
+            event_type: 'evt', field: 'token', value: 'a=b=c',
+        });
+    });
+    it('rejects an empty string', () => {
+        expect(_parseResolveOn('   ')).toMatch(/cannot be empty/);
+    });
+    it('rejects a leading colon (no event type)', () => {
+        expect(_parseResolveOn(':field=value')).toMatch(/must start with an event type/);
+    });
+    it('rejects a field match without =', () => {
+        expect(_parseResolveOn('evt:justfield')).toMatch(/field=value/);
+    });
+});
+describe('_splitList', () => {
+    it('returns undefined for empty / non-string input', () => {
+        expect(_splitList(undefined)).toBeUndefined();
+        expect(_splitList('')).toBeUndefined();
+        expect(_splitList(true)).toBeUndefined();
+    });
+    it('splits and trims, dropping empties', () => {
+        expect(_splitList('support, sales ,, billing')).toEqual(['support', 'sales', 'billing']);
+    });
+});

package/dist/commands/task.d.ts

@@ -0,0 +1,18 @@
+import { task as sdkTask } from '@myapihq/sdk';
+import type { FlagSchema } from '../flags.js';
+import { type Flags } from '../helpers.js';
+import type { Exposes } from '../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare const SCHEMA: FlagSchema;
+export declare const TASK_IMPORTANCE: readonly ["low", "normal", "high", "critical"];
+export declare function _parseResolveOn(raw: string): sdkTask.ResolveOn | string;
+export declare function _splitList(raw: unknown): string[] | undefined;
+export declare function create(description: string, flags: Flags): Promise<void>;
+export declare function list(flags: Flags): Promise<void>;
+export declare function get(id: string, flags: Flags): Promise<void>;
+export declare function claim(id: string, flags: Flags): Promise<void>;
+export declare function extend(id: string, flags: Flags): Promise<void>;
+export declare function resolve(id: string, flags: Flags): Promise<void>;
+export declare function fail(id: string, flags: Flags): Promise<void>;
+export declare function cancel(id: string, flags: Flags): Promise<void>;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/task.js

