@myapihq/cli 1.3.8 → 1.3.12

package/dist/commands/account.d.ts

@@ -0,0 +1,6 @@
+import type { FlagSchema } from '../flags.js';
+import type { Flags } from '../helpers.js';
+import type { Exposes } from '../exposes.js';
+export declare const SCHEMA: FlagSchema;
+export declare const EXPOSES: Exposes;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/account.js

@@ -0,0 +1,75 @@
+// `myapi account` — account-scoped operations.
+//
+// Today: mailing-address (CAN-SPAM compliance for transactional email).
+// Future home for any other account-level reads/writes that don't fit
+// `billing` (which owns money) or `keys` (which owns auth credentials).
+import { hq as sdkHq } from '@myapihq/sdk';
+import { requireConfig } from '../config.js';
+import { success, error, info, printJson } from '../output.js';
+export const SCHEMA = {};
+export const EXPOSES = [
+    'GET /hq/account/mailing-address',
+    'PATCH /hq/account/mailing-address',
+];
+const SUBCOMMAND_USAGE = {
+    'mailing-address': `myapi account mailing-address                       Show current value (null if unset)
+myapi account mailing-address "<address>"            Set the mailing address
+
+The mailing address is required for transactional email (CAN-SPAM):
+\`email message send\` returns MAILING_ADDRESS_REQUIRED until this is set.
+Pass the full postal address as a single string — e.g.
+"123 Main St, Springfield, IL 62701, USA".`,
+};
+async function mailingAddress(args, flags) {
+    const config = requireConfig();
+    // Positional arg present → set. Absent → get.
+    const value = args[0];
+    if (value === undefined) {
+        const res = await sdkHq.getMailingAddress(config.api_key);
+        if (flags.json) {
+            printJson(res);
+            return;
+        }
+        if (res.mailing_address) {
+            info(`Mailing address: ${res.mailing_address}`);
+        }
+        else {
+            info('Mailing address: (not set)');
+            info('Set it with: myapi account mailing-address "<address>"');
+            info('Required for: myapi email message send (CAN-SPAM).');
+        }
+        return;
+    }
+    // Reject obviously bad inputs early — the backend would 400 anyway.
+    const trimmed = value.trim();
+    if (!trimmed) {
+        error('Mailing address must be a non-empty string. Example: "123 Main St, Springfield, IL 62701, USA".');
+    }
+    const res = await sdkHq.setMailingAddress(config.api_key, trimmed);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Mailing address set: ${res.mailing_address}`);
+}
+export async function run(subcommand, args, flags) {
+    if (!subcommand || (flags.help && !subcommand)) {
+        info(`Usage: myapi account <subcommand>
+
+Subcommands:
+  mailing-address    Get or set the account's mailing address (CAN-SPAM)`);
+        return;
+    }
+    if (flags.help) {
+        const usage = SUBCOMMAND_USAGE[subcommand];
+        if (usage)
+            info(`Usage: ${usage}`);
+        else
+            info(`Unknown subcommand: ${subcommand}. Run "myapi account --help" for the list.`);
+        return;
+    }
+    switch (subcommand) {
+        case 'mailing-address': return mailingAddress(args, flags);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi account --help" for the list.`);
+    }
+}

package/dist/commands/config.js

@@ -51,8 +51,8 @@ export async function setFunnel(id, _flags, via = 'auth config') {
     if (!orgId)
         error('No default organization set. Run: myapi auth config set-org <id>');
     info('› Validating…');
-    const rawFunnel = await sdkFunnel.getFunnel(config.api_key, orgId, id);
-    const funnelId = rawFunnel.funnel?.id ?? rawFunnel.id;
+    const { funnel } = await sdkFunnel.getFunnel(config.api_key, orgId, id);
+    const funnelId = funnel.id;
     config.default_funnel = funnelId;
     saveConfig(config);
     success(`Default funnel set to: ${funnelId}`);

package/dist/commands/crm/companies.js

@@ -5,6 +5,10 @@ import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/companies',
+    // Backend (2026-06-06): bare GET list with query-param filters —
+    // companion to the POST /search verb. See contacts.ts for the same
+    // pattern.
+    'GET /crm/orgs/{org_id}/companies',
     'POST /crm/orgs/{org_id}/companies/promote',
     'POST /crm/orgs/{org_id}/companies/search',
     'GET /crm/orgs/{org_id}/companies/{id}',

package/dist/commands/crm/contacts.js

@@ -5,6 +5,11 @@ import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/contacts',
+    // Backend (2026-06-06): bare GET list with query-param filters —
+    // companion to the POST /search verb (richer filters via body). The
+    // CLI `list` verb still uses /search for forward-compat; the bare GET
+    // is declared so it's covered.
+    'GET /crm/orgs/{org_id}/contacts',
     'POST /crm/orgs/{org_id}/contacts/promote',
     'POST /crm/orgs/{org_id}/contacts/search',
     'GET /crm/orgs/{org_id}/contacts/{id}',

package/dist/commands/doctor-setup.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/doctor-setup.test.js

