@myapihq/cli 1.3.6 → 1.3.8

package/dist/commands/crm/companies.js

@@ -10,6 +10,7 @@ export const EXPOSES = [
     'GET /crm/orgs/{org_id}/companies/{id}',
     'PATCH /crm/orgs/{org_id}/companies/{id}',
     'DELETE /crm/orgs/{org_id}/companies/{id}',
+    'POST /crm/orgs/{org_id}/companies/{id}/restore',
 ];
 export const SCHEMA = {};
 function csv(v) {

package/dist/commands/crm/contacts.js

@@ -10,6 +10,7 @@ export const EXPOSES = [
     'GET /crm/orgs/{org_id}/contacts/{id}',
     'PATCH /crm/orgs/{org_id}/contacts/{id}',
     'DELETE /crm/orgs/{org_id}/contacts/{id}',
+    'POST /crm/orgs/{org_id}/contacts/{id}/restore',
     'GET /crm/orgs/{org_id}/contacts/{id}/events',
 ];
 export const SCHEMA = {};

package/dist/commands/funnel.d.ts

@@ -9,6 +9,7 @@ export declare function get(id: string, flags: Flags): Promise<void>;
 export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function pages(funnelArg: string, flags: Flags): Promise<void>;
 export declare function push(slug: string, flags: Flags): Promise<void>;
+export declare function formCmd(funnelArg: string | undefined, flags: Flags): Promise<void>;
 export declare function verify(slug: string, flags: Flags): Promise<void>;
 export declare function publish(dir: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/funnel.js

@@ -14,6 +14,13 @@ export const EXPOSES = [
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
+    // form bindings — created/listed/removed via `funnel form --capture-to`
+    // and the underlying SDK helpers. List/Delete don't have dedicated CLI
+    // subcommands yet; the SDK functions are wired and customers using the
+    // SDK directly need them in EXPOSES for coverage to be honest.
+    'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+    'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/forms',
+    'DELETE /funnel/orgs/{org_id}/funnels/{funnel_id}/forms/{slug}',
     'GET /hq/orgs/{org_id}',
 ];
 export const SCHEMA = {
@@ -21,6 +28,12 @@ export const SCHEMA = {
     slug: 'string',
     env: 'string',
     'api-fn': 'string',
+    // form
+    fields: 'string',
+    cta: 'string',
+    success: 'string',
+    'capture-to': 'string',
+    honeypot: 'string',
 };
 // Backend (2026-05-15): POST /funnels accepts an optional `name` (defaults
 // to the org's preview_subdomain for back-compat). Mirror the backend's
@@ -178,6 +191,129 @@ export async function push(slug, flags) {
         }
     }
 }
+function parseField(token) {
+    // <name>[:<modifier>]... — modifiers are types or `required`, order-free.
+    const parts = token.split(':').map(p => p.trim()).filter(Boolean);
+    const name = parts[0];
+    if (!name || !/^[a-z][a-z0-9_]*$/i.test(name)) {
+        error(`Invalid field name "${name}". Lowercase letters/digits/underscores; starts with a letter.`);
+    }
+    let type;
+    let required = false;
+    for (const mod of parts.slice(1)) {
+        const m = mod.toLowerCase();
+        if (m === 'required')
+            required = true;
+        else if (m === 'text' || m === 'email' || m === 'number' || m === 'tel')
+            type = m;
+        else
+            error(`Unknown field modifier "${mod}" on "${name}". Use one of: text, email, number, tel, required.`);
+    }
+    if (!type) {
+        const n = name.toLowerCase();
+        type = n === 'email' ? 'email'
+            : n === 'phone' || n === 'tel' ? 'tel'
+                : 'text';
+    }
+    return { name, type, required };
+}
+function parseCaptureTo(raw) {
+    const m = raw.match(/^(webhook|workflow):([a-f0-9-]{36})$/i);
+    if (!m)
+        error(`Invalid --capture-to "${raw}". Expected webhook:<uuid> or workflow:<uuid>.`);
+    return { kind: m[1].toLowerCase(), id: m[2] };
+}
+export async function formCmd(funnelArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi funnel form [funnel-id] [--slug <s>] [--fields <spec>] [--capture-to <dest>] [--honeypot <name>] [--cta "<text>"] [--success "<text>"] [--org <id>] [--json]');
+    // Resolve funnel id the same way push/verify do.
+    let funnelId = funnelArg || flags.funnel || config.default_funnel;
+    if (!funnelId) {
+        const existing = await sdkFunnel.listFunnels(config.api_key, orgId);
+        if (existing.length === 0)
+            error('No funnel found for this org. Create one with: myapi funnel create');
+        if (existing.length > 1) {
+            error(`Multiple funnels exist and no default is set.\nPass the funnel id, or set a default:\n  myapi config set-funnel <id>\n\nFunnels:\n${existing.map(f => `  ${f.id}`).join('\n')}`);
+        }
+        funnelId = existing[0].id;
+    }
+    const rawSlug = flags.slug || 'join';
+    const slug = rawSlug.startsWith('/') ? rawSlug.slice(1) : rawSlug;
+    if (!/^[a-z0-9][a-z0-9-]{0,40}$/i.test(slug)) {
+        error(`Invalid --slug "${slug}". Lowercase letters/digits/hyphens, 1-41 chars, starts with a letter or digit.`);
+    }
+    // `--fields email:required,name,phone:tel,plan:text:required`
+    const fieldsArg = (flags.fields || 'email:email:required').trim();
+    const fieldSpecs = fieldsArg.split(',').map(s => s.trim()).filter(Boolean).map(parseField);
+    if (fieldSpecs.length === 0)
+        error('--fields must list at least one field. Example: --fields email:required,name');
+    // Honeypot field — match the backend default unless --honeypot overrides.
+    const honeypot = flags.honeypot || 'middle_name';
+    if (!/^[a-z][a-z0-9_]*$/i.test(honeypot))
+        error(`Invalid --honeypot "${honeypot}".`);
+    for (const f of fieldSpecs)
+        if (f.name === honeypot)
+            error(`Honeypot "${honeypot}" collides with a real field. Pick a different --honeypot name.`);
+    const cta = flags.cta || 'Sign up';
+    const successMsg = flags.success || "Thanks — we'll be in touch.";
