@myapihq/cli 1.3.13 → 2.1.0

package/dist/commands/container.js

@@ -1,7 +1,9 @@
+import { spawnSync } from 'node:child_process';
+import { readFile, stat } from 'node:fs/promises';
 import { container as sdkContainer } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson, banner } from '../output.js';
-import { formatDate } from '../utils.js';
+import { formatDate, pollJob } from '../utils.js';
 import { requireOrg } from '../helpers.js';
 export const EXPOSES = [
     'POST /container/orgs/{org_id}/containers',
@@ -25,6 +27,8 @@ export const SCHEMA = {
     env: 'string',
     tail: 'number',
     remove: 'boolean',
+    source: 'string',
+    image: 'string',
 };
 const CONTAINER_TYPES = ['service', 'worker', 'job'];
 // Mirrors validateName in myapi-hq/internal/routes/container/crud.go —
@@ -149,6 +153,8 @@ export async function get(id, flags) {
     if (c.port)
         info(`Port:            ${c.port}`);
     info(`URL:             ${c.url || '(not deployed)'}`);
+    if (c.egress)
+        info(`Egress:          ${c.egress}`);
     if (c.custom_domain)
         info(`Custom domain:   ${c.custom_domain}`);
     info(`Created:         ${c.created_at}`);
@@ -162,15 +168,106 @@ export async function del(id, flags) {
     await sdkContainer.deleteContainer(config.api_key, orgId, id);
     success(`Deleted container ${id}`);
 }
-// deploy ships a pre-built image to Cloud Run. The scoped API key is
-// rotated on every deploy — the fresh value is shown once here.
+// _isTarball returns true if the path looks like an already-built tar archive
+// (so we upload it as-is instead of tarring a directory).
+export function _isTarball(p) {
+    return /\.(tar|tar\.gz|tgz)$/i.test(p);
+}
+// tarDirectory builds a gzipped tarball of a build-context directory using the
+// system `tar`. Returns the archive bytes. We tar the directory contents (-C
+// <dir> .) so the Dockerfile sits at the root of the build context.
+async function tarDirectory(dir) {
+    const res = spawnSync('tar', ['-czf', '-', '-C', dir, '.'], {
+        maxBuffer: 200 * 1024 * 1024,
+    });
+    if (res.error) {
+        if (res.error.code === 'ENOENT') {
+            error('`tar` was not found on PATH. Install tar, or pass a pre-built .tar.gz to --source.');
+        }
+        error(`Failed to create build-context archive: ${res.error.message}`);
+    }
+    if (res.status !== 0) {
+        error(`tar exited ${res.status}: ${res.stderr?.toString().trim() || 'unknown error'}`);
+    }
+    return res.stdout;
+}
+// deploy ships either a pre-built image (--image / positional ref, synchronous)
+// or a source build context (--source <dir-or-tar>, asynchronous Cloud Build).
+// The scoped API key is rotated on every (image) deploy and shown once.
 export async function deploy(id, image, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi container deploy <id> <image-ref> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi container deploy <id> <image-ref> | --source <dir|tar> [--org <id>]');
     if (!id)
-        error('Missing id.\nUsage: myapi container deploy <id> <image-ref>');
+        error('Missing id.\nUsage: myapi container deploy <id> <image-ref>   (or --source <dir|tar>)');
+    const source = typeof flags.source === 'string' ? flags.source : undefined;
+    // --image is an alias for the positional image ref.
+    if (!image && typeof flags.image === 'string')
+        image = flags.image;
+    if (source && image) {
+        error('Pass either an image ref or --source, not both.');
+    }
+    // ── Source-build path (async) ───────────────────────────────────────────
+    if (source) {
+        let tarball;
+        let filename = 'source.tar.gz';
+        let info_st;
+        try {
+            info_st = await stat(source);
+        }
+        catch (e) {
+            if (e?.code === 'ENOENT')
+                error(`Source not found: ${source}`);
+            error(`Could not read ${source}: ${e?.message ?? e}`);
+        }
+        if (info_st.isDirectory()) {
+            tarball = await tarDirectory(source);
+        }
+        else if (_isTarball(source)) {
+            tarball = await readFile(source);
+            filename = source.split('/').pop() || filename;
+        }
+        else {
+            error(`--source must be a directory or a .tar/.tar.gz/.tgz archive — got ${source}`);
+        }
+        const start = await sdkContainer.deployContainerSource(config.api_key, orgId, id, tarball, filename);
+        if (flags.json && start.status !== 'building') {
+            printJson(start);
+            return;
+        }
+        // Async: poll the container until it leaves the building state.
+        if (start.status === 'building') {
+            info(`Build started (revision ${start.revision_id}). Building from source via Cloud Build…`);
+            const final = await pollJob({
+                label: 'Building & deploying',
+                check: () => sdkContainer.getContainer(config.api_key, orgId, id),
+                isDone: (c) => c.status === 'active',
+                isFailed: (c) => c.status === 'build_error' || c.status === 'deploy_error',
+                failedMessage: 'Build/deploy failed — check `myapi container logs ' + id + '`.',
+                timeoutMs: 600_000,
+                intervalMs: 5_000,
+            });
+            if (flags.json) {
+                printJson(final);
+                return;
+            }
+            success(`Deployed container ${id} from source`);
+            info(`Status:          ${final.status}`);
+            info(`URL:             ${final.url || '(none — job container)'}`);
+            return;
+        }
+        // Backend deployed synchronously after all (unexpected for source) —
+        // surface whatever it returned.
+        if (flags.json) {
+            printJson(start);
+            return;
+        }
+        success(`Deployed container ${id} (revision ${start.revision_id})`);
+        info(`Status:          ${start.status}`);
+        return;
+    }
+    // ── Pre-built image path (sync) ─────────────────────────────────────────
     if (!image)
-        error('Missing image ref.\nUsage: myapi container deploy <id> <image-ref>\n\n→ <image-ref> is a pre-built container image (e.g. a registry path).');
+        error('Missing image ref.\nUsage: myapi container deploy <id> <image-ref>\n   or: myapi container deploy <id> --source <dir|tar>\n\n→ <image-ref> is a pre-built container image (e.g. a registry path).');
     const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image);
     if (flags.json) {
         printJson(result);
@@ -247,12 +344,19 @@ Examples:
   myapi container create --name nightly --type job --cron "0 3 * * *"
   myapi container create --name queue-worker --type worker --memory 1Gi`,
     'deploy': `myapi container deploy <id> <image-ref> [--org <id>] [--json]
+       myapi container deploy <id> --source <dir|tar.gz> [--org <id>] [--json]
 