@@ -0,0 +1,74 @@
+// Unit tests for the doctor's `setup` section augmentation (2026-06-05).
+// Exercises the re-interpretation of backend sections — when the
+// `domains` or `emails` sections come back empty (zero-state), the
+// `setup` augmentation should escalate to actionable warns.
+import { describe, it, expect } from 'vitest';
+import { _setupSection } from './doctor.js';
+function mkReport(sections) {
+    return {
+        org_id: 'org-test',
+        generated_at: '2026-06-05T00:00:00Z',
+        sections,
+        totals: { ok: 0, warn: 0, crit: 0 },
+    };
+}
+function empty(name) {
+    return { name, summary: 'no resources', issues: [] };
+}
+function populated(name) {
+    return { name, summary: 'all checks passed', issues: [{
+                id: 'x', severity: 'ok', scope: name, message: 'something',
+            }] };
+}
+describe('_setupSection', () => {
+    it('returns null when both domains + emails sections are populated', () => {
+        expect(_setupSection(mkReport([populated('domains'), populated('emails')]))).toBeNull();
+    });
+    it('emits both warns when both sections are empty', () => {
+        const s = _setupSection(mkReport([empty('domains'), empty('emails')]));
+        expect(s).not.toBeNull();
+        expect(s.issues.map(i => i.severity)).toEqual(['warn', 'warn']);
+        expect(s.issues[0].message).toMatch(/No domain registered/);
+        expect(s.issues[1].message).toMatch(/No email inbox configured/);
+        expect(s.summary).toBe('2 setup gaps');
+    });
+    it('emits one warn when only emails is empty', () => {
+        const s = _setupSection(mkReport([populated('domains'), empty('emails')]));
+        expect(s).not.toBeNull();
+        expect(s.issues).toHaveLength(1);
+        expect(s.issues[0].scope).toBe('setup/email-inbox');
+        expect(s.summary).toBe('1 setup gap');
+    });
+    it('emits one warn when only domains is empty', () => {
+        const s = _setupSection(mkReport([empty('domains'), populated('emails')]));
+        expect(s).not.toBeNull();
+        expect(s.issues).toHaveLength(1);
+        expect(s.issues[0].scope).toBe('setup/domain');
+    });
+    it('returns null when the backend omits both sections entirely', () => {
+        // If a future backend drops these sections, we shouldn't fabricate
+        // warns out of nothing. Silence is the safe default.
+        expect(_setupSection(mkReport([populated('funnels')]))).toBeNull();
+    });
+    it('attaches actionable hints', () => {
+        const s = _setupSection(mkReport([empty('domains'), empty('emails')]));
+        expect(s.issues[0].hint).toMatch(/myapi domain register/);
+        expect(s.issues[1].hint).toMatch(/myapi email mailbox create/);
+    });
+    it('emits a mailing-address warn when ctx.mailingAddress is null', () => {
+        const s = _setupSection(mkReport([populated('domains'), populated('emails')]), { mailingAddress: null });
+        expect(s).not.toBeNull();
+        expect(s.issues).toHaveLength(1);
+        expect(s.issues[0].scope).toBe('setup/mailing-address');
+        expect(s.issues[0].hint).toMatch(/myapi account mailing-address/);
+    });
+    it('does NOT emit mailing-address warn when set', () => {
+        const s = _setupSection(mkReport([populated('domains'), populated('emails')]), { mailingAddress: '1 Test St, Paris' });
+        expect(s).toBeNull();
+    });
+    it('stays silent when mailing-address fetch failed (undefined)', () => {
+        // undefined = "unknown, infra blip" — don't false-alarm.
+        const s = _setupSection(mkReport([populated('domains'), populated('emails')]), { mailingAddress: undefined });
+        expect(s).toBeNull();
+    });
+});

package/dist/commands/doctor.d.ts

@@ -1,6 +1,11 @@
+import { hq as sdkHq } from '@myapihq/sdk';
 import type { FlagSchema } from '../flags.js';
 import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+export interface SetupContext {
+    mailingAddress?: string | null;
+}
+export declare function _setupSection(report: sdkHq.DoctorReport, ctx?: SetupContext): sdkHq.DoctorSection | null;
 export declare function run(_subcommand: string | undefined, _args: string[], flags: Flags): Promise<void>;

package/dist/commands/doctor.js

@@ -27,6 +27,8 @@ export const EXPOSES = [
     'GET /container/orgs/{org_id}/containers',
     'GET /funnel/orgs/{org_id}/funnels',
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
+    // Best-effort read for the setup-gap mailing_address check (CAN-SPAM).
+    'GET /hq/account/mailing-address',
 ];
 export const SCHEMA = {};
 const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
@@ -58,6 +60,54 @@ function fmtIssue(i) {
     const head = `  ${MARK[i.severity] ?? '·'} ${label}${i.message}`;
     return i.hint ? `${head}\n    ${C.dim}→ ${i.hint}${C.reset}` : head;
 }
+export function _setupSection(report, ctx = {}) {
+    const byName = new Map();
+    for (const s of report.sections)
+        byName.set(s.name, s);
+    const issues = [];
+    const dom = byName.get('domains');
+    if (dom && dom.issues.length === 0) {
+        issues.push({
+            id: localIssueId('setup_no_domain', report.org_id),
+            severity: 'warn',
+            scope: 'setup/domain',
+            category: 'setup',
+            message: 'No domain registered for this org',
+            hint: 'Register one with: myapi domain register <domain> && myapi domain assign <domain>',
+        });
+    }
+    const em = byName.get('emails');
+    if (em && em.issues.length === 0) {
+        issues.push({
+            id: localIssueId('setup_no_mailbox', report.org_id),
+            severity: 'warn',
+            scope: 'setup/email-inbox',
+            category: 'setup',
+            message: 'No email inbox configured',
+            hint: 'Create one with: myapi email mailbox create <username>@<your-domain>',
+        });
+    }
+    // Account-scoped (so use report.org_id only for the dedup id, not as
+    // entity scope). Hard-gates every transactional `email send` —
+    // backend returns MAILING_ADDRESS_REQUIRED until set.
+    if (ctx.mailingAddress === null) {
+        issues.push({
+            id: localIssueId('setup_no_mailing_address', report.org_id),
+            severity: 'warn',
+            scope: 'setup/mailing-address',
+            category: 'setup',
+            message: 'Account has no mailing address (CAN-SPAM)',
+            hint: 'Set one with: myapi account mailing-address "<full postal address>"',
+        });
+    }
+    if (issues.length === 0)
+        return null;
+    return {
+        name: 'setup',
+        summary: `${issues.length} setup gap${issues.length === 1 ? '' : 's'}`,
+        issues,
+    };
+}
 // Local DNS-resolution probe for every distinct domain the report names.
 // The backend can verify domain provisioning state from its own egress;
 // this checks whether the operator's network reaches them today — a
@@ -207,7 +257,26 @@ export async function run(_subcommand, _args, flags) {
         error(`doctor endpoint failed: ${e?.message ?? String(e)}`);
     }
     // Local augmentation, appended after the backend's sections by design —
-    // see the file header on why client-observed checks stay grouped at the end.
+    // see the file header on why client-observed checks stay grouped at the
+    // end. `setup` re-interprets the backend's own sections (zero-state →
+    // warn) and comes first; `local network` + `reachability` are liveness
+    // probes that follow.
+    //
+    // Best-effort fetch the account-scoped mailing_address — `null` if
+    // unset, `undefined` if the call fails (transient / permissions / 404
+    // on older backends). `null` triggers the warn; `undefined` is silent
+    // so we don't false-alarm on infra blips.
+    let mailingAddress;
+    try {
+        const res = await sdkHq.getMailingAddress(apiKey);
+        mailingAddress = res?.mailing_address ?? null;
+    }
+    catch {
+        mailingAddress = undefined;
+    }
+    const setup = _setupSection(report, { mailingAddress });
+    if (setup)
+        report.sections.push(setup);
     const localSection = await dnsProbeSection(report);
     if (localSection)
         report.sections.push(localSection);
@@ -266,6 +335,9 @@ Sections returned by the backend today:
   funnels, webhooks, workflows, domains, containers, emails, payments
 