+    // Optional binding via --capture-to.
+    let registeredBinding;
+    if (typeof flags['capture-to'] === 'string' && flags['capture-to']) {
+        const dest = parseCaptureTo(flags['capture-to']);
+        const binding = {
+            slug,
+            destination: `${dest.kind}:${dest.id}`,
+            fields: fieldSpecs.map(f => ({ name: f.name, required: f.required })),
+            honeypot_field: honeypot,
+        };
+        registeredBinding = await sdkFunnel.createFormBinding(config.api_key, orgId, funnelId, binding);
+    }
+    const url = `https://api.myapihq.com/funnel/funnels/${funnelId}/submit/${encodeURIComponent(slug)}`;
+    const escAttr = (s) => s.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    const escText = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    // Per-field labels — Email uses the canonical placeholder; others
+    // Title-Case the name.
+    const inputs = fieldSpecs.map(f => {
+        const label = f.name.charAt(0).toUpperCase() + f.name.slice(1).replace(/_/g, ' ');
+        const req = f.required ? ' required' : '';
+        return `  <label>${escText(label)} <input type="${f.type}" name="${escAttr(f.name)}"${req}></label>`;
+    }).join('\n');
+    // Honeypot — hidden via inline style, off the tab order, autocomplete
+    // disabled. Bots fill it; humans don't.
+    const honeypotInput = `  <input type="text" name="${escAttr(honeypot)}" style="display:none" tabindex="-1" autocomplete="off">`;
+    const html = `<form action="${escAttr(url)}" method="POST" data-myapi-form>
+${inputs}
+${honeypotInput}
+  <button type="submit">${escText(cta)}</button>
+</form>
+<script>
+document.querySelectorAll('[data-myapi-form]').forEach(f => {
+  f.addEventListener('submit', async e => {
+    e.preventDefault();
+    const r = await fetch(f.action, { method:'POST', headers:{'Content-Type':'application/json'},
+      body: JSON.stringify(Object.fromEntries(new FormData(f))) });
+    if (r.ok) f.outerHTML = ${JSON.stringify(`<p>${escText(successMsg)}</p>`)};
+  });
+});
+</script>`;
+    if (flags.json) {
+        printJson({
+            action_url: url,
+            slug,
+            fields: fieldSpecs,
+            honeypot_field: honeypot,
+            binding_registered: !!registeredBinding,
+            binding: registeredBinding,
+            html,
+        });
+        return;
+    }
+    if (registeredBinding) {
+        // Print confirmation on stderr so stdout stays the clean snippet.
+        process.stderr.write(`✓ Registered form binding: slug=${slug} → ${registeredBinding.destination}\n`);
+    }
+    process.stdout.write(html + '\n');
+}
 // Verify uses the same shape as push: slug positional (default '/'), funnel
 // resolved from --funnel / default / the org's only funnel.
 export async function verify(slug, flags) {
@@ -260,10 +396,51 @@ export async function publish(dir, flags) {
 }
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    'list': 'myapi funnel list [--org <id>] [--json]',
     'create': 'myapi funnel create [--name <name>] [--org <id>]',
-    'get': 'myapi funnel get <id> [--org <id>] [--json]',
     'delete': 'myapi funnel delete <id> [--org <id>]',
+    'form': `myapi funnel form [funnel-id] [--slug <slug>] [--fields <spec>]
+       [--capture-to <dest>] [--honeypot <name>]
+       [--cta "<button text>"] [--success "<message>"] [--org <id>] [--json]
+
+Emits a ready-to-paste HTML snippet for a form that posts to the canonical
+funnel submit proxy. Submissions to any slug fall through to the funnel's
+auto-provisioned webhook by default (CRM ingest + bound workflows fire
+without further wiring). The proxy URL is platform-stable; slug names the
+form so workflows can route on it; an auto-honeypot field stops casual
+bots.
+
+  --slug <s>          Form identifier — appears in the proxy URL.
+                      Defaults to "join". Lowercase letters/digits/hyphens.
+  --fields <spec>     Comma-separated field specs.
+                      Each spec: <name>[:<type>][:required] (modifiers
+                      order-free). Types: text (default), email, number,
+                      tel. Name auto-promotes to email if name="email",
+                      to tel if name="phone" or "tel".
+                      Defaults to "email:email:required".
+  --capture-to <dest> Optional. Register a per-slug binding to the
+                      destination via POST /funnel/.../forms. Format:
+                      webhook:<uuid> or workflow:<uuid>. Without it,
+                      submissions fall through to the funnel's default
+                      webhook (most agents want this).
+  --honeypot <name>   Hidden bot-trap input name. Default "middle_name".
+  --cta "<text>"      Submit button text. Defaults to "Sign up".
+  --success "<text>"  Message shown on successful submit.
+
+Examples:
+  myapi funnel form                                        # email-required on default funnel
+  myapi funnel form --slug waitlist --fields email:required,name
+  myapi funnel form <funnel> --slug checkout \\
+    --fields email:required,plan,phone:tel \\
+    --capture-to webhook:<checkout_webhook_id>
+  myapi funnel form --json                                 # machine-readable
+  myapi funnel form --slug join > form.html                # snippet to a file
+
+Do NOT hardcode webhook inbound URLs into funnel HTML. Use this verb
+instead — the proxy preserves slug routing, hides the URL, and gets
+future platform features (rate-limit, captcha, field validation) for
+free.`,
+    'get': 'myapi funnel get <id> [--org <id>] [--json]',
+    'list': 'myapi funnel list [--org <id>] [--json]',
     'pages': 'myapi funnel pages [funnel_id] [--funnel <id>] [--org <id>] [--json]',
     'publish': `myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--api-fn <id>] [--org <id>]
 