@@ -0,0 +1,288 @@
+import { task as sdkTask } from '@myapihq/sdk';
+import { requireConfig } from '../config.js';
+import { success, error, printTable, info, printJson } from '../output.js';
+import { formatDate } from '../utils.js';
+import { requireOrg, requireArg } from '../helpers.js';
+import * as fs from 'fs';
+export const EXPOSES = [
+    'POST /task/orgs/{org_id}/tasks',
+    'GET /task/orgs/{org_id}/tasks',
+    'GET /task/orgs/{org_id}/tasks/{id}',
+    'DELETE /task/orgs/{org_id}/tasks/{id}',
+    'GET /task/orgs/{org_id}/tasks/{id}/body',
+    'POST /task/orgs/{org_id}/tasks/{id}/claim',
+    'POST /task/orgs/{org_id}/tasks/{id}/extend',
+    'POST /task/orgs/{org_id}/tasks/{id}/fail',
+    'POST /task/orgs/{org_id}/tasks/{id}/resolve',
+];
+export const SCHEMA = {
+    body: 'string',
+    importance: 'string',
+    due: 'string',
+    assignee: 'string',
+    tag: 'string',
+    'depends-on': 'string',
+    'dedup-key': 'string',
+    'resolve-on': 'string',
+    source: 'string',
+    status: 'string',
+    limit: 'number',
+    lease: 'number',
+    worker: 'string',
+    reason: 'string',
+};
+// The backend's fixed importance enum — validated client-side so a typo
+// fails before the network call.
+export const TASK_IMPORTANCE = ['low', 'normal', 'high', 'critical'];
+// Parses --resolve-on "<event_type>[:<field>=<value>]" into a matcher.
+// Returns the parsed object, or a string error message.
+export function _parseResolveOn(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === '')
+        return '--resolve-on cannot be empty.';
+    const colon = trimmed.indexOf(':');
+    if (colon === -1)
+        return { event_type: trimmed };
+    const eventType = trimmed.slice(0, colon);
+    const rest = trimmed.slice(colon + 1);
+    if (eventType === '')
+        return '--resolve-on must start with an event type, e.g. payment.succeeded:amount=100';
+    const eq = rest.indexOf('=');
+    if (eq === -1) {
+        return `--resolve-on field match must look like field=value — got "${rest}".`;
+    }
+    return { event_type: eventType, field: rest.slice(0, eq), value: rest.slice(eq + 1) };
+}
+// Parses a comma-separated --tag / --depends-on flag into a clean array.
+export function _splitList(raw) {
+    if (typeof raw !== 'string' || raw.trim() === '')
+        return undefined;
+    return raw.split(',').map(s => s.trim()).filter(Boolean);
+}
+// --body accepts inline text or @path to read a Markdown file.
+function resolveBody(raw) {
+    if (raw.startsWith('@')) {
+        const path = raw.slice(1);
+        try {
+            return fs.readFileSync(path, 'utf-8');
+        }
+        catch (e) {
+            error(`Could not read --body file "${path}": ${e?.message ?? e}`);
+        }
+    }
+    return raw;
+}
+// ── Create / list ────────────────────────────────────────────────────────────
+export async function create(description, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi task create "<description>" [--org <id>]');
+    requireArg(description, 'description', 'myapi task create "<description>"');
+    let resolveOn;
+    if (typeof flags['resolve-on'] === 'string') {
+        const parsed = _parseResolveOn(flags['resolve-on']);
+        if (typeof parsed === 'string')
+            error(parsed);
+        resolveOn = parsed;
+    }
+    let body;
+    if (typeof flags.body === 'string')
+        body = resolveBody(flags.body);
+    else if (flags.body === true)
+        error('--body needs a value: inline Markdown or @path-to-file.');
+    let importance;
+    if (typeof flags.importance === 'string') {
+        if (!TASK_IMPORTANCE.includes(flags.importance)) {
+            error(`Invalid --importance "${flags.importance}". Must be one of: ${TASK_IMPORTANCE.join(', ')}.`);
+        }
+        importance = flags.importance;
+    }
+    const t = await sdkTask.createTask(config.api_key, orgId, {
+        description,
+        body,
+        importance,
+        dueAt: typeof flags.due === 'string' ? flags.due : undefined,
+        assignee: typeof flags.assignee === 'string' ? flags.assignee : undefined,