 Local additions:
+  setup         — Flags zero-state config the backend currently reports as
+                  "no resources": no domain registered, no email inbox.
+                  Warnings, not critical — the org may not need them yet.
   local network — DNS resolution from your egress for each domain mentioned.
   reachability  — HTTP GET to every container URL and funnel page; surfaces
                   the status code. Failures are warnings, never critical —

package/dist/commands/domain.d.ts

@@ -13,6 +13,7 @@ export declare function unassign(domainArg: string, flags: Flags): Promise<void>
 export declare function status(domainArg: string, flags: Flags): Promise<void>;
 export declare function emailSetup(domainArg: string, flags: Flags): Promise<void>;
 export declare function retryProvisioning(domainArg: string, flags: Flags): Promise<void>;
+export declare function mailServerResync(domainArg: string, flags: Flags): Promise<void>;
 export declare function settings(domainArg: string, flags: Flags): Promise<void>;
 export declare function updateSettings(domainArg: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/domain.js

@@ -1,4 +1,4 @@
-import { domain as sdkDomain } from '@myapihq/sdk';
+import { domain as sdkDomain, email as sdkEmail } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, info, printTable, printJson } from '../output.js';
 import { formatDate } from '../utils.js';
@@ -16,6 +16,12 @@ export const EXPOSES = [
     'GET /domain/orgs/{org_id}/{domain}/status',
     'POST /domain/orgs/{org_id}/{domain}/email-infra',
     'POST /domain/orgs/{org_id}/{domain}/retry-provisioning',
+    // Mail-server (Stalwart) reprovisioning — distinct from DNS/cert
+    // retry-provisioning above. Call when mailbox-create returns
+    // DOMAIN_NOT_MAIL_READY / MAILBOX_PROVISION_FAILED, or when inbox
+    // reads return "mail server error" on a domain whose
+    // email_infra_ready=true.
+    'POST /email/orgs/{org_id}/domains/{domain}/mail-server-resync',
     'GET /domain/orgs/{org_id}/{domain}/records',
     'POST /domain/orgs/{org_id}/{domain}/records',
     'GET /domain/orgs/{org_id}/{domain}/records/{record_id}',
@@ -312,6 +318,24 @@ export async function retryProvisioning(domainArg, flags) {
         info(res.next_step);
     info(`Track with: myapi domain status ${domain} --watch`);
 }
+// Re-runs mail-server (Stalwart) provisioning for a domain. Distinct from
+// retry-provisioning above — that re-runs the DNS / cert side; this one
+// re-runs the IMAP/SMTP / mail-store side. Idempotent. Use when:
+//   - `email mailbox create` returns DOMAIN_NOT_MAIL_READY / MAILBOX_PROVISION_FAILED
+//   - `email message inbox <addr>` returns "mail server error" on a domain
+//     whose `email_infra_ready=true` according to `domain list`.
+export async function mailServerResync(domainArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain mail-server-resync <domain> [--org <id>]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain mail-server-resync <domain> [--org <id>]');
+    const res = await sdkEmail.mailServerResync(config.api_key, orgId, domain);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Mail-server resync triggered for ${domain}`);
+    info('Retry mailbox-create / inbox reads in a few seconds.');
+}
 export async function settings(domainArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi domain settings <domain> [--org <id>]');
@@ -591,6 +615,17 @@ Re-runs domain provisioning when status=infra_error and error_detail.retryable=t
 The CLI surfaces the retry hint automatically when status renders infra_error.
 
 After triggering retry, poll: myapi domain status <domain> --watch`,
+    'mail-server-resync': `myapi domain mail-server-resync <domain> [--org <id>]
+
+Re-runs the mail-server (Stalwart) provisioning for a domain. Distinct
+from "retry-provisioning" — that re-runs the DNS / cert side; this one
+re-runs the IMAP / SMTP / mail-store side. Idempotent.
+
+Use when:
+  - "email mailbox create" returns DOMAIN_NOT_MAIL_READY or MAILBOX_PROVISION_FAILED
+  - "email message inbox <addr>" returns "mail server error" but
+    "domain list" shows email_infra_ready=true for that domain
+  - The fix-path called out in backend-email-postdeploy-findings-2026-06-05`,
     'update-settings': `myapi domain update-settings <domain> [--security=<level>] [--browser-check=on|off] [--purge-cache] [--org <id>]
 
   --security=<level>       essentially_off | low | medium | high | under_attack  (default: medium)
@@ -610,6 +645,7 @@ Subcommands:
   email-setup      Opt in to MyAPI-managed email on a subdomain (default: mail.<domain>)
   import           Bring your own domain (BYOD) — registrar-agnostic
   list             List domains
+  mail-server-resync  Re-run Stalwart mail-server provisioning for a domain (fixes inbox/create on broken domains)
   records          Manage DNS records in the zone (list / get / create / update / delete)
   register         Register a domain
   renew            Renew a registered domain for another period
@@ -643,6 +679,7 @@ Tip: Set defaults with "myapi config set-org <id>" / "set-domain <domain>" to sk
         case 'update-settings': return updateSettings(args[0], flags);
         case 'records': return recordsRun(args[0], args.slice(1), flags);
         case 'email-setup': return emailSetup(args[0], flags);
+        case 'mail-server-resync': return mailServerResync(args[0], flags);
         case 'retry-provisioning': return retryProvisioning(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi domain --help" for a list of valid subcommands.`);
     }

