@myapihq/cli 1.3.8 → 1.3.11

package/dist/commands/account.d.ts

@@ -0,0 +1,6 @@
+import type { FlagSchema } from '../flags.js';
+import type { Flags } from '../helpers.js';
+import type { Exposes } from '../exposes.js';
+export declare const SCHEMA: FlagSchema;
+export declare const EXPOSES: Exposes;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/account.js

@@ -0,0 +1,75 @@
+// `myapi account` — account-scoped operations.
+//
+// Today: mailing-address (CAN-SPAM compliance for transactional email).
+// Future home for any other account-level reads/writes that don't fit
+// `billing` (which owns money) or `keys` (which owns auth credentials).
+import { hq as sdkHq } from '@myapihq/sdk';
+import { requireConfig } from '../config.js';
+import { success, error, info, printJson } from '../output.js';
+export const SCHEMA = {};
+export const EXPOSES = [
+    'GET /hq/account/mailing-address',
+    'PATCH /hq/account/mailing-address',
+];
+const SUBCOMMAND_USAGE = {
+    'mailing-address': `myapi account mailing-address                       Show current value (null if unset)
+myapi account mailing-address "<address>"            Set the mailing address
+
+The mailing address is required for transactional email (CAN-SPAM):
+\`email message send\` returns MAILING_ADDRESS_REQUIRED until this is set.
+Pass the full postal address as a single string — e.g.
+"123 Main St, Springfield, IL 62701, USA".`,
+};
+async function mailingAddress(args, flags) {
+    const config = requireConfig();
+    // Positional arg present → set. Absent → get.
+    const value = args[0];
+    if (value === undefined) {
+        const res = await sdkHq.getMailingAddress(config.api_key);
+        if (flags.json) {
+            printJson(res);
+            return;
+        }
+        if (res.mailing_address) {
+            info(`Mailing address: ${res.mailing_address}`);
+        }
+        else {
+            info('Mailing address: (not set)');
+            info('Set it with: myapi account mailing-address "<address>"');
+            info('Required for: myapi email message send (CAN-SPAM).');
+        }
+        return;
+    }
+    // Reject obviously bad inputs early — the backend would 400 anyway.
+    const trimmed = value.trim();
+    if (!trimmed) {
+        error('Mailing address must be a non-empty string. Example: "123 Main St, Springfield, IL 62701, USA".');
+    }
+    const res = await sdkHq.setMailingAddress(config.api_key, trimmed);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Mailing address set: ${res.mailing_address}`);
+}
+export async function run(subcommand, args, flags) {
+    if (!subcommand || (flags.help && !subcommand)) {
+        info(`Usage: myapi account <subcommand>
+
+Subcommands:
+  mailing-address    Get or set the account's mailing address (CAN-SPAM)`);
+        return;
+    }
+    if (flags.help) {
+        const usage = SUBCOMMAND_USAGE[subcommand];
+        if (usage)
+            info(`Usage: ${usage}`);
+        else
+            info(`Unknown subcommand: ${subcommand}. Run "myapi account --help" for the list.`);
+        return;
+    }
+    switch (subcommand) {
+        case 'mailing-address': return mailingAddress(args, flags);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi account --help" for the list.`);
+    }
+}

package/dist/commands/config.js

@@ -51,8 +51,8 @@ export async function setFunnel(id, _flags, via = 'auth config') {
     if (!orgId)
         error('No default organization set. Run: myapi auth config set-org <id>');
     info('› Validating…');
-    const rawFunnel = await sdkFunnel.getFunnel(config.api_key, orgId, id);
-    const funnelId = rawFunnel.funnel?.id ?? rawFunnel.id;
+    const { funnel } = await sdkFunnel.getFunnel(config.api_key, orgId, id);
+    const funnelId = funnel.id;
     config.default_funnel = funnelId;
     saveConfig(config);
     success(`Default funnel set to: ${funnelId}`);

package/dist/commands/doctor-setup.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/doctor-setup.test.js