-Ships a pre-built container image to the runtime. The scoped API key is
-rotated on every deploy — the fresh value is printed once.
+Two ways to deploy:
+  image    Ship a pre-built image (positional ref or --image). Synchronous;
+           the scoped API key is rotated and printed once.
+  source   Upload a build context with --source <dir> (tarred locally) or a
+           pre-built --source <archive.tar.gz>. MyAPI builds it via Cloud
+           Build, then deploys. Asynchronous — the CLI polls until it's live.
 
-Example:
-  myapi container deploy <id> registry.example.com/my-app:v2`,
+Examples:
+  myapi container deploy <id> registry.example.com/my-app:v2
+  myapi container deploy <id> --source ./my-app
+  myapi container deploy <id> --source ./context.tar.gz`,
     'list': 'myapi container list [--org <id>] [--json]',
     'get': 'myapi container get <id> [--org <id>] [--json]',
     'logs': `myapi container logs <id> [--tail <n>] [--org <id>] [--json]
@@ -281,7 +385,7 @@ dependencies and long execution.
 Subcommands:
   create               Register a container and get its scoped API key (returned once)
   delete <id>          Soft-delete and revoke its scoped API key
-  deploy <id> <image>  Ship a pre-built image and go live
+  deploy <id> <image>  Ship a pre-built image (or --source <dir|tar> to build) and go live
   domain <id> <domain> Bind a custom domain (--remove to unbind)
   get <id>             Inspect a container
   list                 List containers in your org