package/dist/commands/email/mailbox.js

@@ -4,6 +4,7 @@ import { success, error, printTable, info } from '../../output.js';
 export const EXPOSES = [
     'POST /email/mailboxes/create',
     'GET /email/mailboxes',
+    'DELETE /email/mailboxes/{address}',
     'PUT /email/mailboxes/{address}/forwarding',
     'DELETE /email/mailboxes/{address}/forwarding',
     'POST /email/sending/activate',
@@ -70,6 +71,17 @@ async function clearForwarding(address, _flags) {
     await sdkEmail.deleteForwarding(config.api_key, address);
     success(`Forwarding cleared for ${address}`);
 }
+async function del(address, _flags) {
+    const config = requireConfig();
+    if (!address)
+        error('Missing required arguments.\nUsage: myapi email mailbox delete <user@domain>');
+    // Backend is idempotent — 204 whether or not the mailbox existed. So we
+    // don't pre-check existence; just call delete and report success. The
+    // 409 MAILBOX_IN_USE case bubbles up as an API error with a clear
+    // pointer to pause the campaign first.
+    await sdkEmail.deleteMailbox(config.api_key, address);
+    success(`Mailbox deleted: ${address}`);
+}
 const USAGE = {
     'create': `myapi email mailbox create <user@domain> [--display-name <name>]
        myapi email mailbox create --username <u> --domain <d> [--display-name <name>]
@@ -83,6 +95,11 @@ matches the rest of the CLI ("first required arg is positional").`,
                         org (orphaned mailboxes — domain was unassigned
                         without first deleting them).`,
     'activate-sending': 'myapi email mailbox activate-sending --address <email>',
+    'delete': `myapi email mailbox delete <user@domain>
+
+Idempotent — returns success whether or not the mailbox existed.
+Refuses with MAILBOX_IN_USE when an active or paused campaign still
+sends from this address; pause/delete the campaign first.`,
     'set-forwarding': `myapi email mailbox set-forwarding <user@domain> <forward-to@domain>
 
 Redirects a copy of every incoming message to an external address
@@ -97,6 +114,7 @@ Subcommands:
   activate-sending   Activate outbound sending for a mailbox
   clear-forwarding   Stop forwarding for a mailbox
   create             Create a mailbox (positional <user@domain> or --username/--domain)
+  delete             Delete a mailbox (idempotent; rejects if a campaign still uses it)
   list               List mailboxes on a domain (--domain) or orphaned ones (--filter unassigned)
   set-forwarding     Forward a copy of incoming mail to an external address`);
         return;
@@ -112,6 +130,7 @@ Subcommands:
     switch (sub) {
         case 'create': return create(args[0], flags);
         case 'list': return list(flags);
+        case 'delete': return del(args[0], flags);
         case 'activate-sending': return activateSending(flags);
         case 'set-forwarding': return setForwarding(args[0], args[1], flags);
         case 'clear-forwarding': return clearForwarding(args[0], flags);