@@ -0,0 +1,74 @@
+// Unit tests for the doctor's `setup` section augmentation (2026-06-05).
+// Exercises the re-interpretation of backend sections — when the
+// `domains` or `emails` sections come back empty (zero-state), the
+// `setup` augmentation should escalate to actionable warns.
+import { describe, it, expect } from 'vitest';
+import { _setupSection } from './doctor.js';
+function mkReport(sections) {
+    return {
+        org_id: 'org-test',
+        generated_at: '2026-06-05T00:00:00Z',
+        sections,
+        totals: { ok: 0, warn: 0, crit: 0 },
+    };
+}
+function empty(name) {
+    return { name, summary: 'no resources', issues: [] };
+}
+function populated(name) {
+    return { name, summary: 'all checks passed', issues: [{
+                id: 'x', severity: 'ok', scope: name, message: 'something',
+            }] };
+}
+describe('_setupSection', () => {
+    it('returns null when both domains + emails sections are populated', () => {
+        expect(_setupSection(mkReport([populated('domains'), populated('emails')]))).toBeNull();
+    });
+    it('emits both warns when both sections are empty', () => {
+        const s = _setupSection(mkReport([empty('domains'), empty('emails')]));
+        expect(s).not.toBeNull();
+        expect(s.issues.map(i => i.severity)).toEqual(['warn', 'warn']);
+        expect(s.issues[0].message).toMatch(/No domain registered/);
+        expect(s.issues[1].message).toMatch(/No email inbox configured/);
+        expect(s.summary).toBe('2 setup gaps');
+    });
+    it('emits one warn when only emails is empty', () => {
+        const s = _setupSection(mkReport([populated('domains'), empty('emails')]));
+        expect(s).not.toBeNull();
+        expect(s.issues).toHaveLength(1);
+        expect(s.issues[0].scope).toBe('setup/email-inbox');
+        expect(s.summary).toBe('1 setup gap');
+    });
+    it('emits one warn when only domains is empty', () => {
+        const s = _setupSection(mkReport([empty('domains'), populated('emails')]));
+        expect(s).not.toBeNull();
+        expect(s.issues).toHaveLength(1);
+        expect(s.issues[0].scope).toBe('setup/domain');
+    });
+    it('returns null when the backend omits both sections entirely', () => {
+        // If a future backend drops these sections, we shouldn't fabricate
+        // warns out of nothing. Silence is the safe default.
+        expect(_setupSection(mkReport([populated('funnels')]))).toBeNull();
+    });
+    it('attaches actionable hints', () => {
+        const s = _setupSection(mkReport([empty('domains'), empty('emails')]));
+        expect(s.issues[0].hint).toMatch(/myapi domain register/);
+        expect(s.issues[1].hint).toMatch(/myapi email mailbox create/);
+    });
+    it('emits a mailing-address warn when ctx.mailingAddress is null', () => {
+        const s = _setupSection(mkReport([populated('domains'), populated('emails')]), { mailingAddress: null });
+        expect(s).not.toBeNull();
+        expect(s.issues).toHaveLength(1);
+        expect(s.issues[0].scope).toBe('setup/mailing-address');
+        expect(s.issues[0].hint).toMatch(/myapi account mailing-address/);
+    });
+    it('does NOT emit mailing-address warn when set', () => {
+        const s = _setupSection(mkReport([populated('domains'), populated('emails')]), { mailingAddress: '1 Test St, Paris' });
+        expect(s).toBeNull();
+    });
+    it('stays silent when mailing-address fetch failed (undefined)', () => {
+        // undefined = "unknown, infra blip" — don't false-alarm.
+        const s = _setupSection(mkReport([populated('domains'), populated('emails')]), { mailingAddress: undefined });
+        expect(s).toBeNull();
+    });
+});

package/dist/commands/doctor.d.ts

@@ -1,6 +1,11 @@
+import { hq as sdkHq } from '@myapihq/sdk';
 import type { FlagSchema } from '../flags.js';
 import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+export interface SetupContext {
+    mailingAddress?: string | null;
+}
+export declare function _setupSection(report: sdkHq.DoctorReport, ctx?: SetupContext): sdkHq.DoctorSection | null;
 export declare function run(_subcommand: string | undefined, _args: string[], flags: Flags): Promise<void>;