package/dist/commands/doctor-setup.test.js

@@ -3,7 +3,7 @@
 // `domains` or `emails` sections come back empty (zero-state), the
 // `setup` augmentation should escalate to actionable warns.
 import { describe, it, expect } from 'vitest';
-import { _setupSection } from './doctor.js';
+import { _setupSection, sanitizeHint, _tallyTotals } from './doctor.js';
 function mkReport(sections) {
     return {
         org_id: 'org-test',
@@ -20,6 +20,12 @@ function populated(name) {
                 id: 'x', severity: 'ok', scope: name, message: 'something',
             }] };
 }
+// A section the backend reports as having resources, but with no issues
+// emitted (all healthy, no per-resource ok rows). The issue-count proxy
+// would mis-read this as zero-state; `resource_count` must win.
+function healthyQuiet(name, count) {
+    return { name, summary: 'all checks passed', issues: [], resource_count: count };
+}
 describe('_setupSection', () => {
     it('returns null when both domains + emails sections are populated', () => {
         expect(_setupSection(mkReport([populated('domains'), populated('emails')]))).toBeNull();
@@ -71,4 +77,83 @@ describe('_setupSection', () => {
         const s = _setupSection(mkReport([populated('domains'), populated('emails')]), { mailingAddress: undefined });
         expect(s).toBeNull();
     });
+    // resource_count is authoritative — it must override the fragile
+    // issues.length proxy in both directions.
+    it('does NOT flag a healthy-but-quiet domains section (resource_count > 0, no issues)', () => {
+        // The bug class this prevents: backend stops emitting per-domain `ok`
+        // rows → issues:[] → proxy would falsely say "No domain registered".
+        const s = _setupSection(mkReport([healthyQuiet('domains', 2), healthyQuiet('emails', 1)]));
+        expect(s).toBeNull();
+    });
+    it('flags zero-state via resource_count even if an issue happens to be present', () => {
+        const domains = {
+            name: 'domains', summary: 'x', resource_count: 0,
+            issues: [{ id: 'y', severity: 'ok', scope: 'domains', message: 'stale ok row' }],
+        };
+        const s = _setupSection(mkReport([domains, populated('emails')]));
+        expect(s).not.toBeNull();
+        expect(s.issues).toHaveLength(1);
+        expect(s.issues[0].scope).toBe('setup/domain');
+    });
+    it('falls back to the issue-count proxy when resource_count is absent', () => {
+        // Older backend: no resource_count → empty section still reads as zero-state.
+        const s = _setupSection(mkReport([empty('domains'), populated('emails')]));
+        expect(s.issues[0].scope).toBe('setup/domain');
+    });
+});
+describe('sanitizeHint', () => {
+    it('drops a hint referencing an internal docs/ artifact', () => {
+        expect(sanitizeHint('see docs/security-debt-pixel-hypersearch-2026-05-27.md item #2 for the fix')).toBeUndefined();
+    });
+    it('drops a hint referencing an internal code path', () => {
+        expect(sanitizeHint('fix in internal/routes/billing/billing.go')).toBeUndefined();
+        expect(sanitizeHint('see packages/cli/src/commands/doctor.ts')).toBeUndefined();
+    });
+    it('keeps actionable command hints unchanged', () => {
+        const cmd = 'Create one with: myapi email mailbox create <username>@<your-domain>';
+        expect(sanitizeHint(cmd)).toBe(cmd);
+        expect(sanitizeHint('attach a workflow if you want a notification on each submission'))
+            .toBe('attach a workflow if you want a notification on each submission');
+    });
+    it('does not false-match a bare word with a dotted suffix (no slash)', () => {
+        // "node.js" / "data.object" have no path slash → not an internal artifact.
+        expect(sanitizeHint('deploy your node.js app')).toBe('deploy your node.js app');
+    });
+    it('passes through undefined', () => {
+        expect(sanitizeHint(undefined)).toBeUndefined();
+    });
+});
+describe('_tallyTotals', () => {
+    function sec(name, issues) {
+        return {
+            name, summary: '', issues: issues.map((i, n) => ({
+                id: `${name}-${n}`, severity: 'warn', scope: name, message: 'm', ...i,
+            })),
+        };
+    }
+    it('counts plain severities', () => {
+        const t = _tallyTotals([sec('a', [{ severity: 'crit' }, { severity: 'warn' }, { severity: 'ok' }])]);
+        expect(t).toEqual({ ok: 1, warn: 1, crit: 1, operator: 0 });
+    });
+    it('pulls an operator_only critical OUT of crit and into operator', () => {
+        // The pixel case: a platform-side critical must not count as a customer
+        // critical (so it won't set exit code 1).
+        const t = _tallyTotals([sec('pixel', [{ severity: 'crit', operator_only: true }])]);
+        expect(t.crit).toBe(0);
+        expect(t.operator).toBe(1);
+    });
+    it('pulls an operator_only warning into operator too', () => {
+        const t = _tallyTotals([sec('x', [{ severity: 'warn', operator_only: true }, { severity: 'warn' }])]);
+        expect(t.warn).toBe(1);
+        expect(t.operator).toBe(1);
+    });
+    it('still counts a real customer critical alongside an operator_only one', () => {
+        const t = _tallyTotals([sec('x', [{ severity: 'crit' }, { severity: 'crit', operator_only: true }])]);
+        expect(t.crit).toBe(1); // exit code WILL be 1 — there's a real one
+        expect(t.operator).toBe(1);
+    });
+    it('treats an operator_only ok row as a passing check, not an operator issue', () => {
+        const t = _tallyTotals([sec('x', [{ severity: 'ok', operator_only: true }])]);
+        expect(t).toEqual({ ok: 1, warn: 0, crit: 0, operator: 0 });
+    });
 });