package/dist/commands/funnel.js

@@ -27,6 +27,7 @@ export const SCHEMA = {
     funnel: 'string',
     slug: 'string',
     env: 'string',
+    force: 'boolean',
     'api-fn': 'string',
     // form
     fields: 'string',
@@ -44,6 +45,28 @@ function validateFunnelName(name) {
         error(`Invalid --name "${name}". Lowercase letters, digits, hyphens; 1-50 chars; starts with a letter or digit.`);
     }
 }
+// Canonical key for comparing slugs across the wire shapes the backend may
+// return (`/about`, `about`, `/about/`). Home is the empty string whether it
+// arrives as `/` or ``.
+function slugKey(s) {
+    return (s.startsWith('/') ? s.slice(1) : s).replace(/\/+$/, '');
+}
+// Resolve human-readable labels for the namespace a destructive write lands
+// on. The whole point of the funnel-write guardrails is that the agent (and
+// the human reading the transcript) can SEE which org + funnel it touched —
+// a bare UUID hides the cross-org mistake this is meant to catch. Best-effort:
+// fall back to ids if either lookup fails so we never block the real work on a
+// cosmetic call.
+async function describeTarget(apiKey, orgId, funnelId) {
+    const [org, funnelRes] = await Promise.all([
+        hq.getOrg(apiKey, orgId).catch(() => undefined),
+        sdkFunnel.getFunnel(apiKey, orgId, funnelId).catch(() => undefined),
+    ]);
+    const orgLabel = org?.name ? `${org.name} (${orgId})` : orgId;
+    const fname = funnelRes?.funnel?.name;
+    const funnelLabel = fname ? `${fname} (${funnelId})` : funnelId;
+    return { orgLabel, funnelLabel };
+}
 export async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi funnel list [--org <id>]');
@@ -83,16 +106,12 @@ export async function get(id, flags) {
     const orgId = requireOrg(flags, config, 'myapi funnel get <id> [--org <id>]');
     if (!id)
         error('Missing required arguments.\nUsage: myapi funnel get <id> [--org <id>]');
-    const raw = await sdkFunnel.getFunnel(config.api_key, orgId, id);
-    // Backend response shape varies between two layouts:
-    //   1) { funnel: {...}, subdomain_url, domain_url }    (newer, wrapped)
-    //   2) { id, ..., subdomain_url, domain_url }          (older, flat)
-    // Coalesce both so this works regardless of which shape we get back.
-    const funnel = raw.funnel ?? raw;
-    const subdomain_url = raw.subdomain_url ?? funnel.subdomain_url;
-    const domain_url = raw.domain_url ?? funnel.domain_url;
+    // SDK normalizes the wire shape to the wrapped envelope. `--json`
+    // still emits the envelope (back-compat: legacy consumers parse it).
+    const result = await sdkFunnel.getFunnel(config.api_key, orgId, id);
+    const { funnel, subdomain_url, domain_url } = result;
     if (flags.json) {
-        printJson(raw);
+        printJson(result);
         return;
     }
     info(`ID:          ${funnel.id}`);
@@ -104,8 +123,8 @@ export async function get(id, flags) {
         info(`Created:     ${formatDate(funnel.created_at)}`);
     if (funnel.updated_at)
         info(`Updated:     ${formatDate(funnel.updated_at)}`);
-    if (Array.isArray(funnel.pages))
-        info(`Pages:       ${funnel.pages.length}`);
+    // `pages` isn't part of the typed Funnel; backend doesn't include it
+    // here (use `myapi funnel pages` for that). Drop the inline count.
 }
 export async function del(id, flags) {
     const config = requireConfig();
@@ -153,6 +172,29 @@ export async function push(slug, flags) {
     if (process.stdin.isTTY) {
         error("No content provided via stdin. Use a pipe or file:\n  echo '<h1>Hello</h1>' | myapi funnel push /\n  cat page.html | myapi funnel push /about");
     }
+    // Overwrite guard. `push` silently replaces whatever is live at the slug,
+    // so an agent pushing `/` onto an org's existing site destroys it with no
+    // second chance. Mirror the my-domain-api principle ("destructive ops don't
+    // ride on silent defaults"): if a page already exists at this slug, refuse
+    // and name the org + funnel + slug, unless --force. We do this BEFORE
+    // reading stdin so a refused push never consumes the generated HTML.
+    const force = flags.force === true;
+    const existingPages = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId);
+    const clash = existingPages.find(p => slugKey(p.slug) === slugKey(finalSlug));
+    if (clash && !force) {
+        const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
+        const when = clash.updated_at ? `, last updated ${formatDate(clash.updated_at)}` : '';
+        error(`Refusing to overwrite an existing page.
+
+  Org:    ${orgLabel}
+  Funnel: ${funnelLabel}
+  Slug:   ${finalSlug}  (already published${when})
+
+This funnel already serves a page at ${finalSlug}; pushing would replace it.
+  • Wrong org or funnel? Re-run with --org <id> and/or --funnel <id>.
+  • New demo? Create a fresh funnel: myapi funnel create --name <demo> --org <id>
+  • Meant to replace it? Re-run the same command with --force.`);
+    }
     const html = await new Promise((resolve, reject) => {
         let data = '';
         process.stdin.setEncoding('utf-8');
@@ -163,9 +205,12 @@ export async function push(slug, flags) {
     if (!html.trim())
         error("No content provided via stdin. Usage: echo '<h1>Hello</h1>' | myapi funnel push [slug]");
     const result = await sdkFunnel.pushFunnelPage(config.api_key, orgId, funnelId, { slug: finalSlug, html });
-    success(`Pushed page to ${finalSlug}`);
+    const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
+    success(`Pushed ${clash ? '(overwrote) ' : ''}page to ${finalSlug}`);
+    info(`Org:    ${orgLabel}`);
+    info(`Funnel: ${funnelLabel}`);
     if (resolvedFromOrg) {
-        info(`(Used the org's only funnel: ${funnelId}. Set a default with: myapi config set-funnel ${funnelId})`);
+        info(`(Auto-picked the org's only funnel. Pin it explicitly with --funnel ${funnelId} or: myapi config set-funnel ${funnelId})`);
     }
     let liveUrl = result?.url;
     if (!liveUrl) {
@@ -256,10 +301,32 @@ export async function formCmd(funnelArg, flags) {
             error(`Honeypot "${honeypot}" collides with a real field. Pick a different --honeypot name.`);
     const cta = flags.cta || 'Sign up';
     const successMsg = flags.success || "Thanks — we'll be in touch.";
-    // Optional binding via --capture-to.
+    // Resolve the binding destination.
+    //
+    // Without a binding, the backend falls submissions through to the
+    // funnel's default webhook with NO honeypot / field validation. That
+    // makes the on-page honeypot purely cosmetic and lets trivial bots
+    // write to your CRM. So: always register a binding. When
+    // `--capture-to` is omitted, target the funnel's auto-provisioned
+    // `org_webhook_id` — same destination as the fallback, just with
+    // server-side guards turned on. Backend POST upserts on duplicate
+    // slug, so re-runs are safe.
     let registeredBinding;
+    let autoBound = false;
+    let dest = null;
     if (typeof flags['capture-to'] === 'string' && flags['capture-to']) {
-        const dest = parseCaptureTo(flags['capture-to']);
+        dest = parseCaptureTo(flags['capture-to']);
+    }
+    else {
+        const { funnel } = await sdkFunnel.getFunnel(config.api_key, orgId, funnelId);
+        if (funnel.org_webhook_id) {
+            dest = { kind: 'webhook', id: funnel.org_webhook_id };
+            autoBound = true;
+        }
+        // Legacy funnels migrated before 2026-06-03 may briefly lack
+        // org_webhook_id — emit the HTML without a binding and warn.
+    }
+    if (dest) {
         const binding = {
             slug,
             destination: `${dest.kind}:${dest.id}`,
@@ -310,7 +377,13 @@ document.querySelectorAll('[data-myapi-form]').forEach(f => {
     }
     if (registeredBinding) {
         // Print confirmation on stderr so stdout stays the clean snippet.
-        process.stderr.write(`✓ Registered form binding: slug=${slug} → ${registeredBinding.destination}\n`);
+        const tag = autoBound ? ' (auto, default webhook)' : '';
+        process.stderr.write(`✓ Registered form binding: slug=${slug} → ${registeredBinding.destination}${tag}\n`);
+    }
+    else {
+        // No org_webhook_id and no --capture-to → honeypot/field guards
+        // won't fire. Surface it so the agent can act.
+        process.stderr.write(`⚠  No binding registered (funnel has no org_webhook_id). Honeypot and field guards are NOT enforced for this slug. Pass --capture-to webhook:<id> or workflow:<id>, or wait for the backend migration to backfill org_webhook_id.\n`);
     }
     process.stdout.write(html + '\n');
 }
@@ -381,6 +454,29 @@ export async function publish(dir, flags) {
     const files = await collectFiles(dir, dir);
     if (files.length === 0)
         error(`No files found under ${dir}.`);
+    // Overwrite guard — prod only. Publishing to prod replaces the whole live
+    // site; the dev channel is the throwaway preview you re-publish freely, so
+    // it stays unguarded. If the funnel already serves pages and this is a prod
+    // publish, refuse without --force and name the namespace at risk.
+    const force = flags.force === true;
+    const channel = env || 'prod';
+    if (channel === 'prod' && !force) {
+        const existingPages = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId);
+        if (existingPages.length > 0) {
+            const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
+            error(`Refusing to replace a published site.
+
+  Org:    ${orgLabel}
+  Funnel: ${funnelLabel}
+  Live:   ${existingPages.length} page(s) currently published
+
+Publishing to the prod channel replaces the entire live site.
+  • Wrong org or funnel? Re-run with --org <id> and/or --funnel <id>.
+  • New demo? Create a fresh funnel: myapi funnel create --name <demo> --org <id>
+  • Preview safely first: myapi funnel publish ${dir} --env dev
+  • Meant to replace it? Re-run the same command with --force.`);
+        }
+    }
     const result = await sdkFunnel.publishFiles(config.api_key, orgId, funnelId, files, {
         env: env,
         apiFunctionId: flags['api-fn'],
@@ -389,7 +485,10 @@ export async function publish(dir, flags) {
         printJson(result);
         return;
     }
+    const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
     success(`Published ${result.file_count} file(s) to the ${result.channel} channel`);
+    info(`Org:    ${orgLabel}`);
+    info(`Funnel: ${funnelLabel}`);
     info(`Size:   ${(result.size_bytes / 1024).toFixed(1)} KB`);
     info(`SPA:    ${result.spa_mode ? 'on' : 'off'}`);
     info(`Live:   ${result.published_url}`);
@@ -442,7 +541,7 @@ free.`,
     'get': 'myapi funnel get <id> [--org <id>] [--json]',
     'list': 'myapi funnel list [--org <id>] [--json]',
     'pages': 'myapi funnel pages [funnel_id] [--funnel <id>] [--org <id>] [--json]',
-    'publish': `myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--api-fn <id>] [--org <id>]
+    'publish': `myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--api-fn <id>] [--force] [--org <id>]
 