package/dist/commands/doctor.js

@@ -27,6 +27,8 @@ export const EXPOSES = [
     'GET /container/orgs/{org_id}/containers',
     'GET /funnel/orgs/{org_id}/funnels',
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
+    // Best-effort read for the setup-gap mailing_address check (CAN-SPAM).
+    'GET /hq/account/mailing-address',
 ];
 export const SCHEMA = {};
 const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
@@ -58,6 +60,54 @@ function fmtIssue(i) {
     const head = `  ${MARK[i.severity] ?? '·'} ${label}${i.message}`;
     return i.hint ? `${head}\n    ${C.dim}→ ${i.hint}${C.reset}` : head;
 }
+export function _setupSection(report, ctx = {}) {
+    const byName = new Map();
+    for (const s of report.sections)
+        byName.set(s.name, s);
+    const issues = [];
+    const dom = byName.get('domains');
+    if (dom && dom.issues.length === 0) {
+        issues.push({
+            id: localIssueId('setup_no_domain', report.org_id),
+            severity: 'warn',
+            scope: 'setup/domain',
+            category: 'setup',
+            message: 'No domain registered for this org',
+            hint: 'Register one with: myapi domain register <domain> && myapi domain assign <domain>',
+        });
+    }
+    const em = byName.get('emails');
+    if (em && em.issues.length === 0) {
+        issues.push({
+            id: localIssueId('setup_no_mailbox', report.org_id),
+            severity: 'warn',
+            scope: 'setup/email-inbox',
+            category: 'setup',
+            message: 'No email inbox configured',
+            hint: 'Create one with: myapi email mailbox create <username>@<your-domain>',
+        });
+    }
+    // Account-scoped (so use report.org_id only for the dedup id, not as
+    // entity scope). Hard-gates every transactional `email send` —
+    // backend returns MAILING_ADDRESS_REQUIRED until set.
+    if (ctx.mailingAddress === null) {
+        issues.push({
+            id: localIssueId('setup_no_mailing_address', report.org_id),
+            severity: 'warn',
+            scope: 'setup/mailing-address',
+            category: 'setup',
+            message: 'Account has no mailing address (CAN-SPAM)',
+            hint: 'Set one with: myapi account mailing-address "<full postal address>"',
+        });
+    }
+    if (issues.length === 0)
+        return null;
+    return {
+        name: 'setup',
+        summary: `${issues.length} setup gap${issues.length === 1 ? '' : 's'}`,
+        issues,
+    };
+}
 // Local DNS-resolution probe for every distinct domain the report names.
 // The backend can verify domain provisioning state from its own egress;
 // this checks whether the operator's network reaches them today — a
@@ -207,7 +257,26 @@ export async function run(_subcommand, _args, flags) {
         error(`doctor endpoint failed: ${e?.message ?? String(e)}`);
     }
     // Local augmentation, appended after the backend's sections by design —
-    // see the file header on why client-observed checks stay grouped at the end.
+    // see the file header on why client-observed checks stay grouped at the
+    // end. `setup` re-interprets the backend's own sections (zero-state →
+    // warn) and comes first; `local network` + `reachability` are liveness
+    // probes that follow.
+    //
+    // Best-effort fetch the account-scoped mailing_address — `null` if
+    // unset, `undefined` if the call fails (transient / permissions / 404
+    // on older backends). `null` triggers the warn; `undefined` is silent
+    // so we don't false-alarm on infra blips.
+    let mailingAddress;
+    try {
+        const res = await sdkHq.getMailingAddress(apiKey);
+        mailingAddress = res?.mailing_address ?? null;
+    }
+    catch {
+        mailingAddress = undefined;
+    }
+    const setup = _setupSection(report, { mailingAddress });
+    if (setup)
+        report.sections.push(setup);
     const localSection = await dnsProbeSection(report);
     if (localSection)
         report.sections.push(localSection);
@@ -266,6 +335,9 @@ Sections returned by the backend today:
   funnels, webhooks, workflows, domains, containers, emails, payments
 
 Local additions:
+  setup         — Flags zero-state config the backend currently reports as
+                  "no resources": no domain registered, no email inbox.
+                  Warnings, not critical — the org may not need them yet.
   local network — DNS resolution from your egress for each domain mentioned.
   reachability  — HTTP GET to every container URL and funnel page; surfaces
                   the status code. Failures are warnings, never critical —

package/dist/commands/domain.d.ts

@@ -13,6 +13,7 @@ export declare function unassign(domainArg: string, flags: Flags): Promise<void>
 export declare function status(domainArg: string, flags: Flags): Promise<void>;
 export declare function emailSetup(domainArg: string, flags: Flags): Promise<void>;
 export declare function retryProvisioning(domainArg: string, flags: Flags): Promise<void>;
+export declare function mailServerResync(domainArg: string, flags: Flags): Promise<void>;
 export declare function settings(domainArg: string, flags: Flags): Promise<void>;
 export declare function updateSettings(domainArg: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/domain.js