package/dist/commands/doctor.d.ts

@@ -4,6 +4,14 @@ import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+export interface DoctorTotals {
+    ok: number;
+    warn: number;
+    crit: number;
+    operator: number;
+}
+export declare function _tallyTotals(sections: sdkHq.DoctorSection[]): DoctorTotals;
+export declare function sanitizeHint(hint: string | undefined): string | undefined;
 export interface SetupContext {
     mailingAddress?: string | null;
 }

package/dist/commands/doctor.js

@@ -41,6 +41,33 @@ const MARK = {
     warn: `${C.warn}⚠${C.reset}`,
     crit: `${C.err}✗${C.reset}`,
 };
+// Operator-only issues are platform-side and not the customer's to fix. Render
+// them with a distinct, non-alarming marker so they don't read as a failure the
+// customer must act on — regardless of the backend severity.
+const OPERATOR_MARK = `${C.dim}ℹ${C.reset}`;
+// Tally issues for the exit code + summary. `operator_only` warn/crit issues
+// are pulled into their own `operator` bucket and OUT of crit/warn: a
+// platform-side problem the customer can't fix must not fail their `doctor`
+// run (exit 1) or inflate their critical count. Everything else tallies by
+// severity as before; any ok row (operator or not) counts as ok.
+export function _tallyTotals(sections) {
+    const t = { ok: 0, warn: 0, crit: 0, operator: 0 };
+    for (const s of sections) {
+        for (const i of s.issues) {
+            if (i.severity === 'crit' || i.severity === 'warn') {
+                if (i.operator_only)
+                    t.operator++;
+                else
+                    t[i.severity]++;
+            }
+            else if (i.severity === 'ok') {
+                t.ok++;
+            }
+            // Unknown severities the backend might invent are ignored (no NaN).
+        }
+    }
+    return t;
+}
 function rule(width = 60) {
     return `${C.dim}${'─'.repeat(width)}${C.reset}`;
 }
@@ -51,14 +78,43 @@ function rule(width = 60) {
 function localIssueId(kind, key) {
     return `${kind}/${createHash('sha256').update(key).digest('hex').slice(0, 16)}`;
 }
+// Backend hints are sometimes written for operators, not customers — e.g.
+// "see docs/security-debt-pixel-hypersearch-2026-05-27.md item #2 for the fix".
+// A reference to an internal repo artifact (a file path with a doc/code
+// extension, or anything under `docs/`) is useless to — and leaks internals
+// at — the customer running `myapi doctor`. Drop the hint entirely in that
+// case: the issue's `message` still conveys what's wrong; a hint that points
+// nowhere the user can go is worse than no hint. (Root fix is backend-side
+// hint hygiene — see docs/cross-repo-prompts/backend-doctor-quality-*.md.)
+const INTERNAL_ARTIFACT_RE = /\bdocs\/[\w.\-/]+|\b[\w.\-]+\/[\w.\-/]*\.(?:md|go|tsx?|jsx?|json|ya?ml|sql)\b/i;
+export function sanitizeHint(hint) {
+    if (!hint)
+        return undefined;
+    return INTERNAL_ARTIFACT_RE.test(hint) ? undefined : hint;
+}
 function fmtIssue(i) {
     // Prefix the entity name so sibling issues with identical messages
     // (e.g. four "domain is active" rows) are distinguishable. Skip it when
     // the message already names the entity — the local DNS section does.
     const name = i.entity?.name;
     const label = name && !i.message.includes(name) ? `${C.bold}${name}${C.reset} — ` : '';
-    const head = `  ${MARK[i.severity] ?? '·'} ${label}${i.message}`;
-    return i.hint ? `${head}\n    ${C.dim}→ ${i.hint}${C.reset}` : head;
+    const mark = i.operator_only ? OPERATOR_MARK : (MARK[i.severity] ?? '·');