 Uploads a whole local directory as the funnel's site. Each file's path
 within <dir> becomes its path on the site (e.g. dir/about/index.html →
@@ -451,18 +550,29 @@ within <dir> becomes its path on the site (e.g. dir/about/index.html →
   --env dev|prod    Target channel (default prod). dev publishes to
                     <name>-dev.makeautonomous.com for preview.
   --api-fn <id>     Bind /api/* on the site to a deployed function.
+  --force           Publish to prod even when the funnel already serves
+                    pages (replaces the entire live site). Refused without
+                    it. The dev channel is never guarded.
 
+Publishing to prod replaces the whole live site. The command prints the
+resolved org + funnel so you can confirm the namespace before it lands.
 SPA fallback is auto-enabled when the publish has a root index.html.
 
 Examples:
-  myapi funnel publish ./dist
-  myapi funnel publish ./dist --env dev
+  myapi funnel publish ./dist --env dev          # safe preview
+  myapi funnel publish ./dist                    # prod — refused if a site exists
+  myapi funnel publish ./dist --force            # prod — replace existing site
   myapi funnel publish ./site --api-fn <function_id>`,
-    'push': `myapi funnel push [slug] [--funnel <id>] [--slug <path>] [--org <id>] < page.html
+    'push': `myapi funnel push [slug] [--funnel <id>] [--slug <path>] [--force] [--org <id>] < page.html
 
 Reads HTML from stdin and publishes to <slug> on your funnel. Funnel is resolved
 from --funnel, the default funnel, or (only if the org has exactly one) auto-picked.
 
+Pushing OVERWRITES whatever page is already live at <slug>. If a page already
+exists there, push refuses and names the org + funnel + slug at risk; re-run
+with --force to replace it. On success it prints the resolved org + funnel so
+you can confirm you wrote to the namespace you intended.
+
 By default, your funnel is served on a preview subdomain (*.makeautonomous.com).
 To serve on your own domain, register and assign one with:
   myapi domain register <domain>
@@ -471,7 +581,7 @@ To serve on your own domain, register and assign one with:
 Examples:
   echo '<h1>Hello</h1>' | myapi funnel push /
   cat about.html | myapi funnel push /about
-  myapi funnel push < index.html
+  cat new.html | myapi funnel push / --force         # replace the live homepage
   cat p.html | myapi funnel push /pricing --funnel <uuid>`,
     'verify': `myapi funnel verify [slug] [--funnel <id>] [--org <id>]
 

package/dist/completion.js

@@ -26,7 +26,7 @@ const BLOCK_END = `# end ${PROGRAM} completion`;
 // test/smoke/completion.test.ts, which fails if a command in `myapi --help`
 // is missing here.
 export const COMMANDS = [
-    'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
+    'account', 'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
     'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image',
     'doctor', 'install-skills', 'keys', 'llm', 'org', 'payments', 'people', 'pixel', 'queue',
     'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
@@ -35,10 +35,11 @@ export const COMMANDS = [
 // command → subcommands, for `myapi <command> <TAB>`. Mirrors each
 // command's dispatcher; commands absent here take no subcommand.
 export const SUBCOMMANDS = {
+    account: ['mailing-address'],
     auth: ['setup', 'import-key', 'whoami', 'link', 'switch', 'install-skills', 'config', 'registrant', 'api-keys'],
     org: ['create', 'delete', 'get', 'import', 'list', 'sync-brand', 'update'],
     billing: ['balance', 'history', 'usage', 'setup', 'topup', 'spend-cap'],
-    domain: ['assign', 'check', 'email-setup', 'import', 'list', 'records', 'register', 'renew', 'retry-provisioning', 'settings', 'status'],
+    domain: ['assign', 'check', 'email-setup', 'import', 'list', 'mail-server-resync', 'records', 'register', 'renew', 'retry-provisioning', 'settings', 'status'],
     funnel: ['create', 'delete', 'get', 'list', 'pages', 'publish', 'push', 'verify'],
     webhook: ['create', 'delete', 'delivery', 'list', 'update'],
     workflow: ['create', 'delete', 'disable', 'enable', 'get', 'get-run', 'list', 'runs', 'update'],

package/dist/exposes.test.js

@@ -6,6 +6,7 @@ import * as url from 'url';
 // EXPOSES array so the coverage tool (S-102) can introspect the full CLI
 // surface.
 const COMMAND_MODULES = [
+    './commands/account.js',
     './commands/auth.js',
     './commands/billing.js',
     './commands/config.js',

package/dist/index.js

@@ -6,6 +6,7 @@ import * as fs from 'fs';
 import { parseFlags } from './flags.js';
 const pkgPath = new URL('../package.json', import.meta.url);
 const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+import * as accountCmd from './commands/account.js';
 import * as keysCmd from './commands/keys.js';
 import * as billingCmd from './commands/billing.js';
 import * as orgCmd from './commands/org.js';
@@ -40,6 +41,7 @@ import * as doctorCmd from './commands/doctor.js';
 // into a single schema for the upfront parse, so adding a new value flag in
 // one command means editing one file (its SCHEMA), not a global allowlist.
 const COMBINED_SCHEMA = {
+    ...accountCmd.SCHEMA,
     ...authCmd.SCHEMA,
     ...billingCmd.SCHEMA,
     ...configCmd.SCHEMA,
@@ -170,6 +172,9 @@ async function main() {
             case 'org':
                 await orgCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'account':
+                await accountCmd.run(subcommand, restArgs, flags);
+                break;
             case 'billing':
                 await billingCmd.run(subcommand, restArgs, flags);
                 break;
@@ -367,6 +372,7 @@ const HELP_TARGETS = {
     task: f => taskCmd.run(undefined, [], f),
     doctor: f => doctorCmd.run(undefined, [], f),
     org: f => orgCmd.run(undefined, [], f),
+    account: f => accountCmd.run(undefined, [], f),
     billing: f => billingCmd.run(undefined, [], f),
     keys: f => keysCmd.run(undefined, [], f),
     config: f => configCmd.run(undefined, [], f),
@@ -399,6 +405,7 @@ Usage: myapi <command> [subcommand] [args]
        myapi --version
 