+        tags: _splitList(flags.tag),
+        dependsOn: _splitList(flags['depends-on']),
+        dedupKey: typeof flags['dedup-key'] === 'string' ? flags['dedup-key'] : undefined,
+        resolveOn,
+        source: typeof flags.source === 'string' ? flags.source : undefined,
+    });
+    if (flags.json) {
+        printJson(t);
+        return;
+    }
+    success(`Task created: ${t.id}`);
+    info(`Status: ${t.status}`);
+    if (t.assignee)
+        info(`Assignee: ${t.assignee} (magic link emailed)`);
+}
+export async function list(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi task list [--org <id>]');
+    const res = await sdkTask.listTasks(config.api_key, orgId, {
+        status: typeof flags.status === 'string' ? flags.status : undefined,
+        tag: typeof flags.tag === 'string' ? flags.tag : undefined,
+        importance: typeof flags.importance === 'string' ? flags.importance : undefined,
+        assignee: typeof flags.assignee === 'string' ? flags.assignee : undefined,
+        source: typeof flags.source === 'string' ? flags.source : undefined,
+        limit: typeof flags.limit === 'number' ? flags.limit : undefined,
+    });
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    printTable(res.tasks.map(t => ({
+        id: t.id,
+        score: t.score,
+        description: t.description,
+    })), { flags, empty: 'No open tasks.' });
+    info('');
+    info(`Showing ${res.meta.shown} of ${res.meta.total_open} open task(s).`);
+}
+// ── Read ─────────────────────────────────────────────────────────────────────
+export async function get(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi task get <id> [--body] [--org <id>]');
+    requireArg(id, 'id', 'myapi task get <id>');
+    const t = await sdkTask.getTask(config.api_key, orgId, id);
+    // --body opts in to the separate body tier — never fetched implicitly.
+    const wantBody = flags.body === true || typeof flags.body === 'string';
+    const body = wantBody ? await sdkTask.getTaskBody(config.api_key, orgId, id) : undefined;
+    if (flags.json) {
+        printJson(wantBody ? { ...t, body } : t);
+        return;
+    }
+    info(`Task:        ${t.id}`);
+    info(`Status:      ${t.status}`);
+    info(`Description: ${t.description}`);
+    if (t.importance)
+        info(`Importance:  ${t.importance}`);
+    if (t.due_at)
+        info(`Due:         ${formatDate(t.due_at)}`);
+    if (t.assignee)
+        info(`Assignee:    ${t.assignee}`);
+    if (t.tags?.length)
+        info(`Tags:        ${t.tags.join(', ')}`);
+    if (t.depends_on?.length)
+        info(`Depends on:  ${t.depends_on.join(', ')}`);
+    if (t.claimed_by)
+        info(`Claimed by:  ${t.claimed_by}`);
+    if (t.lease_expires_at)
+        info(`Lease until: ${formatDate(t.lease_expires_at)}`);
+    if (wantBody) {
+        info('');
+        info('── body ──');
+        info(body ?? '');
+    }
+}
+// ── Lifecycle ────────────────────────────────────────────────────────────────
+export async function claim(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi task claim <id> [--lease <seconds>] [--worker <name>] [--org <id>]');
+    requireArg(id, 'id', 'myapi task claim <id>');
+    const t = await sdkTask.claimTask(config.api_key, orgId, id, {
+        leaseSeconds: typeof flags.lease === 'number' ? flags.lease : undefined,
+        worker: typeof flags.worker === 'string' ? flags.worker : undefined,
+    });
+    if (flags.json) {
+        printJson(t);
+        return;
+    }
+    success(`Claimed task ${t.id}`);
+    if (t.lease_expires_at)
+        info(`Lease expires: ${formatDate(t.lease_expires_at)} — heartbeat with: myapi task extend ${t.id}`);
+}
+export async function extend(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi task extend <id> [--lease <seconds>] [--org <id>]');
+    requireArg(id, 'id', 'myapi task extend <id>');
+    const t = await sdkTask.extendTask(config.api_key, orgId, id, {
+        leaseSeconds: typeof flags.lease === 'number' ? flags.lease : undefined,
+    });
+    if (flags.json) {
+        printJson(t);
+        return;
+    }