+    const head = `  ${mark} ${label}${i.message}`;
+    const hint = sanitizeHint(i.hint);
+    return hint ? `${head}\n    ${C.dim}→ ${hint}${C.reset}` : head;
+}
+// "Does this section's org have zero resources of its kind?" Prefer the
+// backend's authoritative `resource_count` when present; fall back to the
+// issue-count proxy only for older backends that omit it. The proxy is
+// fragile — it reads "section emitted no issues" as "no resources", which
+// holds today only because the backend emits an `ok` row per healthy
+// resource. The moment a section returns `issues: []` for an all-healthy
+// org, the proxy would mis-fire (e.g. "No domain registered" for an org
+// that has a live domain). `resource_count` removes that coupling.
+function isZeroState(section) {
+    if (typeof section.resource_count === 'number')
+        return section.resource_count === 0;
+    return section.issues.length === 0;
 }
 export function _setupSection(report, ctx = {}) {
     const byName = new Map();
@@ -66,7 +122,7 @@ export function _setupSection(report, ctx = {}) {
         byName.set(s.name, s);
     const issues = [];
     const dom = byName.get('domains');
-    if (dom && dom.issues.length === 0) {
+    if (dom && isZeroState(dom)) {
         issues.push({
             id: localIssueId('setup_no_domain', report.org_id),
             severity: 'warn',
@@ -77,7 +133,7 @@ export function _setupSection(report, ctx = {}) {
         });
     }
     const em = byName.get('emails');
-    if (em && em.issues.length === 0) {
+    if (em && isZeroState(em)) {
         issues.push({
             id: localIssueId('setup_no_mailbox', report.org_id),
             severity: 'warn',
@@ -283,18 +339,12 @@ export async function run(_subcommand, _args, flags) {
     const reachSection = await httpProbeSection(apiKey, orgId);
     if (reachSection)
         report.sections.push(reachSection);
-    // Re-tally totals after local augmentation.
-    const totals = { ok: 0, warn: 0, crit: 0 };
-    for (const s of report.sections) {
-        for (const i of s.issues) {
-            // Ignore any severity the backend invents that we don't model — better
-            // a missed count than a NaN poisoning the whole tally.
-            if (i.severity in totals)
-                totals[i.severity]++;
-        }
-    }
+    // Re-tally totals after local augmentation. `operator_only` issues land in
+    // their own bucket and out of crit/warn (see _tallyTotals).
+    const totals = _tallyTotals(report.sections);
     // Set the exit code before any output branch — CI relies on it in both
-    // the human and the --json path.
+    // the human and the --json path. Only customer-actionable criticals fail
+    // the run; a platform-side (operator_only) critical does not.
     if (totals.crit)
         process.exitCode = 1;
     if (wantJson) {
@@ -322,6 +372,11 @@ export async function run(_subcommand, _args, flags) {
     else {
         info(`${MARK.ok} ${totals.ok} check${totals.ok === 1 ? '' : 's'} passed`);
     }
+    // Platform-side issues are surfaced for transparency but don't count against
+    // the org or fail the run — make that explicit.
+    if (totals.operator) {
+        info(`${OPERATOR_MARK} ${C.dim}${totals.operator} platform-side issue${totals.operator === 1 ? '' : 's'} the MyAPI team is handling (not counted against your org)${C.reset}`);
+    }
     if (!verbose)
         info(`${C.dim}(--verbose to show passing checks · --json for machine-readable)${C.reset}`);
 }