 Commands:
+  account         Account-scoped settings (mailing address)
   audience        Save filter snapshots as named audiences (people or companies)
   auth            Manage account · setup · whoami · link
   billing         Check balance and manage billing

package/dist/skills/my-funnel-api/SKILL.md

@@ -15,6 +15,8 @@ A funnel is a website tied to an org. Push raw HTML pages to slugs and they're s
 <!-- llm:start -->
 Funnels are the publishing surface. You create a funnel under an org (one command), then `funnel push` raw HTML to any slug (`/`, `/about`, `/pricing`, etc.). The edge serves the page within seconds — no CI/CD, no build, no deploy queue.
 
+**Before you push, know where you're writing.** `funnel push` and `funnel publish --env prod` **overwrite** whatever is live at the target — no undo. An org may already host a real site; pushing `/` onto it replaces the homepage. See **Namespace & safety** below — this is the #1 way agents wreck an existing site.
+
 By default, your funnel lives on a free preview subdomain (`*.makeautonomous.com`) you get with every org. To serve on a custom domain, register and assign one via **mydomainapi** first.
 
 Every funnel auto-provisions a **webhook** at creation time (`org_webhook_id`). The funnel exposes two public proxy endpoints your HTML can call directly (no API key needed): a **form submit** at `POST /funnel/funnels/{id}/submit/{slug}` that delivers submissions through that webhook (CRM upsert + bound workflows fire automatically), and an **analytics/event ingest** for pageviews and click tracking. For multi-form funnels you can bind individual slugs to specific destinations with `myapi funnel form ... --capture-to webhook:<id>`.
@@ -28,51 +30,66 @@ Every funnel auto-provisions a **webhook** at creation time (`org_webhook_id`).
 | `myapi funnel list` | List all funnels with preview/domain URLs |
 | `myapi funnel get <id>` | Inspect a funnel's metadata + preview URL |
 | `myapi funnel delete <id>` | Delete the funnel and purge its edge pages |
-| `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`) |
+| `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`). **Overwrites** an existing page — refused without `--force`, prints the resolved org + funnel on success |
 | `myapi funnel pages [funnel_id]` | List the pages currently published to a funnel |
 | `myapi funnel form [funnel_id]` | Emit canonical form HTML (and register a binding with `--capture-to`) |
 | `myapi funnel verify [slug]` | Verify a published page is reachable + check links/webhooks |
 <!-- generated:end -->
 
+## Namespace & safety (read before any write)
+
+A write targets a `(org, funnel, slug)` address. Get all three right *before* pushing — the CLI will help, but the thinking is yours:
+
+1. **Confirm the org.** `--org` (or `default_org`) decides whose namespace you touch. For a demo or a new project, pass `--org <id>` explicitly every time — don't trust the ambient default. `myapi org list` shows the orgs you can reach.
+2. **Look before you write.** `myapi funnel list --org <id>` shows the org's funnels; `myapi funnel pages --funnel <id>` shows what's already published. If a slug is taken by something real, you're about to replace it.
+3. **A new demo = a new funnel.** Don't reuse an org's existing funnel for an unrelated demo. `myapi funnel create --name <demo> --org <id>` gives you a clean namespace and its own preview subdomain.
+4. **Pin the funnel.** When an org has exactly one funnel, `push`/`publish` auto-pick it — convenient, but it's how a demo lands on the wrong site. Pass `--funnel <id>` (or set a default) so the target is explicit, not inferred.
+
+The CLI backstops you: `push` refuses to overwrite an existing slug (and `publish --env prod` refuses to replace a live site) without `--force`, and both print the resolved **org + funnel** on success. `--force` is the deliberate "yes, replace it" — never reach for it just to clear the error; first check whether the clash means you're aimed at the wrong place.
+
 ## Examples
 <!-- llm:start -->
 ```bash
-# Create a funnel + push a homepage
-myapi funnel create
-echo '<h1>Hello</h1>' | myapi funnel push /
+# New demo, done safely — explicit org, fresh funnel, confirm, then push
+myapi org list                                      # which orgs can I reach?
+myapi funnel list --org <org_id>                    # what already lives here?
+myapi funnel create --name acme-demo --org <org_id> # clean namespace for the demo
+echo '<h1>Hello</h1>' | myapi funnel push / --funnel <new_funnel_id>
 
-# Push multiple pages
-cat about.html    | myapi funnel push /about
-cat pricing.html  | myapi funnel push /pricing
+# Push multiple pages to that funnel
+cat about.html    | myapi funnel push /about   --funnel <new_funnel_id>
+cat pricing.html  | myapi funnel push /pricing --funnel <new_funnel_id>
 
-# Pipe directly from a generator
-my-html-gen        | myapi funnel push /landing
+# Inspect what's published before touching an existing funnel
+myapi funnel pages  --funnel <funnel_id>
+myapi funnel verify /pricing --funnel <funnel_id>
 
-# Inspect what's published
-myapi funnel pages
-myapi funnel verify /pricing
+# Deliberately replace a live page (only after confirming it's the right target)
+cat new-home.html | myapi funnel push / --funnel <funnel_id> --force
 
 # Clean up
-myapi funnel delete <funnel_id>
+myapi funnel delete <funnel_id> --org <org_id>
 ```
 
-Omitting `[slug]` defaults to `/`. The funnel id is resolved from `--funnel`, the saved default funnel, or — only if the org has exactly one funnel — auto-picked.
+Omitting `[slug]` defaults to `/`. The funnel id is resolved from `--funnel`, the saved default funnel, or — only if the org has exactly one funnel — auto-picked (so an unintended push can silently land on an existing site; pass `--funnel` to be sure). `push` refuses to overwrite an occupied slug without `--force`.
 <!-- llm:end -->
 
 ## Form submissions (canonical recipe)
 
 The funnel submit proxy is the canonical form-capture path. **Never hardcode `https://api.mywebhookapi.com/webhook/in/<slug>` into funnel HTML** — that URL leaks into your git history, breaks on rotation, gets scraped, and locks the platform out of future form-quality features (rate-limit, captcha, anti-bot, field validation). Use the proxy instead — same plumbing, hidden URL, automatic CRM ingest on `email`.
 