+    success(`Extended lease on task ${t.id}`);
+    if (t.lease_expires_at)
+        info(`Lease expires: ${formatDate(t.lease_expires_at)}`);
+}
+export async function resolve(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi task resolve <id> [--org <id>]');
+    requireArg(id, 'id', 'myapi task resolve <id>');
+    await sdkTask.resolveTask(config.api_key, orgId, id);
+    success(`Resolved task ${id}`);
+}
+export async function fail(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi task fail <id> --reason "<why>" [--org <id>]');
+    requireArg(id, 'id', 'myapi task fail <id> --reason "<why>"');
+    const reason = flags.reason;
+    if (typeof reason !== 'string' || reason.trim() === '') {
+        error('Missing --reason.\nUsage: myapi task fail <id> --reason "<why>"');
+    }
+    await sdkTask.failTask(config.api_key, orgId, id, reason);
+    success(`Failed task ${id}`);
+}
+export async function cancel(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi task cancel <id> [--org <id>]');
+    requireArg(id, 'id', 'myapi task cancel <id>');
+    await sdkTask.cancelTask(config.api_key, orgId, id);
+    success(`Cancelled task ${id}`);
+}
+// ── Dispatcher ───────────────────────────────────────────────────────────────
+const SUBCOMMAND_USAGE = {
+    'create': 'myapi task create "<description>" [--body <md|@file>] [--importance <i>] [--due <rfc3339>] [--assignee <email>] [--tag <t,t>] [--depends-on <id,id>] [--dedup-key <k>] [--resolve-on <event[:field=value]>] [--source <s>] [--org <id>]',
+    'list': 'myapi task list [--status <s>] [--tag <t>] [--importance <i>] [--assignee <email>] [--source <s>] [--limit <n>] [--org <id>] [--json]',
+    'get': 'myapi task get <id> [--body] [--org <id>] [--json]\n\n--body additionally fetches the Markdown body tier (a separate read).',
+    'claim': 'myapi task claim <id> [--lease <seconds>] [--worker <name>] [--org <id>]',
+    'extend': 'myapi task extend <id> [--lease <seconds>] [--org <id>]',
+    'resolve': 'myapi task resolve <id> [--org <id>]',
+    'fail': 'myapi task fail <id> --reason "<why>" [--org <id>]',
+    'cancel': 'myapi task cancel <id> [--org <id>]',
+};
+export async function run(subcommand, args, flags) {
+    if (!subcommand || (flags.help && !subcommand)) {
+        info(`Usage: myapi task <subcommand>
+
+An agent-task queue — the agent-loop hot path. Tasks are ranked by score,
+claimed under a lease, then resolved, failed, or cancelled.
+
+  create "<description>"  File a task (--body, --importance, --assignee, --resolve-on, ...)
+  list                    Top open tasks, ranked (--status, --tag, --limit)
+  get <id>                Show a task; --body also fetches the Markdown body tier
+  claim <id>              Take an atomic lease (default 10 min)
+  extend <id>             Heartbeat a live claim
+  resolve <id>            Resolve a task (terminal) — unblocks dependents
+  fail <id>               Fail a task (terminal) — requires --reason
+  cancel <id>             Cancel a task (terminal, distinct from fail)
+
+The agent loop is: list → get <id> --body → claim → resolve.
+For durable machine work (retried HTTP jobs), see: myapi queue --help
+
+All commands accept --org <id> (or set default: myapi config set-org <id>).`);
+        return;
+    }
+    if (flags.help) {
+        const usage = SUBCOMMAND_USAGE[subcommand];
+        if (usage)
+            info(`Usage: ${usage}`);
+        else
+            info(`Unknown subcommand: ${subcommand}. Run "myapi task --help" for the list.`);
+        return;
+    }
+    switch (subcommand) {
+        case 'create': return create(args[0], flags);
+        case 'list': return list(flags);
+        case 'get': return get(args[0], flags);
+        case 'claim': return claim(args[0], flags);
+        case 'extend': return extend(args[0], flags);
+        case 'resolve': return resolve(args[0], flags);
+        case 'fail': return fail(args[0], flags);
+        case 'cancel': return cancel(args[0], flags);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi task --help" for a list of valid subcommands.`);
+    }
+}