@@ -314,6 +491,7 @@ export async function run(subcommand, args, flags) {
 Subcommands:
   create     Create a funnel (optional --name; backend defaults to org's preview_subdomain)
   delete     Delete a funnel
+  form       Emit HTML for a form that posts to the canonical submit proxy
   get <id>   Get funnel details
   list       List funnels
   pages      List the pages currently published to a funnel
@@ -333,14 +511,15 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
     }
     switch (subcommand) {
-        case 'list': return list(flags);
         case 'create': return create(flags);
-        case 'get': return get(args[0], flags);
         case 'delete': return del(args[0], flags);
+        case 'form': return formCmd(args[0], flags);
+        case 'get': return get(args[0], flags);
+        case 'list': return list(flags);
+        case 'pages': return pages(args[0], flags);
         case 'publish': return publish(args[0], flags);
         case 'push': return push(args[0], flags);
         case 'verify': return verify(args[0], flags);
-        case 'pages': return pages(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi funnel --help" for a list of valid subcommands.`);
     }
 }

package/dist/commands/llm.js

@@ -7,6 +7,7 @@ export const EXPOSES = [
     'POST /llm/orgs/{org_id}/complete',
     'POST /llm/orgs/{org_id}/embed',
     'GET /llm/orgs/{org_id}/models',
+    'POST /llm/orgs/{org_id}/tasks/{verb}',
 ];
 export const SCHEMA = {
     org: 'string',
@@ -16,8 +17,36 @@ export const SCHEMA = {
     temperature: 'number',
     stop: 'string',
     file: 'string',
+    // verb-specific
+    labels: 'string',
+    multi: 'boolean',
+    schema: 'string',
+    style: 'string',
     kind: 'string',
+    context: 'string',
+    prompt: 'string',
+    tier: 'string',
 };
+// Cache the catalog once per CLI invocation so verbs (which don't take a
+// --model flag) can fall back to "the first chat model" without an extra
+// network round-trip per command.
+let cachedModels = null;
+async function loadModels(apiKey, orgId) {
+    if (cachedModels)
+        return cachedModels;
+    const res = await sdkLlm.listModels(apiKey, orgId);
+    cachedModels = res.models;
+    return cachedModels;
+}
+async function defaultChatModel(apiKey, orgId) {
+    const models = await loadModels(apiKey, orgId);
+    const chat = models.find(m => m.kind === 'chat');
+    if (!chat) {
+        error('No chat model available — run "myapi llm models" to inspect the catalog.');
+        throw new Error('unreachable'); // satisfy the type checker
+    }
+    return chat.id;
+}
 function readPromptArg(promptArg, flags) {
     if (typeof flags.file === 'string' && flags.file) {
         return fs.readFileSync(flags.file, 'utf-8');
@@ -27,11 +56,62 @@ function readPromptArg(promptArg, flags) {
     }
     return promptArg ?? '';
 }
-const DEFAULT_CHAT_MODEL = 'gemini-3.1-flash-lite-preview';
+function fmtCostCents(cents) {
+    // Sub-cent calls (the common case for short prompts) get four decimals so
+    // the footer stays informative — "0.0063¢" reads honestly as "less than a
+    // cent." Larger numbers collapse to two decimals.
+    return cents < 1 ? `${cents.toFixed(4)}¢` : `${cents.toFixed(2)}¢`;
+}
+function parseSchemaFlag(flags) {
+    if (typeof flags.schema !== 'string' || !flags.schema)
+        return null;
+    // Accept either a path to a JSON file or an inline JSON string.
+    let raw = flags.schema;
+    if (fs.existsSync(raw)) {
+        try {
+            raw = fs.readFileSync(raw, 'utf-8');
+        }
+        catch (e) {
+            error(`Could not read --schema file: ${e.message}`);
+        }
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        error('--schema must be valid JSON (inline) or a path to a JSON file');
+        return null;
+    }
+}
+function parseContextFlag(flags) {
+    if (typeof flags.context !== 'string' || !flags.context)
+        return undefined;
+    try {
+        const parsed = JSON.parse(flags.context);
+        if (typeof parsed === 'object' && parsed !== null)
+            return parsed;
+        error('--context must be a JSON object');
+        return undefined;
+    }
+    catch {
+        error('--context must be valid JSON');
+        return undefined;
+    }
+}
+function tierFromFlag(flags) {
+    if (typeof flags.tier !== 'string' || !flags.tier)
+        return undefined;
+    if (flags.tier === 'fast' || flags.tier === 'reasoning' || flags.tier === 'cheap')
+        return flags.tier;
+    error('--tier must be one of: fast, reasoning, cheap');
+}
+// ── raw ──────────────────────────────────────────────────────────────────
 async function complete(promptArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi llm complete "<prompt>" [--model <id>] [--system <s>] [--max-tokens N] [--temperature 0..1] [--stop <csv>] [--org <id>]');
-    const model = typeof flags.model === 'string' && flags.model ? flags.model : DEFAULT_CHAT_MODEL;
+    const model = typeof flags.model === 'string' && flags.model
+        ? flags.model
+        : await defaultChatModel(config.api_key, orgId);
     const prompt = readPromptArg(promptArg, flags);
     if (!prompt.trim())
         error('Empty prompt. Pass <prompt> as an argument, "-" to read stdin, or --file <path>.');
@@ -56,7 +136,7 @@ async function complete(promptArg, flags) {
     }
     info(res.content);
     // Usage footer on stderr so it doesn't pollute piped output.
-    process.stderr.write(`\n— ${res.model} · ${res.usage.input_tokens}+${res.usage.output_tokens} tokens · $${res.usage.cost_usd.toFixed(6)} · ${res.finish_reason}\n`);
+    process.stderr.write(`\n— ${res.model} · ${res.usage.input_tokens}+${res.usage.output_tokens ?? 0} tokens · ${fmtCostCents(res.usage.cost_cents)} · ${res.finish_reason}\n`);
 }
 async function embed(inputArg, flags) {
     const config = requireConfig();
@@ -73,7 +153,7 @@ async function embed(inputArg, flags) {
         return;
     }
     const first = res.embeddings[0] ?? [];
-    info(`${res.model} · dim=${first.length} · ${res.usage.input_tokens} tokens · $${res.usage.cost_usd.toFixed(6)}`);
+    info(`${res.model} · dim=${first.length} · ${res.usage.input_tokens} tokens · ${fmtCostCents(res.usage.cost_cents)}`);
     info(`first 5: [${first.slice(0, 5).map(n => n.toFixed(6)).join(', ')}${first.length > 5 ? ', ...' : ''}]`);
     info(`(pass --json for the full vector)`);
 }
@@ -90,49 +170,198 @@ async function listModels(flags) {
     printTable(models.map(m => ({
         id: m.id,
         kind: m.kind,
-        context: m.context ?? '',
+        context: m.context_window ?? '',
         dimensions: m.dimensions ?? '',
-        in_per_1m: `$${m.input_per_1m}`,
-        out_per_1m: m.output_per_1m != null ? `$${m.output_per_1m}` : '',
+        'in ¢/1M': m.input_cost_per_1m_cents,
+        'out ¢/1M': m.output_cost_per_1m_cents != null ? m.output_cost_per_1m_cents : '',
     })), { flags, empty: 'No models available.' });
 }
+// ── verbs ────────────────────────────────────────────────────────────────
+function printVerbFooter(usage) {
+    process.stderr.write(`\n— tier=${usage.tier_used} · ${usage.tokens_in}+${usage.tokens_out} tokens · ${fmtCostCents(usage.cost_cents)}\n`);
+}
+async function classify(inputArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi llm classify "<input>" --labels <csv> [--multi] [--tier <t>] [--org <id>]');
+    const input = readPromptArg(inputArg, flags);
+    if (!input.trim())
+        error('Empty input. Pass <input> as an argument, "-" to read stdin, or --file <path>.');
+    if (typeof flags.labels !== 'string' || !flags.labels) {
+        error('Missing required flag: --labels <comma-separated>');
+        return;
+    }
+    const labels = flags.labels.split(',').map(s => s.trim()).filter(Boolean);
+    if (labels.length === 0)
+        error('--labels must contain at least one label');
+    const multi = flags.multi === true;
+    const res = await sdkLlm.classify(config.api_key, orgId, { input, labels, multi, tier: tierFromFlag(flags) });
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    if (multi) {
+        const arr = res.data.labels ?? [];
+        info(arr.length ? arr.join(', ') : '(no matching labels)');
+    }
+    else {
+        info(res.data.label ?? '(no label)');
+    }
+    printVerbFooter(res.usage);
+}
+async function extract(inputArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi llm extract "<input>" --schema <path|json> [--tier <t>] [--org <id>]');
+    const input = readPromptArg(inputArg, flags);
+    if (!input.trim())
+        error('Empty input. Pass <input> as an argument, "-" to read stdin, or --file <path>.');
+    const schema = parseSchemaFlag(flags);
+    if (!schema) {
+        error('Missing required flag: --schema <path|json>');
+        return;
+    }
+    const res = await sdkLlm.extract(config.api_key, orgId, { input, schema, tier: tierFromFlag(flags) });
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    info(JSON.stringify(res.data.data, null, 2));
+    printVerbFooter(res.usage);
+}
+async function summarize(inputArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi llm summarize "<input>" [--style brief|exec|bullet] [--tier <t>] [--org <id>]');
+    const input = readPromptArg(inputArg, flags);
+    if (!input.trim())
+        error('Empty input. Pass <input> as an argument, "-" to read stdin, or --file <path>.');
+    const style = typeof flags.style === 'string' && flags.style ? flags.style : undefined;
+    if (style && !['brief', 'exec', 'bullet'].includes(style)) {
+        error('--style must be one of: brief, exec, bullet');
+    }
+    const res = await sdkLlm.summarize(config.api_key, orgId, {
+        input,
+        style: style,
+        tier: tierFromFlag(flags),
+    });
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    info(res.data.summary);
+    printVerbFooter(res.usage);
+}
+async function draft(inputArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi llm draft --kind <what> [--prompt "<instructions>"] [--context <json>] ["<source text>"] [--tier <t>] [--org <id>]');
+    if (typeof flags.kind !== 'string' || !flags.kind) {
+        error('Missing required flag: --kind <email|message|reply|...>');
+        return;
+    }
+    const input = readPromptArg(inputArg, flags);
+    const promptText = typeof flags.prompt === 'string' ? flags.prompt : '';
+    const ctx = parseContextFlag(flags);
+    if (!input.trim() && !promptText.trim() && (!ctx || Object.keys(ctx).length === 0)) {
+        error('draft needs at least one of: <source text> (arg or --file), --prompt, or --context.');
+    }
+    const res = await sdkLlm.draft(config.api_key, orgId, {
+        input: input || undefined,
+        kind: flags.kind,
+        context: ctx,
+        prompt: promptText || undefined,
+        tier: tierFromFlag(flags),
+    });
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    info(res.data.text);
+    printVerbFooter(res.usage);
+}
+// ── help ─────────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     complete: `myapi llm complete "<prompt>" [--model <id>]
        [--system "<system msg>"] [--max-tokens N] [--temperature 0..1]
        [--stop <csv>] [--file <path>] [--org <id>] [--json]
 