package/dist/commands/domain.js

@@ -299,7 +299,7 @@ export async function emailSetup(domainArg, flags) {
         printJson(res);
         return;
     }
-    success(`Email infra provisioning on ${res.email_subdomain} (state: ${res.email_infra})`);
+    success(`Email infra provisioning on ${res.subdomain} (state: ${res.email_infra})`);
     if (res.next_step)
         info(res.next_step);
     info(`Track with: myapi domain status ${domain} --watch`);
@@ -533,7 +533,7 @@ Prerequisites:
   - WHOIS registrant info (ICANN requirement — see below)
 
 Registrant (required at every register call):
-  Cheapest path: run \`myapi auth registrant set\` once. The CLI stores
+  Cheapest path: run \`myapi account registrant set\` once. The CLI stores
   your name/email/phone/address and auto-injects it on every register.
 
   Per-call override (agent-friendly):

package/dist/commands/email/index.js

@@ -10,7 +10,6 @@ import * as mailbox from './mailbox.js';
 import * as message from './message.js';
 import * as warmup from './warmup.js';
 import * as template from './template.js';
-import * as campaign from './campaign.js';
 import * as verify from './verify.js';
 export const SCHEMA = {
     org: 'string',
@@ -53,15 +52,6 @@ const DEPRECATED_ALIASES = {
     'edit-template': ['template', 'edit'],
     'send-test': ['template', 'send-test'],
     'delete-template': ['template', 'delete'],
-    'create-campaign': ['campaign', 'create'],
-    'list-campaigns': ['campaign', 'list'],
-    'get-campaign': ['campaign', 'get'],
-    'update-campaign': ['campaign', 'update'],
-    'upload-contacts': ['campaign', 'upload-contacts'],
-    'start-campaign': ['campaign', 'start'],
-    'pause-campaign': ['campaign', 'pause'],
-    'resume-campaign': ['campaign', 'resume'],
-    'campaign-stats': ['campaign', 'stats'],
 };
 async function dispatchNamespace(ns, sub, restArgs, flags) {
     switch (ns) {
@@ -69,7 +59,6 @@ async function dispatchNamespace(ns, sub, restArgs, flags) {
         case 'message': return message.run(sub, restArgs, flags);
         case 'warmup': return warmup.run(sub, restArgs, flags);
         case 'template': return template.run(sub, restArgs, flags);
-        case 'campaign': return campaign.run(sub, restArgs, flags);
         case 'verify': return verify.run(sub, restArgs, flags);
         default: error(`Unknown namespace: ${ns}. Run "myapi email --help" for the list.`);
     }
@@ -79,7 +68,6 @@ export async function run(subcommand, args, flags) {
         info(`Usage: myapi email <namespace> <subcommand>
 
 Namespaces:
-  campaign   Email campaigns (org-scoped) — create, list, get, update, upload-contacts, start, pause, resume, stats
   mailbox    Mailboxes (account-scoped) — create, list, activate-sending
   message    Send & read mail (account-scoped) — send, status, sent, inbox, outbox, get
   template   Email templates (org-scoped) — generate, list, edit, send-test, delete
@@ -90,7 +78,6 @@ Examples:
   myapi email mailbox create hello@example.com
   myapi email message send --from a@x --to b@y --subject hi --body "hello"
   myapi email template generate welcome --prompt "Welcome email"
-  myapi email campaign create "Q2 Launch" --template-id <id> --from a@x
   myapi email verify alice@example.com
 