@@ -1,4 +1,4 @@
-import { domain as sdkDomain } from '@myapihq/sdk';
+import { domain as sdkDomain, email as sdkEmail } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, info, printTable, printJson } from '../output.js';
 import { formatDate } from '../utils.js';
@@ -16,6 +16,12 @@ export const EXPOSES = [
     'GET /domain/orgs/{org_id}/{domain}/status',
     'POST /domain/orgs/{org_id}/{domain}/email-infra',
     'POST /domain/orgs/{org_id}/{domain}/retry-provisioning',
+    // Mail-server (Stalwart) reprovisioning — distinct from DNS/cert
+    // retry-provisioning above. Call when mailbox-create returns
+    // DOMAIN_NOT_MAIL_READY / MAILBOX_PROVISION_FAILED, or when inbox
+    // reads return "mail server error" on a domain whose
+    // email_infra_ready=true.
+    'POST /email/orgs/{org_id}/domains/{domain}/mail-server-resync',
     'GET /domain/orgs/{org_id}/{domain}/records',
     'POST /domain/orgs/{org_id}/{domain}/records',
     'GET /domain/orgs/{org_id}/{domain}/records/{record_id}',
@@ -312,6 +318,24 @@ export async function retryProvisioning(domainArg, flags) {
         info(res.next_step);
     info(`Track with: myapi domain status ${domain} --watch`);
 }
+// Re-runs mail-server (Stalwart) provisioning for a domain. Distinct from
+// retry-provisioning above — that re-runs the DNS / cert side; this one
+// re-runs the IMAP/SMTP / mail-store side. Idempotent. Use when:
+//   - `email mailbox create` returns DOMAIN_NOT_MAIL_READY / MAILBOX_PROVISION_FAILED
+//   - `email message inbox <addr>` returns "mail server error" on a domain
+//     whose `email_infra_ready=true` according to `domain list`.
+export async function mailServerResync(domainArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain mail-server-resync <domain> [--org <id>]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain mail-server-resync <domain> [--org <id>]');
+    const res = await sdkEmail.mailServerResync(config.api_key, orgId, domain);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Mail-server resync triggered for ${domain}`);
+    info('Retry mailbox-create / inbox reads in a few seconds.');
+}
 export async function settings(domainArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi domain settings <domain> [--org <id>]');
@@ -591,6 +615,17 @@ Re-runs domain provisioning when status=infra_error and error_detail.retryable=t
 The CLI surfaces the retry hint automatically when status renders infra_error.
 
 After triggering retry, poll: myapi domain status <domain> --watch`,
+    'mail-server-resync': `myapi domain mail-server-resync <domain> [--org <id>]
+
+Re-runs the mail-server (Stalwart) provisioning for a domain. Distinct
+from "retry-provisioning" — that re-runs the DNS / cert side; this one
+re-runs the IMAP / SMTP / mail-store side. Idempotent.
+
+Use when:
+  - "email mailbox create" returns DOMAIN_NOT_MAIL_READY or MAILBOX_PROVISION_FAILED
+  - "email message inbox <addr>" returns "mail server error" but
+    "domain list" shows email_infra_ready=true for that domain
+  - The fix-path called out in backend-email-postdeploy-findings-2026-06-05`,
     'update-settings': `myapi domain update-settings <domain> [--security=<level>] [--browser-check=on|off] [--purge-cache] [--org <id>]
 