package/dist/commands/workflow-validation.test.js

@@ -120,6 +120,33 @@ describe('_validateSteps — http_request / http (2026-05-15)', () => {
             .toMatch(/"headers" value for "X-Token" must be a string/);
     });
 });
+describe('_validateSteps — enqueue_job / enqueue (2026-05-19)', () => {
+    const VALID_ENQUEUE = { type: 'enqueue_job', queue: 'thumbnails' };
+    it('accepts the canonical type name', () => {
+        expect(_validateSteps([VALID_ENQUEUE])).toBeNull();
+    });
+    it('accepts the `enqueue` alias', () => {
+        expect(_validateSteps([{ ...VALID_ENQUEUE, type: 'enqueue' }])).toBeNull();
+    });
+    it('accepts a string payload with templating', () => {
+        expect(_validateSteps([{ ...VALID_ENQUEUE, payload: '{"email":"{{ payload.email }}"}' }])).toBeNull();
+    });
+    it('accepts dedup_key and delay_seconds', () => {
+        expect(_validateSteps([{ ...VALID_ENQUEUE, dedup_key: 'k1', delay_seconds: 30 }])).toBeNull();
+    });
+    it('rejects when queue is missing', () => {
+        expect(_validateSteps([{ type: 'enqueue_job' }]))
+            .toMatch(/missing required field "queue"/);
+    });
+    it('rejects a non-string payload', () => {
+        expect(_validateSteps([{ ...VALID_ENQUEUE, payload: { not: 'a string' } }]))
+            .toMatch(/"payload" must be a string/);
+    });
+    it('rejects a non-number delay_seconds', () => {
+        expect(_validateSteps([{ ...VALID_ENQUEUE, delay_seconds: '30' }]))
+            .toMatch(/"delay_seconds" must be a number/);
+    });
+});
 describe('_validateSteps — mixed-type pipelines', () => {
     it('accepts an http_request after a send_email (pipeline shape)', () => {
         expect(_validateSteps([

package/dist/commands/workflow.js

@@ -26,7 +26,9 @@ export const SCHEMA = {
 //
 // 2026-05-15: backend added `http_request` (alias `http`). See
 // myapi-hq/internal/routes/workflow/execute.go.
-const SUPPORTED_STEP_TYPES = ['send_email', 'email', 'slack_message', 'slack', 'http_request', 'http'];
+// 2026-05-19: `enqueue_job` (alias `enqueue`) added — hands durable work to
+// my-queue-api. Backend step pending; see the orchestration cross-repo prompt.
+const SUPPORTED_STEP_TYPES = ['send_email', 'email', 'slack_message', 'slack', 'http_request', 'http', 'enqueue_job', 'enqueue'];
 const HTTP_METHODS = new Set(['GET', 'POST', 'PATCH', 'PUT', 'DELETE']);
 const SLACK_HOOK_RE = /^https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+/;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -110,6 +112,20 @@ export function _validateSteps(steps) {
                 }
             }
         }
+        if (s.type === 'enqueue_job' || s.type === 'enqueue') {
+            if (!s.queue || typeof s.queue !== 'string') {
+                return `${where} (${s.type}): missing required field "queue" (the target queue name).`;
+            }
+            if (s.payload !== undefined && typeof s.payload !== 'string') {
+                return `${where} (${s.type}): "payload" must be a string (template substitutions supported).`;
+            }
+            if (s.dedup_key !== undefined && typeof s.dedup_key !== 'string') {
+                return `${where} (${s.type}): "dedup_key" must be a string.`;
+            }
+            if (s.delay_seconds !== undefined && typeof s.delay_seconds !== 'number') {
+                return `${where} (${s.type}): "delay_seconds" must be a number.`;
+            }
+        }
     }
     return null;
 }