 Org-scoped commands accept --org <id> (or set default: myapi config set-org <id>).

package/dist/commands/fn.d.ts

@@ -11,6 +11,7 @@ export declare function list(flags: Flags): Promise<void>;
 export declare function get(id: string, flags: Flags): Promise<void>;
 export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function deploy(id: string, bundlePath: string, flags: Flags): Promise<void>;
+export declare function _parseSetPairs(raw: string | string[]): Record<string, string> | string;
 export declare function setEnv(id: string, name: string, value: string, flags: Flags): Promise<void>;
 export declare function runs(id: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/fn.js

@@ -15,6 +15,8 @@ export const EXPOSES = [
 ];
 export const SCHEMA = {
     cron: 'string',
+    scope: 'string',
+    set: 'string',
 };
 // Backend: Story 1 (function CRUD + scoped key) and Story 2/4/5 (deploy a
 // JS bundle to Cloudflare Workers, list runs, set env secrets).
@@ -67,6 +69,14 @@ export async function create(flags) {
     };
     if (cron)
         payload.cron_schedule = cron;
+    // --scope narrows the minted key's slot grants. Repeatable, but the flag
+    // parser keeps only the last occurrence, so we also accept a comma-joined
+    // list (e.g. --scope email,storage). Grants can never exceed the caller's.
+    if (typeof flags.scope === 'string') {
+        const scopes = flags.scope.split(',').map(s => s.trim()).filter(Boolean);
+        if (scopes.length > 0)
+            payload.scopes = scopes;
+    }
     const result = await sdkFn.createFunction(config.api_key, orgId, payload);
     success(`Function created: ${result.function.id}`);
     info(`Name:            ${result.function.name}`);
@@ -77,7 +87,8 @@ export async function create(flags) {
     info('');
     info(`Scoped API key (returned once — save it if you need it):`);
     info(`  ${result.scoped_api_key}`);
-    info(`  (id: ${result.scoped_api_key_id}; scopes: slot_call; rejected at /hq/*, /admin/*, /internal/*)`);
+    const scopeNote = payload.scopes && payload.scopes.length > 0 ? `slots: ${payload.scopes.join(', ')}` : 'scopes: slot_call';
+    info(`  (id: ${result.scoped_api_key_id}; ${scopeNote}; rejected at /hq/*, /admin/*, /internal/*)`);
     if (!result.function.invocation_url) {
         info('');
         banner(`Next: deploy code with  myapi fn deploy ${result.function.id} <bundle.js>`);
@@ -153,14 +164,48 @@ export async function deploy(id, bundlePath, flags) {
     info(`Scoped API key was rotated. New value (returned once — save it if you need it):`);
     info(`  ${result.scoped_api_key}`);
 }
-// env sets a Worker Secret (Stripe key, etc.) on a deployed function.
+// _parseSetPairs parses `--set K=V` entries into a map. Accepts a single
+// string (comma-joined: K=V,K2=V2) or an array of strings (when the flag is
+// repeated and the parser preserves them). Returns the map or an error
+// message string (pure form, for tests).
+export function _parseSetPairs(raw) {
+    const entries = [];
+    for (const chunk of Array.isArray(raw) ? raw : [raw]) {
+        for (const pair of chunk.split(',').map(s => s.trim()).filter(Boolean))
+            entries.push(pair);
+    }
+    const env = {};
+    for (const pair of entries) {
+        const eq = pair.indexOf('=');
+        if (eq < 1)
+            return `Invalid --set entry "${pair}". Use KEY=VALUE.`;
+        env[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+    return env;
+}
+// env sets Worker Secret(s) (Stripe key, etc.) on a deployed function.
+// Single form:  myapi fn env <id> <name> <value>
+// Bulk form:    myapi fn env <id> --set K=V[,K2=V2 ...]
 export async function setEnv(id, name, value, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi fn env <id> <name> <value> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi fn env <id> <name> <value> | --set K=V [--org <id>]');
     if (!id)
-        error('Missing id.\nUsage: myapi fn env <id> <name> <value>');
+        error('Missing id.\nUsage: myapi fn env <id> <name> <value>   (or --set K=V for bulk)');
+    // Bulk path: one --set string (comma-joined) or repeated --set occurrences.
+    if (flags.set !== undefined && flags.set !== true) {
+        const env = _parseSetPairs(flags.set);
+        if (typeof env === 'string')
+            error(env);
+        if (Object.keys(env).length === 0)
+            error('No secrets given. Usage: myapi fn env <id> --set KEY=VALUE');
+        const result = await sdkFn.setFunctionEnvBulk(config.api_key, orgId, id, env);
+        success(`Set ${result.set} secret${result.set === 1 ? '' : 's'} on function ${id}`);
+        info('Values are encrypted at rest by Cloudflare and never stored or echoed by MyAPI.');
+        return;
+    }
+    // Single-secret path (original form).
     if (!name)
-        error('Missing secret name.\nUsage: myapi fn env <id> <name> <value>');
+        error('Missing secret name.\nUsage: myapi fn env <id> <name> <value>   (or --set K=V for bulk)');
     if (value === undefined)
         error('Missing secret value.\nUsage: myapi fn env <id> <name> <value>');
     await sdkFn.setFunctionEnv(config.api_key, orgId, id, name, value);
@@ -191,7 +236,7 @@ export async function runs(id, flags) {
 }
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    'create': `myapi fn create --name <name> [--cron <expr>] [--org <id>]
+    'create': `myapi fn create --name <name> [--cron <expr>] [--scope <slot>[,<slot>...]] [--org <id>]
 