   --security=<level>       essentially_off | low | medium | high | under_attack  (default: medium)
@@ -610,6 +645,7 @@ Subcommands:
   email-setup      Opt in to MyAPI-managed email on a subdomain (default: mail.<domain>)
   import           Bring your own domain (BYOD) — registrar-agnostic
   list             List domains
+  mail-server-resync  Re-run Stalwart mail-server provisioning for a domain (fixes inbox/create on broken domains)
   records          Manage DNS records in the zone (list / get / create / update / delete)
   register         Register a domain
   renew            Renew a registered domain for another period
@@ -643,6 +679,7 @@ Tip: Set defaults with "myapi config set-org <id>" / "set-domain <domain>" to sk
         case 'update-settings': return updateSettings(args[0], flags);
         case 'records': return recordsRun(args[0], args.slice(1), flags);
         case 'email-setup': return emailSetup(args[0], flags);
+        case 'mail-server-resync': return mailServerResync(args[0], flags);
         case 'retry-provisioning': return retryProvisioning(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi domain --help" for a list of valid subcommands.`);
     }

package/dist/commands/email/mailbox.js

@@ -4,6 +4,7 @@ import { success, error, printTable, info } from '../../output.js';
 export const EXPOSES = [
     'POST /email/mailboxes/create',
     'GET /email/mailboxes',
+    'DELETE /email/mailboxes/{address}',
     'PUT /email/mailboxes/{address}/forwarding',
     'DELETE /email/mailboxes/{address}/forwarding',
     'POST /email/sending/activate',
@@ -70,6 +71,17 @@ async function clearForwarding(address, _flags) {
     await sdkEmail.deleteForwarding(config.api_key, address);
     success(`Forwarding cleared for ${address}`);
 }
+async function del(address, _flags) {
+    const config = requireConfig();
+    if (!address)
+        error('Missing required arguments.\nUsage: myapi email mailbox delete <user@domain>');
+    // Backend is idempotent — 204 whether or not the mailbox existed. So we
+    // don't pre-check existence; just call delete and report success. The
+    // 409 MAILBOX_IN_USE case bubbles up as an API error with a clear
+    // pointer to pause the campaign first.
+    await sdkEmail.deleteMailbox(config.api_key, address);
+    success(`Mailbox deleted: ${address}`);
+}
 const USAGE = {
     'create': `myapi email mailbox create <user@domain> [--display-name <name>]
        myapi email mailbox create --username <u> --domain <d> [--display-name <name>]
@@ -83,6 +95,11 @@ matches the rest of the CLI ("first required arg is positional").`,
                         org (orphaned mailboxes — domain was unassigned
                         without first deleting them).`,
     'activate-sending': 'myapi email mailbox activate-sending --address <email>',
+    'delete': `myapi email mailbox delete <user@domain>
+
+Idempotent — returns success whether or not the mailbox existed.
+Refuses with MAILBOX_IN_USE when an active or paused campaign still
+sends from this address; pause/delete the campaign first.`,
     'set-forwarding': `myapi email mailbox set-forwarding <user@domain> <forward-to@domain>
 
 Redirects a copy of every incoming message to an external address
@@ -97,6 +114,7 @@ Subcommands:
   activate-sending   Activate outbound sending for a mailbox
   clear-forwarding   Stop forwarding for a mailbox
   create             Create a mailbox (positional <user@domain> or --username/--domain)
+  delete             Delete a mailbox (idempotent; rejects if a campaign still uses it)
   list               List mailboxes on a domain (--domain) or orphaned ones (--filter unassigned)
   set-forwarding     Forward a copy of incoming mail to an external address`);
         return;
@@ -112,6 +130,7 @@ Subcommands:
     switch (sub) {
         case 'create': return create(args[0], flags);
         case 'list': return list(flags);
+        case 'delete': return del(args[0], flags);
         case 'activate-sending': return activateSending(flags);
         case 'set-forwarding': return setForwarding(args[0], args[1], flags);
         case 'clear-forwarding': return clearForwarding(args[0], flags);