package/dist/completion.js

@@ -28,8 +28,8 @@ const BLOCK_END = `# end ${PROGRAM} completion`;
 export const COMMANDS = [
     'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
     'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image',
-    'install-skills', 'keys', 'llm', 'org', 'payments', 'people', 'pixel',
-    'setup', 'status', 'storage', 'update', 'url', 'webhook', 'whoami',
+    'install-skills', 'keys', 'llm', 'org', 'payments', 'people', 'pixel', 'queue',
+    'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
     'workflow',
 ];
 // command → subcommands, for `myapi <command> <TAB>`. Mirrors each
@@ -59,6 +59,8 @@ export const SUBCOMMANDS = {
     payments: ['connect', 'status', 'charge', 'list', 'get', 'refund'],
     container: ['create', 'deploy', 'list', 'get', 'logs', 'delete'],
     git: ['create', 'list', 'get', 'delete', 'refs', 'log', 'show', 'tree', 'blob', 'diff', 'commit', 'create-branch', 'delete-branch', 'tag', 'merge', 'repack'],
+    queue: ['create', 'list', 'get', 'enqueue', 'jobs', 'job'],
+    task: ['create', 'list', 'get', 'claim', 'extend', 'resolve', 'fail', 'cancel'],
     completion: ['install', 'uninstall'],
 };
 // ── Completion request handling ──────────────────────────────────────────────

package/dist/exposes.test.js

@@ -41,6 +41,8 @@ const COMMAND_MODULES = [
     './commands/payments.js',
     './commands/container.js',
     './commands/git.js',
+    './commands/queue.js',
+    './commands/task.js',
 ];
 const ENDPOINT_PATTERN = /^(GET|POST|PATCH|PUT|DELETE) \/[A-Za-z0-9_\-./{}]*$/;
 describe('every CLI command exports a typed EXPOSES array (S-101)', () => {

package/dist/index.js

@@ -33,6 +33,8 @@ import * as fnCmd from './commands/fn.js';
 import * as paymentsCmd from './commands/payments.js';
 import * as containerCmd from './commands/container.js';
 import * as gitCmd from './commands/git.js';
+import * as queueCmd from './commands/queue.js';
+import * as taskCmd from './commands/task.js';
 // Each command file declares the value flags it understands. We union them
 // into a single schema for the upfront parse, so adding a new value flag in
 // one command means editing one file (its SCHEMA), not a global allowlist.
@@ -62,6 +64,8 @@ const COMBINED_SCHEMA = {
     ...paymentsCmd.SCHEMA,
     ...containerCmd.SCHEMA,
     ...gitCmd.SCHEMA,
+    ...queueCmd.SCHEMA,
+    ...taskCmd.SCHEMA,
     // Top-level flags
     version: 'boolean',
     V: 'boolean',
@@ -224,6 +228,12 @@ async function main() {
             case 'git':
                 await gitCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'queue':
+                await queueCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'task':
+                await taskCmd.run(subcommand, restArgs, flags);
+                break;
             // Convenience aliases
             case 'setup':
                 await setupCmd.setup(flags);
@@ -348,6 +358,8 @@ const HELP_TARGETS = {
     payments: f => paymentsCmd.run(undefined, [], f),
     container: f => containerCmd.run(undefined, [], f),
     git: f => gitCmd.run(undefined, [], f),
+    queue: f => queueCmd.run(undefined, [], f),
+    task: f => taskCmd.run(undefined, [], f),
     org: f => orgCmd.run(undefined, [], f),
     billing: f => billingCmd.run(undefined, [], f),
     keys: f => keysCmd.run(undefined, [], f),
@@ -392,6 +404,8 @@ Commands:
   fn              Create and deploy functions on the edge runtime
   container       Run containers — services, workers, and scheduled jobs
   git             Hosted git repositories — repos, commits, branches, history
+  queue           Durable job queue — enqueue work, retried against an HTTP consumer
+  task            Agent-task queue — file, claim, and resolve units of work
   payments        Take payments with Stripe Checkout (connect, charge, refund)
   webhook         Manage inbound webhook endpoints and inspect deliveries
   email           Manage mailboxes, send/read email, templates, and campaigns

package/dist/sdk-email-forwarding.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-email-forwarding.test.js