-  Default model: gemini-3.1-flash-lite-preview (cheap + fast). Pass --model
-  to override; run "myapi llm models" to see the catalog.
+  Raw chat completion against a self-hosted catalog model. Without --model,
+  picks the first chat model from "myapi llm models" (today:
+  Qwen/Qwen3-Coder-30B-A3B-Instruct).
 
-  Pass "-" as the prompt to read from stdin. The reply goes to stdout;
-  a one-line usage footer (tokens + cost) goes to stderr so it doesn't
-  pollute piped output.
+  Pass "-" as the prompt to read from stdin. The reply goes to stdout; a
+  one-line usage footer (tokens + cost in cents) goes to stderr so it
+  doesn't pollute piped output.
 
   Examples:
     myapi llm complete "summarize: $(cat README.md)"
-    cat draft.md | myapi llm complete - --model gemini-3.1-pro-preview --system "You are an editor"
-    myapi llm complete --file prompt.txt --max-tokens 200`,
+    cat draft.md | myapi llm complete - --system "You are an editor" --max-tokens 200`,
     embed: `myapi llm embed "<text>" --model <id> [--file <path>] [--org <id>] [--json]
 
-  Returns a vector summary by default; pass --json for the full vector.
+  No embedding model is served on the raw catalog today — this returns
+  EMBED_NOT_AVAILABLE until one is. Use a dedicated embedding API for now.`,
+    models: `myapi llm models [--kind chat|embed] [--org <id>] [--json]
+
+  Lists the live model catalog with per-1M-token pricing in cents.
+  The catalog reflects exactly what the inference gateway serves.`,
+    classify: `myapi llm classify "<input>" --labels <a,b,c> [--multi]
+       [--tier fast|reasoning|cheap] [--file <path>] [--org <id>] [--json]
+
+  Pick the best label (or with --multi, all applicable labels) from a set.
+  Output goes to stdout; usage footer to stderr.
 
   Examples:
-    myapi llm embed "the quick brown fox" --model gemini-embedding-001
-    myapi llm embed --file doc.txt --model gemini-embedding-001 --json > doc.vec.json`,
-    models: `myapi llm models [--kind chat|embed] [--org <id>] [--json]
+    myapi llm classify "I was charged twice and need a refund" \\
+      --labels billing,technical,sales,spam
+    cat email.txt | myapi llm classify - --labels urgent,bug,question --multi`,
+    extract: `myapi llm extract "<input>" --schema <path|json>
+       [--tier <t>] [--file <path>] [--org <id>] [--json]
+
+  Extract data from <input> conforming to a JSON Schema. --schema accepts
+  an inline JSON string OR a path to a .json file. Stdout is the extracted
+  JSON object.
+
+  Examples:
+    myapi llm extract "Acme Corp has 250 employees" \\
+      --schema '{"type":"object","properties":{"company":{"type":"string"},"employees":{"type":"integer"}}}'
+    myapi llm extract - --schema ./order.schema.json < order.eml`,
+    summarize: `myapi llm summarize "<input>" [--style brief|exec|bullet]
+       [--tier <t>] [--file <path>] [--org <id>] [--json]
 
-  Lists the model catalog with per-1M-token pricing at upstream rates.
-  Models prefixed with vendor name pass through to that vendor; un-prefixed
-  models (when available) run on MyAPI's own inference.`,
+  Summarize text. Default style 'brief' (1-2 sentences); 'exec' is a
+  decision-maker summary; 'bullet' is a short list.
+
+  Examples:
+    myapi llm summarize --file long-thread.txt --style bullet
+    cat report.md | myapi llm summarize - --style exec`,
+    draft: `myapi llm draft --kind <what> [--prompt "<instructions>"]
+       [--context '<json>'] ["<source text>"] [--file <path>]
+       [--tier <t>] [--org <id>] [--json]
+
+  Draft a piece of writing (email, reply, message, …). Provide at least one
+  of: <source text> (arg or --file), --prompt, or --context (JSON of facts).
+
+  Examples:
+    myapi llm draft --kind email \\
+      --prompt "Friendly welcome to the beta. Under 60 words." \\
+      --context '{"recipient":"a new signup","product":"MyAPI"}'
+    cat inbound.eml | myapi llm draft - --kind reply --prompt "Acknowledge and ask for the order ID"`,
 };
 export async function run(subcommand, args, flags) {
     if (!subcommand || (flags.help && !subcommand)) {
         info(`Usage: myapi llm <subcommand>
 