package/dist/commands/funnel.js

@@ -83,16 +83,12 @@ export async function get(id, flags) {
     const orgId = requireOrg(flags, config, 'myapi funnel get <id> [--org <id>]');
     if (!id)
         error('Missing required arguments.\nUsage: myapi funnel get <id> [--org <id>]');
-    const raw = await sdkFunnel.getFunnel(config.api_key, orgId, id);
-    // Backend response shape varies between two layouts:
-    //   1) { funnel: {...}, subdomain_url, domain_url }    (newer, wrapped)
-    //   2) { id, ..., subdomain_url, domain_url }          (older, flat)
-    // Coalesce both so this works regardless of which shape we get back.
-    const funnel = raw.funnel ?? raw;
-    const subdomain_url = raw.subdomain_url ?? funnel.subdomain_url;
-    const domain_url = raw.domain_url ?? funnel.domain_url;
+    // SDK normalizes the wire shape to the wrapped envelope. `--json`
+    // still emits the envelope (back-compat: legacy consumers parse it).
+    const result = await sdkFunnel.getFunnel(config.api_key, orgId, id);
+    const { funnel, subdomain_url, domain_url } = result;
     if (flags.json) {
-        printJson(raw);
+        printJson(result);
         return;
     }
     info(`ID:          ${funnel.id}`);
@@ -104,8 +100,8 @@ export async function get(id, flags) {
         info(`Created:     ${formatDate(funnel.created_at)}`);
     if (funnel.updated_at)
         info(`Updated:     ${formatDate(funnel.updated_at)}`);
-    if (Array.isArray(funnel.pages))
-        info(`Pages:       ${funnel.pages.length}`);
+    // `pages` isn't part of the typed Funnel; backend doesn't include it
+    // here (use `myapi funnel pages` for that). Drop the inline count.
 }
 export async function del(id, flags) {
     const config = requireConfig();
@@ -256,10 +252,32 @@ export async function formCmd(funnelArg, flags) {
             error(`Honeypot "${honeypot}" collides with a real field. Pick a different --honeypot name.`);
     const cta = flags.cta || 'Sign up';
     const successMsg = flags.success || "Thanks — we'll be in touch.";
-    // Optional binding via --capture-to.
+    // Resolve the binding destination.
+    //
+    // Without a binding, the backend falls submissions through to the
+    // funnel's default webhook with NO honeypot / field validation. That
+    // makes the on-page honeypot purely cosmetic and lets trivial bots
+    // write to your CRM. So: always register a binding. When
+    // `--capture-to` is omitted, target the funnel's auto-provisioned
+    // `org_webhook_id` — same destination as the fallback, just with
+    // server-side guards turned on. Backend POST upserts on duplicate
+    // slug, so re-runs are safe.
     let registeredBinding;
+    let autoBound = false;
+    let dest = null;
     if (typeof flags['capture-to'] === 'string' && flags['capture-to']) {
-        const dest = parseCaptureTo(flags['capture-to']);
+        dest = parseCaptureTo(flags['capture-to']);
+    }
+    else {
+        const { funnel } = await sdkFunnel.getFunnel(config.api_key, orgId, funnelId);
+        if (funnel.org_webhook_id) {
+            dest = { kind: 'webhook', id: funnel.org_webhook_id };
+            autoBound = true;
+        }
+        // Legacy funnels migrated before 2026-06-03 may briefly lack
+        // org_webhook_id — emit the HTML without a binding and warn.
+    }
+    if (dest) {
         const binding = {
             slug,
             destination: `${dest.kind}:${dest.id}`,
@@ -310,7 +328,13 @@ document.querySelectorAll('[data-myapi-form]').forEach(f => {
     }
     if (registeredBinding) {
         // Print confirmation on stderr so stdout stays the clean snippet.
-        process.stderr.write(`✓ Registered form binding: slug=${slug} → ${registeredBinding.destination}\n`);
+        const tag = autoBound ? ' (auto, default webhook)' : '';
+        process.stderr.write(`✓ Registered form binding: slug=${slug} → ${registeredBinding.destination}${tag}\n`);
+    }
+    else {
+        // No org_webhook_id and no --capture-to → honeypot/field guards
+        // won't fire. Surface it so the agent can act.
+        process.stderr.write(`⚠  No binding registered (funnel has no org_webhook_id). Honeypot and field guards are NOT enforced for this slug. Pass --capture-to webhook:<id> or workflow:<id>, or wait for the backend migration to backfill org_webhook_id.\n`);
     }
     process.stdout.write(html + '\n');
 }