@@ -0,0 +1,48 @@
+// SDK-level unit tests for mailbox forwarding —
+// email.setForwarding + email.deleteForwarding. Mocks fetch — no network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { email } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+let fetchMock;
+function ok(data, status = 200) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, status) {
+    return new Response(JSON.stringify({ success: false, error: { code, message: code }, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => { fetchMock = vi.fn(); globalThis.fetch = fetchMock; });
+afterEach(() => { vi.restoreAllMocks(); });
+describe('email.setForwarding', () => {
+    it('PUTs {forward_to} to the mailbox forwarding endpoint', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ address: 'a@x.com', forward_to: 'b@y.com' }));
+        const res = await email.setForwarding(API_KEY, 'a@x.com', 'b@y.com');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain('/email/mailboxes/a%40x.com/forwarding');
+        expect(init.method).toBe('PUT');
+        expect(JSON.parse(init.body)).toEqual({ forward_to: 'b@y.com' });
+        expect(res.forward_to).toBe('b@y.com');
+    });
+    it('surfaces FORWARD_LOOP (400)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('FORWARD_LOOP', 400));
+        await expect(email.setForwarding(API_KEY, 'a@x.com', 'a@x.com'))
+            .rejects.toMatchObject({ code: 'FORWARD_LOOP', status: 400 });
+    });
+});
+describe('email.deleteForwarding', () => {
+    it('DELETEs the forwarding endpoint and resolves on 204', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        await email.deleteForwarding(API_KEY, 'a@x.com');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain('/email/mailboxes/a%40x.com/forwarding');
+        expect(init.method).toBe('DELETE');
+    });
+    it('surfaces MAILBOX_NOT_OWNED (403)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('MAILBOX_NOT_OWNED', 403));
+        await expect(email.deleteForwarding(API_KEY, 'a@x.com'))
+            .rejects.toMatchObject({ code: 'MAILBOX_NOT_OWNED', status: 403 });
+    });
+});

package/dist/sdk-queue.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-queue.test.js

@@ -0,0 +1,86 @@
+// SDK-level unit tests for the queue module. Verifies URL/body shape,
+// envelope-unwrapping, query params, and error handling against
+// myapi-hq/internal/routes/queue/. Mocks global fetch — no network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { queue } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG = '11111111-1111-4111-8111-111111111111';
+let fetchMock;
+function ok(data, status = 200) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, status) {
+    return new Response(JSON.stringify({ success: false, error: { code, message: code }, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => { fetchMock = vi.fn(); globalThis.fetch = fetchMock; });
+afterEach(() => { vi.restoreAllMocks(); });
+describe('queue queues', () => {
+    it('createQueue POSTs {name, consumer_url} and optional policy fields', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ name: 'q', consumer_url: 'https://c', max_attempts: 5, max_concurrency: 5 }, 201));
+        await queue.createQueue(API_KEY, ORG, {
+            name: 'q', consumerUrl: 'https://c', maxAttempts: 3, maxConcurrency: 2,
+        });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/queue/orgs/${ORG}/queues`);
+        expect(init.method).toBe('POST');
+        expect(JSON.parse(init.body)).toEqual({
+            name: 'q', consumer_url: 'https://c', max_attempts: 3, max_concurrency: 2,
+        });
+    });
+    it('createQueue omits unset optional fields', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ name: 'q', consumer_url: 'https://c', max_attempts: 5, max_concurrency: 5 }, 201));
+        await queue.createQueue(API_KEY, ORG, { name: 'q', consumerUrl: 'https://c' });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ name: 'q', consumer_url: 'https://c' });
+    });
+    it('listQueues unwraps the {queues:[...]} envelope to an array', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ queues: [{ name: 'a' }, { name: 'b' }] }));
+        expect(await queue.listQueues(API_KEY, ORG)).toEqual([{ name: 'a' }, { name: 'b' }]);
+    });
+    it('getQueue GETs /queues/{name}', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ name: 'q', consumer_url: 'https://c', max_attempts: 5, max_concurrency: 5 }));
+        const q = await queue.getQueue(API_KEY, ORG, 'q');
+        expect(q.max_attempts).toBe(5);
+        expect(fetchMock.mock.calls[0][0]).toContain(`/queue/orgs/${ORG}/queues/q`);
+    });
+});
+describe('queue jobs', () => {
+    it('enqueueJob POSTs payload/dedup_key/delay_seconds/depends_on', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: 'j1', queue: 'q', status: 'pending', attempts: 0 }, 201));
+        await queue.enqueueJob(API_KEY, ORG, 'q', {
+            payload: { x: 1 }, dedupKey: 'k', delaySeconds: 30, dependsOn: ['j0'],
+        });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/queue/orgs/${ORG}/queues/q/jobs`);
+        expect(init.method).toBe('POST');
+        expect(JSON.parse(init.body)).toEqual({
+            payload: { x: 1 }, dedup_key: 'k', delay_seconds: 30, depends_on: ['j0'],
+        });
+    });
+    it('listJobs unwraps {jobs} and passes status/limit as query', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ jobs: [{ id: 'j1', status: 'dead' }] }));
+        const jobs = await queue.listJobs(API_KEY, ORG, 'q', { status: 'dead', limit: 50 });
+        expect(jobs).toHaveLength(1);
+        const url = fetchMock.mock.calls[0][0];
+        expect(url).toMatch(/\/jobs\?/);
+        expect(url).toContain('status=dead');
+        expect(url).toContain('limit=50');
+    });
+    it('getJob GETs /jobs/{id} and surfaces 404', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: 'j1', queue: 'q', status: 'succeeded', attempts: 1 }));
+        expect((await queue.getJob(API_KEY, ORG, 'j1')).status).toBe('succeeded');
+        expect(fetchMock.mock.calls[0][0]).toContain(`/queue/orgs/${ORG}/jobs/j1`);
+        fetchMock.mockResolvedValueOnce(fail('job not found', 404));
+        await expect(queue.getJob(API_KEY, ORG, 'gone')).rejects.toMatchObject({ status: 404 });
+    });
+});
+describe('queue.EXPOSES', () => {
+    it('covers all 6 queue endpoints', () => {
+        expect(queue.EXPOSES).toHaveLength(6);
+        expect(queue.EXPOSES).toContain('POST /queue/orgs/{org_id}/queues/{name}/jobs');
+        expect(queue.EXPOSES).toContain('GET /queue/orgs/{org_id}/jobs/{id}');
+    });
+});