+Two surfaces:
+
+  Raw — you pick a self-hosted catalog model and shape the prompt yourself.
+  Verbs — you ask for a task done; the model is implementation detail and
+          is never named in the response.
+
 Subcommands:
-  complete   Chat completion — returns reply + usage (default model: gemini-3.1-flash-lite-preview)
-  embed      Text embedding — returns vector + usage
-  models     List available models (chat + embed) with pricing
+  classify    Pick a label from a set
+  complete    Raw chat completion against a catalog model
+  draft       Write something (email | reply | message | …)
+  embed       Raw embeddings (no model served on raw today)
+  extract     Pull structured data conforming to a JSON Schema
+  models      List the live model catalog (id, kind, context, cents/1M)
+  summarize   Summarize text (brief | exec | bullet)
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).
 Use this for workflow steps and scripted pipelines — not as a replacement
@@ -151,6 +380,10 @@ for your own reasoning. The agent has its own model already.`);
         case 'complete': return complete(args[0], flags);
         case 'embed': return embed(args[0], flags);
         case 'models': return listModels(flags);
+        case 'classify': return classify(args[0], flags);
+        case 'extract': return extract(args[0], flags);
+        case 'summarize': return summarize(args[0], flags);
+        case 'draft': return draft(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi llm --help" for valid subcommands.`);
     }
 }

package/dist/commands/queue.js

@@ -7,6 +7,7 @@ export const EXPOSES = [
     'POST /queue/orgs/{org_id}/queues',
     'GET /queue/orgs/{org_id}/queues',
     'GET /queue/orgs/{org_id}/queues/{name}',
+    'DELETE /queue/orgs/{org_id}/queues/{name}',
     'POST /queue/orgs/{org_id}/queues/{name}/jobs',
     'GET /queue/orgs/{org_id}/queues/{name}/jobs',
     'GET /queue/orgs/{org_id}/jobs/{id}',

package/dist/commands/workflow-validation.test.js

@@ -94,10 +94,19 @@ describe('_validateSteps — http_request / http (2026-05-15)', () => {
             .toMatch(/missing required field "url"/);
     });
     it('rejects non-http(s) URLs', () => {
+        // post-brutalize: real URL parse instead of prefix regex —
+        // /must use http:\/\/ or https:\/\/ scheme/  applies to anything
+        // that parses to a non-http(s) protocol (ftp, javascript, file,
+        // gopher, data, …); strings that don't parse as URLs at all get
+        // the separate "not a valid URL" message.
         expect(_validateSteps([{ ...VALID_HTTP, url: 'ftp://example.com' }]))
-            .toMatch(/must start with http:\/\/ or https:\/\//);
+            .toMatch(/must use http:\/\/ or https:\/\/ scheme/);
         expect(_validateSteps([{ ...VALID_HTTP, url: 'javascript:alert(1)' }]))
-            .toMatch(/must start with http:\/\/ or https:\/\//);
+            .toMatch(/must use http:\/\/ or https:\/\/ scheme/);
+        expect(_validateSteps([{ ...VALID_HTTP, url: 'file:///etc/passwd' }]))
+            .toMatch(/must use http:\/\/ or https:\/\/ scheme/);
+        expect(_validateSteps([{ ...VALID_HTTP, url: 'not a url' }]))
+            .toMatch(/is not a valid URL/);
     });
     it('rejects unknown HTTP methods', () => {
         expect(_validateSteps([{ ...VALID_HTTP, method: 'TRACE' }]))

package/dist/commands/workflow.js

@@ -91,8 +91,21 @@ export function _validateSteps(steps) {
             if (!s.url || typeof s.url !== 'string') {
                 return `${where} (${s.type}): missing required field "url".`;
             }
-            if (!/^https?:\/\//.test(s.url)) {
-                return `${where} (${s.type}): "url" must start with http:// or https:// — got "${s.url}".`;
+            // Real URL parse instead of prefix regex — catches javascript:,
+            // file:, gopher:, data:, and whitespace/null-byte hosts that pass
+            // /^https?:\/\// but fail proper parsing. Mirrors the scheme check
+            // on webhook.forward_url and queue.consumer_url; same shape as the
+            // SDK helper. The backend ALSO validates — see
+            // docs/cross-repo-prompts/backend-workflow-step-validation.md.
+            let parsedUrl;
+            try {
+                parsedUrl = new URL(s.url);
+            }
+            catch {
+                return `${where} (${s.type}): "url" is not a valid URL — got "${s.url}".`;
+            }
+            if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+                return `${where} (${s.type}): "url" must use http:// or https:// scheme — got "${parsedUrl.protocol}" in "${s.url}".`;
             }
             if (s.method !== undefined) {
                 if (typeof s.method !== 'string' || !HTTP_METHODS.has(s.method.toUpperCase())) {

package/dist/completion.js

@@ -49,7 +49,7 @@ export const SUBCOMMANDS = {
     people: ['search', 'get'],
     company: ['search', 'get'],
     audience: ['create', 'list', 'get', 'update', 'delete', 'members', 'refresh'],
-    llm: ['complete', 'embed', 'models'],
+    llm: ['complete', 'embed', 'models', 'classify', 'extract', 'summarize', 'draft'],
     database: ['namespaces', 'create', 'delete-namespace', 'keys', 'get', 'set', 'del'],
     crm: ['contacts', 'companies'],
     url: ['shorten'],

package/dist/skills/my-funnel-api/SKILL.md

@@ -17,7 +17,7 @@ Funnels are the publishing surface. You create a funnel under an org (one comman
 
 By default, your funnel lives on a free preview subdomain (`*.makeautonomous.com`) you get with every org. To serve on a custom domain, register and assign one via **mydomainapi** first.
 
-Every funnel includes two public proxy endpoints your HTML can call directly (no API key needed): a **form submit** endpoint that forwards POSTs to your org's webhook, and an **analytics/event ingest** for pageviews and click tracking.
+Every funnel auto-provisions a **webhook** at creation time (`org_webhook_id`). The funnel exposes two public proxy endpoints your HTML can call directly (no API key needed): a **form submit** at `POST /funnel/funnels/{id}/submit/{slug}` that delivers submissions through that webhook (CRM upsert + bound workflows fire automatically), and an **analytics/event ingest** for pageviews and click tracking. For multi-form funnels you can bind individual slugs to specific destinations with `myapi funnel form ... --capture-to webhook:<id>`.
 <!-- llm:end -->
 
 ## Commands
@@ -30,6 +30,7 @@ Every funnel includes two public proxy endpoints your HTML can call directly (no
 | `myapi funnel delete <id>` | Delete the funnel and purge its edge pages |
 | `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`) |
 | `myapi funnel pages [funnel_id]` | List the pages currently published to a funnel |
+| `myapi funnel form [funnel_id]` | Emit canonical form HTML (and register a binding with `--capture-to`) |
 | `myapi funnel verify [slug]` | Verify a published page is reachable + check links/webhooks |
 <!-- generated:end -->
 
@@ -58,12 +59,39 @@ myapi funnel delete <funnel_id>
 Omitting `[slug]` defaults to `/`. The funnel id is resolved from `--funnel`, the saved default funnel, or — only if the org has exactly one funnel — auto-picked.
 <!-- llm:end -->
 
-## Form Submissions & Analytics
+## Form submissions (canonical recipe)
 
-Funnels expose two public proxy endpoints your published HTML can hit directly (no API key needed):
+The funnel submit proxy is the canonical form-capture path. **Never hardcode `https://api.mywebhookapi.com/webhook/in/<slug>` into funnel HTML** — that URL leaks into your git history, breaks on rotation, gets scraped, and locks the platform out of future form-quality features (rate-limit, captcha, anti-bot, field validation). Use the proxy instead — same plumbing, hidden URL, automatic CRM ingest on `email`.
 