 Persists a function record + issues a scoped API key. Deploy code separately
 with "myapi fn deploy".
@@ -200,9 +245,15 @@ Triggers:
   (default)         HTTP — function gets a public invocation URL once deployed.
   --cron <expr>     Cron — function runs on the schedule (e.g. "0 8 * * *").
 
+Scoping:
+  --scope <slot>    Narrow the minted key's slot grants (comma-separated list,
+                    e.g. --scope email,storage). Omit to inherit your grants.
+                    The key can never out-reach the credential that created it.
+
 Examples:
   myapi fn create --name my-app-api
   myapi fn create --name daily-report --cron "0 8 * * *"
+  myapi fn create --name mailer --scope email,storage
 
 The response returns the scoped API key ONCE. It lets the function call
 other MyAPI slots with its own permissions (scopes=slot_call; rejected at
@@ -218,13 +269,14 @@ once. After deploy the function has a live invocation URL.
 Example:
   myapi fn deploy <id> ./dist/bundle.js`,
     'env': `myapi fn env <id> <name> <value> [--org <id>]
+       myapi fn env <id> --set KEY=VALUE[,KEY2=VALUE2 ...] [--org <id>]
 
-Sets a secret (Stripe key, API token, ...) as a Cloudflare Worker Secret on
-a deployed function. The value is encrypted at rest and never stored in
-MyAPI or echoed back. The function must already be deployed.
+Sets one or more secrets (Stripe key, API token, ...) as Cloudflare Worker
+Secrets on a deployed function. Values are encrypted at rest and never stored
+in MyAPI or echoed back. The function must already be deployed.
 
-Example:
-  myapi fn env <id> STRIPE_KEY sk_live_...`,
+  Single:  myapi fn env <id> STRIPE_KEY sk_live_...
+  Bulk:    myapi fn env <id> --set STRIPE_KEY=sk_live_...,WEBHOOK_SECRET=whsec_...`,
     'runs': `myapi fn runs <id> [--org <id>] [--json]
 
 Lists recent invocation records (most recent first, up to 100).`,
@@ -242,7 +294,7 @@ Subcommands:
   create               Register a function and get its scoped API key (returned once)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <file>   Upload a JS bundle and go live
-  env <id> <k> <v>     Set a Worker Secret on a deployed function
+  env <id> <k> <v>     Set a Worker Secret (or --set K=V for bulk) on a deployed function
   get <id>             Inspect a function
   list                 List functions in your org
   runs <id>            List recent invocation records