package/dist/completion.js

@@ -26,7 +26,7 @@ const BLOCK_END = `# end ${PROGRAM} completion`;
 // test/smoke/completion.test.ts, which fails if a command in `myapi --help`
 // is missing here.
 export const COMMANDS = [
-    'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
+    'account', 'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
     'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image',
     'doctor', 'install-skills', 'keys', 'llm', 'org', 'payments', 'people', 'pixel', 'queue',
     'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
@@ -35,10 +35,11 @@ export const COMMANDS = [
 // command → subcommands, for `myapi <command> <TAB>`. Mirrors each
 // command's dispatcher; commands absent here take no subcommand.
 export const SUBCOMMANDS = {
+    account: ['mailing-address'],
     auth: ['setup', 'import-key', 'whoami', 'link', 'switch', 'install-skills', 'config', 'registrant', 'api-keys'],
     org: ['create', 'delete', 'get', 'import', 'list', 'sync-brand', 'update'],
     billing: ['balance', 'history', 'usage', 'setup', 'topup', 'spend-cap'],
-    domain: ['assign', 'check', 'email-setup', 'import', 'list', 'records', 'register', 'renew', 'retry-provisioning', 'settings', 'status'],
+    domain: ['assign', 'check', 'email-setup', 'import', 'list', 'mail-server-resync', 'records', 'register', 'renew', 'retry-provisioning', 'settings', 'status'],
     funnel: ['create', 'delete', 'get', 'list', 'pages', 'publish', 'push', 'verify'],
     webhook: ['create', 'delete', 'delivery', 'list', 'update'],
     workflow: ['create', 'delete', 'disable', 'enable', 'get', 'get-run', 'list', 'runs', 'update'],

package/dist/exposes.test.js

@@ -6,6 +6,7 @@ import * as url from 'url';
 // EXPOSES array so the coverage tool (S-102) can introspect the full CLI
 // surface.
 const COMMAND_MODULES = [
+    './commands/account.js',
     './commands/auth.js',
     './commands/billing.js',
     './commands/config.js',

package/dist/index.js

@@ -6,6 +6,7 @@ import * as fs from 'fs';
 import { parseFlags } from './flags.js';
 const pkgPath = new URL('../package.json', import.meta.url);
 const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+import * as accountCmd from './commands/account.js';
 import * as keysCmd from './commands/keys.js';
 import * as billingCmd from './commands/billing.js';
 import * as orgCmd from './commands/org.js';
@@ -40,6 +41,7 @@ import * as doctorCmd from './commands/doctor.js';
 // into a single schema for the upfront parse, so adding a new value flag in
 // one command means editing one file (its SCHEMA), not a global allowlist.
 const COMBINED_SCHEMA = {
+    ...accountCmd.SCHEMA,
     ...authCmd.SCHEMA,
     ...billingCmd.SCHEMA,
     ...configCmd.SCHEMA,
@@ -170,6 +172,9 @@ async function main() {
             case 'org':
                 await orgCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'account':
+                await accountCmd.run(subcommand, restArgs, flags);
+                break;
             case 'billing':
                 await billingCmd.run(subcommand, restArgs, flags);
                 break;
@@ -367,6 +372,7 @@ const HELP_TARGETS = {
     task: f => taskCmd.run(undefined, [], f),
     doctor: f => doctorCmd.run(undefined, [], f),
     org: f => orgCmd.run(undefined, [], f),
+    account: f => accountCmd.run(undefined, [], f),
     billing: f => billingCmd.run(undefined, [], f),
     keys: f => keysCmd.run(undefined, [], f),
     config: f => configCmd.run(undefined, [], f),
@@ -399,6 +405,7 @@ Usage: myapi <command> [subcommand] [args]
        myapi --version
 
 Commands:
+  account         Account-scoped settings (mailing address)
   audience        Save filter snapshots as named audiences (people or companies)
   auth            Manage account · setup · whoami · link
   billing         Check balance and manage billing

package/dist/skills/my-funnel-api/SKILL.md

@@ -73,6 +73,8 @@ cat page-with-snippet.html | myapi funnel push /
 # Submissions land in the funnel's auto-provisioned webhook → CRM upsert on `email` → any bound workflow fires.
 ```
 
+`funnel form` always registers a per-slug binding (idempotent on repeat). Without `--capture-to` it auto-targets the funnel's `org_webhook_id` — same destination as the fallback, with server-side honeypot + field validation turned on.
+
 Multi-form funnel (each slug to a different destination):
 
 ```bash

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.3.8",
+  "version": "1.3.11",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -30,7 +30,7 @@
     "lint:skills:strict": "node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.3.8"
+    "@myapihq/sdk": "^1.3.11"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",