-- **Form submit:** `POST /funnel/funnels/{id}/submit/{slug}` — validates payload and forwards to your org's configured webhook.
-- **Analytics/tracking:** `POST /funnel/funnels/{id}/event` — proxies pageviews, clicks, and pixel events to your webhook. Rate-limited to 60 req/min per funnel.
+Zero-config form (the happy path most agents want):
+
+```bash
+myapi funnel create
+myapi funnel form --slug join --fields email:required,name > snippet.html
+# paste snippet.html into your page (or pipe through funnel push):
+cat page-with-snippet.html | myapi funnel push /
+# Submissions land in the funnel's auto-provisioned webhook → CRM upsert on `email` → any bound workflow fires.
+```
+
+Multi-form funnel (each slug to a different destination):
+
+```bash
+# Bind /checkout to a specific webhook:
+myapi funnel form <funnel_id> --slug checkout \
+  --fields email:required,plan,phone:tel \
+  --capture-to webhook:<checkout_webhook_id>
+
+# Bind /survey to a workflow directly:
+myapi funnel form <funnel_id> --slug survey \
+  --fields email:required,score:number \
+  --capture-to workflow:<survey_workflow_id>
+```
+
+`--capture-to` registers the per-slug binding via `POST /funnel/orgs/.../funnels/{id}/forms`. Without it, submissions fall through to the funnel's default webhook.
+
+## Analytics
+
+`POST /funnel/funnels/{id}/event` — public proxy for pageviews, clicks, and pixel events (no API key needed). Rate-limited to 60 req/min per funnel.
 
 ## Notes
 

package/dist/skills/my-llm-api/README.md

@@ -1,19 +1,29 @@
 # my-llm-api
 
-Provider-agnostic LLM completions and embeddings, billed at upstream cost. Today routes to Gemini; the model id is just a string, so additional providers land without breaking callers.
+Two-surface LLM primitive. Self-hosted open-source inference on the raw surface, objective verbs on the verb surface. Pricing is in cents per 1M tokens at upstream rate.
 
 ## What it does
 
-- **Chat completion** — messages array (role/content), get reply + usage + cost
-- **Embeddings** — single string or batch, returns vector(s) + usage
-- **Model catalog** — list available models with per-1M-token pricing
+Two surfaces, one credential, one balance:
+
+- **Raw** — `complete`, `embed`, `models`. You pick a self-hosted catalog model and shape the prompt yourself. Today's catalog: `Qwen/Qwen3-Coder-30B-A3B-Instruct` (1 chat model, no embed model). Proprietary models are not callable here — that's how MyAPI stays off the reseller framing.
+- **Verbs** — `classify`, `extract`, `summarize`, `draft`. You ask for a task done; the model is implementation detail and is never named in the response. This is where any future proprietary model lives, wrapped behind the verb contract.
 
 ## Quickstart
 
 ```bash
+# Catalog (live — reflects what the gateway actually serves)
 myapi llm models
-myapi llm complete "explain HMAC in two sentences"   # defaults to gemini-3.1-flash-lite-preview
-myapi llm embed "the quick brown fox" --model gemini-embedding-001
+
+# Raw — picks the first chat model from the catalog automatically
+myapi llm complete "explain HMAC in two sentences"
+
+# Verbs — recommended for workflow steps
+myapi llm classify "I want a refund" --labels billing,sales,support
+myapi llm extract "Acme Corp has 250 employees" \
+  --schema '{"type":"object","properties":{"company":{"type":"string"},"employees":{"type":"integer"}}}'
+myapi llm summarize --file long.md --style exec
+myapi llm draft --kind email --prompt "Friendly welcome, under 60 words"
 ```
 
 ## Authentication
@@ -26,10 +36,10 @@ Requires `api_key` and `org_id` from **myapihq**. Inference cost is debited from
 
 ## When to use
 
-This is the **workflow-step LLM** — use it inside scripted pipelines (summarize a doc, classify an email, embed text for similarity). It is **not** a replacement for your own reasoning if you're an agent; you already have a model.
+This is the **workflow-step LLM** — use it inside scripted pipelines (summarize a doc, classify an email, extract structured data, draft a reply). It is **not** a replacement for your own reasoning if you're an agent; you already have a model.
 
 ## Documentation
 
-Model catalog, message shapes, and cost semantics: see `SKILL.md`.
+Two-surface design, raw/verb shapes, and cost semantics: see `SKILL.md`.
 
 Run `myapi llm --help` for inline reference.

package/dist/skills/my-llm-api/SKILL.md

@@ -1,29 +1,39 @@
 ---
 name: my-llm-api
-version: 1.0.0
+version: 1.1.0
 description: >
-  Provider-agnostic LLM completions and embeddings, billed at upstream cost.
-  The model id is just a string — today routes to Gemini, more providers land
-  without breaking callers. Use this inside workflow steps and scripted
-  pipelines, not as a replacement for your own reasoning.
-triggers: [llm, completion, chat, embed, embedding, gemini, inference, summarize, classify, vector]
+  Two-surface LLM primitive. Raw chat completion against self-hosted
+  open-source models (you pick the model), and objective verbs
+  (classify / extract / summarize / draft) that hide the model behind a
+  task. Pricing in cents per 1M tokens; charged from your MyAPI balance.
+triggers: [llm, completion, chat, embed, embedding, inference, classify, extract, summarize, draft, qwen]
 checksum: sha256-pending
 ---
 
 # MyLLMAPI
 
-A thin, OpenAI-compatible-shape LLM gateway. Three endpoints: `complete` (chat), `embed` (vectors), `models` (catalog). Pricing is per-1M tokens at the upstream rate while we build our own inference; cost is debited from your MyAPI balance.
+A two-surface LLM gateway:
+
+- **Raw** — `complete` / `embed` / `models`. You pick a self-hosted catalog model (today: `Qwen/Qwen3-Coder-30B-A3B-Instruct`). Proprietary models are not callable here.
+- **Verbs** — `classify` / `extract` / `summarize` / `draft`. You ask for a task done; the model is implementation detail and is never named in the response.
+
+Pricing is in cents per 1M tokens at the actual upstream rate; cost is debited from your MyAPI balance.
 
 ## Capabilities
 <!-- llm:start -->
-Use this for workflow tasks — summarize a doc, classify an inbound email, embed text for similarity, expand a one-line prompt into structured copy. The reply goes to stdout; a one-line usage footer (tokens + cost + finish reason) goes to stderr, so `myapi llm complete ... | jq` and similar pipelines work as expected.
+Use this for workflow tasks — summarize a doc, classify an inbound email, extract structured data, draft a reply. The reply goes to stdout; a one-line usage footer (tokens + cost + finish reason) goes to stderr, so `myapi llm complete ... | jq` and similar pipelines work as expected.
+
+**Don't use this as your own model.** If you're an agent reading this, you already have a more capable model than what's exposed here. Reach for the LLM verbs when you're scripting a recurring step where a small/cheap model is the right tool — not for one-shot reasoning you can just do yourself.
 