package/dist/sdk-task.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-task.test.js

@@ -0,0 +1,110 @@
+// SDK-level unit tests for the task module. Verifies URL/body shape,
+// envelope-unwrapping, the list meta {shown,total_open}, the separate body
+// tier, and lease modeling against myapi-hq/internal/routes/task/.
+// Mocks global fetch — no network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { task } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG = '11111111-1111-4111-8111-111111111111';
+let fetchMock;
+function ok(data, status = 200) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, status) {
+    return new Response(JSON.stringify({ success: false, error: { code, message: code }, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => { fetchMock = vi.fn(); globalThis.fetch = fetchMock; });
+afterEach(() => { vi.restoreAllMocks(); });
+describe('task create / list', () => {
+    it('createTask POSTs {description} plus only the set optional fields', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: 't1', description: 'do x', status: 'open' }, 201));
+        await task.createTask(API_KEY, ORG, {
+            description: 'do x', importance: 'high', dependsOn: ['t0'],
+            resolveOn: { event_type: 'payment.succeeded', field: 'id', value: '42' },
+        });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/task/orgs/${ORG}/tasks`);
+        expect(init.method).toBe('POST');
+        expect(JSON.parse(init.body)).toEqual({
+            description: 'do x', importance: 'high', depends_on: ['t0'],
+            resolve_on: { event_type: 'payment.succeeded', field: 'id', value: '42' },
+        });
+    });
+    it('listTasks reads tasks + data.meta {shown, total_open}', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ tasks: [{ id: 't1', description: 'a', score: 9 }], meta: { shown: 1, total_open: 12 } }));
+        const res = await task.listTasks(API_KEY, ORG);
+        expect(res.tasks).toHaveLength(1);
+        expect(res.meta).toEqual({ shown: 1, total_open: 12 });
+    });
+    it('listTasks passes filter options as query params', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ tasks: [], meta: { shown: 0, total_open: 0 } }));
+        await task.listTasks(API_KEY, ORG, { status: 'open', limit: 5 });
+        const url = fetchMock.mock.calls[0][0];
+        expect(url).toContain('status=open');
+        expect(url).toContain('limit=5');
+    });
+});
+describe('task get / body tier', () => {
+    it('getTask GETs /tasks/{id} and does NOT touch the body endpoint', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: 't1', description: 'a', status: 'open' }));
+        await task.getTask(API_KEY, ORG, 't1');
+        const url = fetchMock.mock.calls[0][0];
+        expect(url).toContain(`/task/orgs/${ORG}/tasks/t1`);
+        expect(url).not.toMatch(/\/body$/);
+    });
+    it('getTaskBody fetches the /body tier and unwraps {task_id, body}', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ task_id: 't1', body: '# context' }));
+        expect(await task.getTaskBody(API_KEY, ORG, 't1')).toBe('# context');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/tasks\/t1\/body$/);
+    });
+});
+describe('task lifecycle', () => {
+    it('claimTask POSTs {lease_seconds, worker} and returns the full task', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            id: 't1', description: 'a', status: 'claimed',
+            lease_expires_at: '2026-05-19T10:10:00Z', claimed_by: 'agent-7',
+        }));
+        const t = await task.claimTask(API_KEY, ORG, 't1', { leaseSeconds: 600, worker: 'agent-7' });
+        expect(t.status).toBe('claimed');
+        expect(t.lease_expires_at).toBe('2026-05-19T10:10:00Z');
+        expect(t.claimed_by).toBe('agent-7');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toMatch(/\/tasks\/t1\/claim$/);
+        expect(JSON.parse(init.body)).toEqual({ lease_seconds: 600, worker: 'agent-7' });
+    });
+    it('extendTask POSTs to /extend', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: 't1', description: 'a', status: 'claimed' }));
+        await task.extendTask(API_KEY, ORG, 't1', { leaseSeconds: 300 });
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/tasks\/t1\/extend$/);
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ lease_seconds: 300 });
+    });
+    it('resolveTask POSTs to /resolve', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: 't1', description: 'a', status: 'resolved' }));
+        await task.resolveTask(API_KEY, ORG, 't1');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/tasks\/t1\/resolve$/);
+    });
+    it('failTask POSTs {reason} to /fail', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: 't1', description: 'a', status: 'failed' }));
+        await task.failTask(API_KEY, ORG, 't1', 'blocked on legal');
+        expect(fetchMock.mock.calls[0][0]).toMatch(/\/tasks\/t1\/fail$/);
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ reason: 'blocked on legal' });
+    });
+    it('cancelTask DELETEs the task and surfaces 404', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        await task.cancelTask(API_KEY, ORG, 't1');
+        expect(fetchMock.mock.calls[0][1].method).toBe('DELETE');
+        fetchMock.mockResolvedValueOnce(fail('task not found', 404));
+        await expect(task.cancelTask(API_KEY, ORG, 'gone')).rejects.toMatchObject({ status: 404 });
+    });
+});
+describe('task.EXPOSES', () => {
+    it('covers all 9 task endpoints', () => {
+        expect(task.EXPOSES).toHaveLength(9);
+        expect(task.EXPOSES).toContain('GET /task/orgs/{org_id}/tasks/{id}/body');
+        expect(task.EXPOSES).toContain('POST /task/orgs/{org_id}/tasks/{id}/claim');
+    });
+});

package/dist/skills/my-workflow-api/SKILL.md

@@ -21,8 +21,10 @@ Step types today:
 |---|---|---|
 | `send_email` | `email` | `from`, `to`, `subject`, plus one of `body` / `html` / `template_id` |
 | `slack_message` | `slack` | `webhook_url`, `text` |
+| `http_request` | `http` | `url` (optional: `method`, `body`, `headers`) |
+| `enqueue_job` | `enqueue` | `queue` (optional: `payload`, `dedup_key`, `delay_seconds`) — hands durable work to **my-queue-api** |
 
-Both step types support **payload templating** with `{{ payload.fieldname }}`. The webhook payload is the entire POST body; named fields are accessed dotted. Whitespace inside braces is fine — both `{{ payload.email }}` and `{{payload.email}}` work.
+All step types support **payload templating** with `{{ payload.fieldname }}`. The webhook payload is the entire POST body; named fields are accessed dotted. Whitespace inside braces is fine — both `{{ payload.email }}` and `{{payload.email}}` work.
 
 Unknown step types are rejected at create time, so typos surface immediately rather than after 3 failed retries during execution.
 
@@ -95,4 +97,11 @@ myapi workflow enable <id>
 - Disable to stop firing without losing the configuration.
 - Deleting a workflow purges its run history; the webhook endpoint remains.
 
+## See also
+
+`workflow` is one of three orchestration slots. Use **workflow** to react to
+inbound webhooks; use **my-queue-api** for durable retried machine work; use
+**my-task-api** for work that needs an agent/human decision. Full comparison:
+`docs/orchestration-decision-guide.md`.
+
 Run `myapi workflow --help` for full flag reference.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.2.9",
+  "version": "1.3.0",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -29,7 +29,7 @@
     "lint:changelog": "node ../../scripts/lint-changelog.js"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.2.9"
+    "@myapihq/sdk": "^1.3.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",