-Zero-config form (the happy path most agents want):
+Zero-config form (the happy path most agents want) — still pin the org + funnel so the snippet and the page land in the namespace you mean (see **Namespace & safety**):
 
 ```bash
-myapi funnel create
-myapi funnel form --slug join --fields email:required,name > snippet.html
+myapi funnel create --name acme-demo --org <org_id>
+myapi funnel form --slug join --fields email:required,name --funnel <funnel_id> > snippet.html
 # paste snippet.html into your page (or pipe through funnel push):
-cat page-with-snippet.html | myapi funnel push /
+cat page-with-snippet.html | myapi funnel push / --funnel <funnel_id>
 # Submissions land in the funnel's auto-provisioned webhook → CRM upsert on `email` → any bound workflow fires.
 ```
 
+`funnel form` always registers a per-slug binding (idempotent on repeat). Without `--capture-to` it auto-targets the funnel's `org_webhook_id` — same destination as the fallback, with server-side honeypot + field validation turned on.
+
 Multi-form funnel (each slug to a different destination):
 
 ```bash
@@ -95,7 +112,8 @@ myapi funnel form <funnel_id> --slug survey \
 
 ## Notes
 
-- Set defaults with `myapi config set-org <id>` and `myapi config set-funnel <id>` to skip flags on every command.
+- Set defaults with `myapi config set-org <id>` and `myapi config set-funnel <id>` to skip flags on every command — but a stale default is exactly how a push lands on the wrong org/funnel. For demos and one-offs, pass `--org`/`--funnel` explicitly instead of relying on whatever default was set last.
+- `push` (any slug) and `publish --env prod` overwrite live content and are refused without `--force` when something already exists at the target. `--force` means "yes, replace the live page/site" — confirm you're aimed at the right `(org, funnel, slug)` before using it, don't use it to silence the error.
 - Deleting a funnel purges all its edge pages immediately.
 - `402` errors mean insufficient credits — run `myapi billing topup <amount>`.
 

package/dist/skills/my-llm-api/SKILL.md

@@ -89,6 +89,22 @@ Shared usage block on every verb:
 
 The model/provider is **never** named in the verb response. That's the point — the verb is the contract, the model is implementation.
 
+### OpenAI-compatible drop-in
+
+`POST /llm/orgs/{org_id}/chat/completions` (and `/v1/chat/completions` alias) accepts the OpenAI request shape and returns the OpenAI response shape — **no envelope**. Same catalog and pricing as raw `complete`. Use it when existing OpenAI SDK / LangChain / any `base_url`-configurable tooling should point at MyAPI without rewriting.
+
+```python
+from openai import OpenAI
+client = OpenAI(
+    api_key="hq_live_…",
+    base_url="https://api.myapihq.com/llm/orgs/<org_id>/v1",
+)
+r = client.chat.completions.create(model="Qwen/Qwen3-Coder-30B-A3B-Instruct",
+    messages=[{"role":"user","content":"Hi"}])
+```
+
+Use raw `complete` (MyAPI shape) for first-party integrations; use the OpenAI-compat path for compatibility with existing client code.
+
 <!-- llm:end -->
 
 ## Commands
@@ -145,10 +161,7 @@ INTENT=$(printf '%s' "$BODY" | myapi llm classify - \
 
 ## Notes
 
-- **`draft` context safety — what the platform does and doesn't do.** Every field in `context` is quoted into the prompt as referent data the model is told to incorporate.  Sensitive-named keys (`secret`, `api_key`, `password`, `token`, etc.) are **not** automatically redacted — if you pass `{"secret": "abc123"}`, the model may include `"abc123"` in the output.  The verb does two things on top:
-  - **Injection defense.** Keys named `instructions`, `system`, `system_prompt`, `prompt`, `override`, `directives`, and the JS prototype-pollution sentinels are stripped at the boundary and surfaced in `meta.warnings`; the model can't be hijacked through them.
-  - **Output guardrail.** After generation, every fact value (length ≥ 4) is substring-scanned in the output; matches surface under `meta.guardrails.facts_in_output: ["secret", "api_key", ...]`.  This is a **signal, not a redaction** — you see when a value landed in the body.
-  Rule of thumb: if a value must not appear in the output, **do not put it in `context`**.  Pass identifiers (recipient name, account id, topic) and let the prompt reference them indirectly; keep credentials, PII, and any internal-only metadata out of the body entirely.
-- **Self-hosted raw, server-picked verbs.** Raw runs on MyAPI's TPU; verbs route wherever the server picks (future proprietary models land here, wrapped behind the verb contract).
-- **Cost + latency.** `usage.cost_cents` is authoritative — no markup today. Qwen3-Coder-30B-A3B: 200–600ms to first token, 1–3s end-to-end on a few-hundred-token reply.
-- **Live catalog, no streaming, no BYOK.** Don't hard-code model ids — `models` is the source of truth (CLI picks if `--model` omitted). Full reply only.
+- **`draft` context safety.** `context` fields are quoted into the prompt verbatim; sensitive-named keys (`secret`, `api_key`, `password`, …) are NOT redacted. Two guards on top: (a) injection-defense strips `instructions`/`system`/`prompt`/`override` keys and surfaces them in `meta.warnings`; (b) output guardrail substring-scans fact values (length ≥ 4) in the response and lists matches in `meta.guardrails.facts_in_output` (signal, not redaction). Rule of thumb: never put credentials, PII, or internal metadata in `context` — pass identifiers, reference them indirectly.
+- **Self-hosted raw, server-picked verbs.** Raw runs on MyAPI's TPU; verbs route wherever the server picks.
+- **Cost + latency.** `usage.cost_cents` is authoritative — no markup. Qwen3-Coder-30B: 200–600 ms to first token, 1–3 s end-to-end.
+- **Live catalog, no streaming, no BYOK.** Don't hard-code ids — `models` is truth (CLI auto-picks if `--model` omitted). Full reply only.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.3.8",
+  "version": "1.3.12",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -30,7 +30,7 @@
     "lint:skills:strict": "node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.3.8"
+    "@myapihq/sdk": "^1.3.12"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",