-**Don't use this as your own model.** If you're an agent reading this, you already have a more capable model than what's exposed here. Reach for `llm complete` when you're scripting a recurring step where a small/cheap model is the right tool — not for one-shot reasoning that you can just do yourself.
+### Raw vs. verbs
 
-### Messages shape
+- **Raw `complete`** — full control: pick the model, build the `messages` array, set `max_tokens`/`temperature`/`stop`. Use when shape matters.
+- **Verbs** — you want a *result* (label, JSON, summary, draft). Use when you don't care which model runs underneath.
+
+### Raw `complete` request
 ```json
 {
-  "model": "gemini-3.1-flash-lite-preview",
+  "model": "Qwen/Qwen3-Coder-30B-A3B-Instruct",
   "messages": [
     { "role": "system", "content": "You are a terse editor." },
     { "role": "user",   "content": "Tighten this paragraph: ..." }
@@ -36,90 +46,109 @@ Use this for workflow tasks — summarize a doc, classify an inbound email, embe
 
 Roles: `system | user | assistant`. Multiple system messages collapse to one instruction. `max_tokens`, `temperature`, and `stop` are optional — per-model defaults apply.
 
-### Complete response
+### Raw `complete` response
 ```json
 {
-  "model": "gemini-3.1-flash-lite-preview",
+  "model": "Qwen/Qwen3-Coder-30B-A3B-Instruct",
   "content": "...assistant reply...",
   "finish_reason": "stop",
-  "usage": { "input_tokens": 42, "output_tokens": 87, "cost_usd": 0.000029 }
+  "usage": { "input_tokens": 42, "output_tokens": 87, "cost_cents": 0.029 }
 }
 ```
 
-`finish_reason` is typically `stop` (model returned naturally), `length` (hit max_tokens — increase if you need more), or `safety` (blocked).
+`finish_reason` is one of `stop` (normal), `length` (hit max_tokens), `filter` (blocked).
 
-### Embed response
-```json
-{
-  "model": "gemini-embedding-001",
-  "embeddings": [[-0.0226, 0.0118, ...]],
-  "usage": { "input_tokens": 5, "cost_usd": 0.0000007 }
-}
-```
+If `model` isn't in the self-hosted catalog the server returns `MODEL_NOT_IN_RAW_CATALOG` — that's the signal to use a verb instead, not to retry with a different `--model`.
+
+### Raw `embed`
 
-`embeddings` is always `number[][]` — even a single-string input returns a one-element array of vectors. Embed-only usage has no `output_tokens`.
+No embedding model is served on the raw catalog today; calls return `EMBED_NOT_AVAILABLE`. Use a dedicated embedding API for now.
 
 ### Model catalog
-- Chat models: `id`, `kind: 'chat'`, `context` (token window), `input_per_1m`, `output_per_1m`
-- Embed models: `id`, `kind: 'embed'`, `dimensions`, `input_per_1m`
+- Chat models: `id`, `kind: 'chat'`, `context_window`, `input_cost_per_1m_cents`, `output_cost_per_1m_cents`
+- Embed models: `id`, `kind: 'embed'`, `dimensions`, `input_cost_per_1m_cents`
+
+The catalog is **live** — it reflects what the inference gateway actually serves, refreshed every 15 minutes. Always query `models` rather than hard-coding ids.
+
+### Verb requests + responses
+
+Every verb takes an optional `tier` (`fast | reasoning | cheap`) — opaque routing hint, server picks the model. Response usage block is identical across verbs.
+
+| Verb | Request body | Response `data` |
+|---|---|---|
+| `classify` | `{ input, labels: string[], multi?: boolean, tier? }` | `{ label }` or `{ labels: string[] }` (when `multi`) |
+| `extract`  | `{ input, schema: <json-schema>, tier? }`              | `{ data: <object conforming to schema> }` |
+| `summarize`| `{ input, style?: 'brief'\|'exec'\|'bullet', tier? }`  | `{ summary }` |
+| `draft`    | `{ input?, kind: string, context?: object, prompt?: string, tier? }` | `{ text }` |
+
+Shared usage block on every verb:
+
+```json
+{ "tier_used": "fast", "tokens_in": 65, "tokens_out": 37, "cost_cents": 0.005 }
+```
+
+The model/provider is **never** named in the verb response. That's the point — the verb is the contract, the model is implementation.
 
-Today: `gemini-3.1-pro-preview`, `gemini-3.1-flash-lite-preview`, `gemini-embedding-001`. Catalog is live — always query `models` rather than hard-coding ids.
 <!-- llm:end -->
 
 ## Commands
 <!-- generated:start -->
 | Command | What it does |
 |---|---|
-| `myapi llm models [--kind chat\|embed] [--json]` | List available models with pricing |
-| `myapi llm complete "<prompt>" [--model <id>] [--system "<s>"] [--max-tokens N] [--temperature 0..1] [--stop <csv>] [--file <path>] [--json]` | Chat completion; reply to stdout, usage to stderr. Default model: `gemini-3.1-flash-lite-preview` |
-| `myapi llm embed "<text>" --model <id> [--file <path>] [--json]` | Embed a string; default render shows model + dim + first 5 values |
+| `myapi llm models [--kind chat\|embed] [--json]` | List the live model catalog with pricing (cents/1M) |
+| `myapi llm complete "<prompt>" [--model <id>] [--system "<s>"] [--max-tokens N] [--temperature 0..1] [--stop <csv>] [--file <path>] [--json]` | Raw chat completion; reply to stdout, usage to stderr. Defaults to the first chat model in the catalog |
+| `myapi llm embed "<text>" --model <id> [--json]` | Embed a string (no model served today — returns EMBED_NOT_AVAILABLE) |
+| `myapi llm classify "<input>" --labels <csv> [--multi] [--tier <t>] [--json]` | Pick a label from a set |
+| `myapi llm extract "<input>" --schema <path\|json> [--tier <t>] [--json]` | Pull structured data conforming to a JSON Schema |
+| `myapi llm summarize "<input>" [--style brief\|exec\|bullet] [--tier <t>] [--json]` | Summarize text |
+| `myapi llm draft --kind <what> [--prompt "<s>"] [--context <json>] ["<src>"] [--tier <t>] [--json]` | Draft an email / reply / message / … |
 <!-- generated:end -->
 
-Pass `-` as the prompt to read from stdin. Pass `--file <path>` to read a longer prompt from disk.
+Pass `-` as the prompt/input to read from stdin. Pass `--file <path>` to read longer content from disk.
 
 ## Examples
 <!-- llm:start -->
 ```bash
-# List the catalog
+# List the live catalog
 myapi llm models
-# Filter to embed-only
-myapi llm models --kind embed --json | jq '.models[].id'
+myapi llm models --kind chat --json | jq '.models[].id'
 
-# One-shot completion (default model = gemini-3.1-flash-lite-preview)
+# Raw completion — picks the first chat model from the catalog
 myapi llm complete "Summarize in 12 words: $(cat README.md)"
 
-# Override the model (e.g. when you need pro-tier quality)
-myapi llm complete "Polish this draft: ..." \
-  --model gemini-3.1-pro-preview \
-  --system "You are a terse copy editor" \
-  --max-tokens 300
+# Pin a specific model
+myapi llm complete "Refactor this function: ..." \
+  --model Qwen/Qwen3-Coder-30B-A3B-Instruct \
+  --system "You are a careful Go reviewer." \
+  --max-tokens 600
 
-# Read from stdin (useful in pipelines)
-cat email.txt | myapi llm complete - \
-  --system "Classify intent: support | sales | spam"
+# ── Verbs (recommended for workflow steps) ──────────────────────────────
 
-# Embed and save the vector
-myapi llm embed --file doc.txt --model gemini-embedding-001 --json \
-  > doc.vec.json
-```
+myapi llm classify "I was charged twice — please refund." \
+  --labels billing,technical,sales,spam
 
-### End-to-end recipe — classify inbound webhooks
-```bash
-# Pull the last delivery body, classify with a tiny model, route accordingly
-BODY=$(myapi webhook delivery <delivery_id> --json | jq -r '.body')
-INTENT=$(printf '%s' "$BODY" | myapi llm complete - \
-  --system 'Respond with one word: support, sales, or spam.' \
-  --max-tokens 5)
-echo "Routing $INTENT"
+myapi llm extract "Acme Corp employs 250 people in Berlin." \
+  --schema '{"type":"object","properties":{"company":{"type":"string"},"employees":{"type":"integer"}}}'
+
+myapi llm summarize --file long-thread.txt --style bullet
+
+myapi llm draft --kind email \
+  --prompt "Friendly welcome, under 60 words." \
+  --context '{"recipient":"a new signup","product":"MyAPI"}'
+
+# Classify + route an inbound webhook delivery
+BODY=$(myapi webhook delivery <id> --json | jq -r '.body')
+INTENT=$(printf '%s' "$BODY" | myapi llm classify - \
+  --labels support,sales,spam --json | jq -r '.data.label')
 ```
 <!-- llm:end -->
 
 ## Notes
 
-- **No upstream tokens involved.** MyAPI never holds your Gemini/OpenAI/Anthropic credentials — we hold ours, you pay us at-cost while we build our own inference. The model id is just a string; routing happens server-side.
-- **Latency.** Flash-lite ≈ 200–800ms first token. Pro ≈ 600ms–2s. Embeddings sub-second.
-- **Cost.** `usage.cost_usd` is the authoritative number — debited at upstream rate (no MyAPI markup today). Use this for cost-accounting in workflows.
-- **Streaming.** Not exposed yet — `complete` returns the full reply. Add streaming support when there's a use case that requires it.
-- **Bring-your-own-key.** Not supported by design. MyAPI's value here is unified billing + a stable API across providers; managing your upstream keys would defeat both.
-
-Run `myapi llm --help` for inline reference.
+- **`draft` context safety — what the platform does and doesn't do.** Every field in `context` is quoted into the prompt as referent data the model is told to incorporate.  Sensitive-named keys (`secret`, `api_key`, `password`, `token`, etc.) are **not** automatically redacted — if you pass `{"secret": "abc123"}`, the model may include `"abc123"` in the output.  The verb does two things on top:
+  - **Injection defense.** Keys named `instructions`, `system`, `system_prompt`, `prompt`, `override`, `directives`, and the JS prototype-pollution sentinels are stripped at the boundary and surfaced in `meta.warnings`; the model can't be hijacked through them.
+  - **Output guardrail.** After generation, every fact value (length ≥ 4) is substring-scanned in the output; matches surface under `meta.guardrails.facts_in_output: ["secret", "api_key", ...]`.  This is a **signal, not a redaction** — you see when a value landed in the body.
+  Rule of thumb: if a value must not appear in the output, **do not put it in `context`**.  Pass identifiers (recipient name, account id, topic) and let the prompt reference them indirectly; keep credentials, PII, and any internal-only metadata out of the body entirely.
+- **Self-hosted raw, server-picked verbs.** Raw runs on MyAPI's TPU; verbs route wherever the server picks (future proprietary models land here, wrapped behind the verb contract).
+- **Cost + latency.** `usage.cost_cents` is authoritative — no markup today. Qwen3-Coder-30B-A3B: 200–600ms to first token, 1–3s end-to-end on a few-hundred-token reply.
+- **Live catalog, no streaming, no BYOK.** Don't hard-code model ids — `models` is the source of truth (CLI picks if `--model` omitted). Full reply only.

package/dist/skills/my-webhook-api/SKILL.md

@@ -2,8 +2,8 @@
 name: my-webhook-api
 version: 1.0.0
 description: >
-  Inbound webhook endpoints. Receive HTTP POSTs from third parties (forms, Stripe, GitHub, etc.) and either inspect deliveries directly or wire them to a workflow.
-triggers: [webhook, inbound, receiver, form submission, stripe events, slack notification, delivery, payload, event ingest]
+  Inbound webhook endpoints for non-funnel sources — Stripe, GitHub, custom services. Funnel forms use the my-funnel-api proxy.
+triggers: [webhook, inbound, receiver, stripe events, github webhook, slack notification, delivery, payload, event ingest]
 checksum: sha256-pending
 ---
 
@@ -13,6 +13,8 @@ Per-org HTTP endpoints that accept inbound POSTs and durably store every deliver
 
 ## Capabilities
 <!-- llm:start -->
+**Scope: non-funnel inbound.** Use this for Stripe → MyAPI, GitHub → MyAPI, custom services → MyAPI, anything where an *external* system POSTs to you. **Funnel forms use the funnel proxy** (see `my-funnel-api`: `myapi funnel form ... --capture-to webhook:<id>` if you need to bind a specific destination; otherwise the funnel's auto-provisioned webhook handles it). Don't hardcode `api.mywebhookapi.com/webhook/in/<slug>` URLs into funnel HTML.
+
 Each endpoint has a unique inbound URL minted at create time. Anyone who knows the URL can POST to it; the body is stored verbatim along with headers and a timestamp. Deliveries are kept indefinitely (until you delete the endpoint).
 
 The inbound URL accepts **any JSON body** — no enforced schema, no required fields. Whatever you POST is what gets stored. Two consequences:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -24,12 +24,13 @@
     "check-coverage": "npm run build && node scripts/check-coverage.js",
     "check-coverage:live": "npm run build && node scripts/check-coverage.js --live",
     "update-schema": "node scripts/update-schema.js",
+    "lint:changelog": "node ../../scripts/lint-changelog.js",
+    "lint:help-order": "node scripts/lint-help-order.js",
     "lint:skills": "node scripts/lint-skills.js",
-    "lint:skills:strict": "node scripts/lint-skills.js --strict",
-    "lint:changelog": "node ../../scripts/lint-changelog.js"
+    "lint:skills:strict": "node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.3.6"
+    "@myapihq/sdk": "^1.3.8"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",