@myapihq/cli 2.1.0 → 2.3.1

package/dist/commands/authproduct.d.ts

@@ -3,5 +3,5 @@ import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const SCHEMA: FlagSchema;
 export declare const EXPOSES: Exposes;
-export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register and list OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
+export declare const HELP = "Usage: myapi auth <subcommand>\n\nAuthentication for your app's end users \u2014 a managed OIDC identity provider\n(\u00E0 la Kinde/Auth0). One auth tenant per org; register OIDC clients (apps)\nagainst it; sign users in via the hosted login page or the JS SDK; verify\ntokens locally against the tenant JWKS.\n\nEnd users sign in with managed Google, email/password, or magic links \u2014 pick\nwhich via `tenant create --connections`. (Operator/account commands moved to\n`myapi account`.)\n\nSubcommands:\n  client   Register, list, delete, and rotate OIDC clients (your apps)\n  domain   Serve auth on your own domain (auth.acme.com)\n  tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)\n  usage    Monthly active users (MAU) for the current period";
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/authproduct.js

@@ -1,5 +1,6 @@
 import { auth as sdkAuth } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
+import { confirm, isNonInteractive } from '../prompt.js';
 import { success, error, info, printTable, printJson } from '../output.js';
 import { requireOrg } from '../helpers.js';
 // `myapi auth` — the END-USER auth product (my-auth-api): a managed OIDC IdP
@@ -21,8 +22,11 @@ export const EXPOSES = [
     'POST /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/usage',
+    'DELETE /auth/orgs/{org_id}/clients/{client_id}',
+    'POST /auth/orgs/{org_id}/clients/{client_id}/rotate',
     'POST /auth/orgs/{org_id}/domain',
     'GET /auth/orgs/{org_id}/domain',
+    'POST /auth/orgs/{org_id}/domain/verify',
     'DELETE /auth/orgs/{org_id}/domain',
 ];
 const SUBCOMMAND_USAGE = {
@@ -40,27 +44,35 @@ in against. One per org.
     'usage': `myapi auth usage [--org <id>] [--json]
 
 Monthly active users (MAU) for the current period — auth is billed per MAU.`,
-    'domain': `myapi auth domain [show|set|delete] [--domain <host>] [--org <id>] [--json]
+    'domain': `myapi auth domain [show|set|verify|delete] [--domain <host>] [--org <id>] [--json]
 
 Serve auth on your own domain (e.g. auth.acme.com) instead of the default issuer.
+Three steps: set → publish the ownership TXT → verify → publish the A record.
 
   myapi auth domain                         Show the current custom domain + status
-  myapi auth domain set --domain auth.acme.com   Register it (prints the DNS record to create)
+  myapi auth domain set --domain auth.acme.com   Register it (prints a TXT challenge to publish)
+  myapi auth domain verify                  Check the TXT; on success prints the A record
   myapi auth domain delete                  Remove the custom domain
 
-After 'set', create the printed DNS A record; TLS provisions automatically
-(~30 min) and the domain becomes your issuer once active.`,
-    'client': `myapi auth client <list|create> [--org <id>] [--json]
+Flow: 'set' returns a TXT record to prove ownership; create it, then 'verify'.
+Once verified, create the printed A record; TLS provisions automatically (~30 min)
+and the domain becomes your issuer when active.`,
+    'client': `myapi auth client <list|create|delete|rotate> [--org <id>] [--json]
 
 OIDC clients are the apps that authenticate against your tenant.
 
   myapi auth client list
   myapi auth client create --name "My App" --type spa --redirect https://app.example.com/callback
+  myapi auth client delete <client_id> [--yes]
+  myapi auth client rotate <client_id>
 
-  --name <n>          Human label for the app (required)
+  --name <n>          Human label for the app (required for create)
   --type spa|web      spa = public (no secret); web = confidential (secret once)
-  --redirect <urls>   Allowed redirect URIs, comma-separated (required).
-                      Absolute https (or http://localhost for dev).`,
+  --redirect <urls>   Allowed redirect URIs, comma-separated (required for create).
+                      Absolute https (or http://localhost for dev).
+
+delete  Revoke a client (irreversible; stops authenticating immediately).
+rotate  Re-issue a 'web' client's secret (shown once; old secret stops working).`,
 };
 export const HELP = `Usage: myapi auth <subcommand>
 
@@ -74,7 +86,7 @@ which via \`tenant create --connections\`. (Operator/account commands moved to
 \`myapi account\`.)
 
 Subcommands:
-  client   Register and list OIDC clients (your apps)
+  client   Register, list, delete, and rotate OIDC clients (your apps)
   domain   Serve auth on your own domain (auth.acme.com)
   tenant   Show or create your org's OIDC auth tenant (+ sign-in methods)
   usage    Monthly active users (MAU) for the current period`;
@@ -165,25 +177,34 @@ async function usage(flags) {
     info(`Period:       ${u.period}`);
     info(`Active users: ${u.active_users} MAU`);
     info(`Price:        $${(u.price_cents_each / 100).toFixed(2)} per MAU`);
+    if (u.as_of)
+        info(`As of:        ${u.as_of} (MAU is aggregated, not real-time)`);
 }
 async function domain(args, flags) {
     const action = args[0] || 'show';
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi auth domain [show|set|delete] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi auth domain [show|set|verify|delete] [--org <id>]');
     const showDomain = (d) => {
         info(`Domain: ${d.domain}`);
         info(`Status: ${d.status}`);
-        if (d.status !== 'active') {
+        if (d.status === 'awaiting_verification' && d.verification) {
+            info('');
+            info('Prove ownership — create this DNS record:');
+            info(`  ${d.verification.type}  ${d.verification.name}  →  ${d.verification.value}`);
+            info('\nThen run: myapi auth domain verify');
+        }
+        else if (d.dns) {
             info('');
-            info(`DNS — create this record:`);
+            info('DNS — create this record:');
             info(`  ${d.dns.type}  ${d.dns.name}  →  ${d.dns.value}`);
-            if (d.next)
-                info(`\n${d.next}`);
         }
-        else {
+        if (d.status === 'active') {
             info(`Issuer:    ${d.issuer}`);
             info(`Login URL: ${d.login_url}`);
         }
+        else if (d.next) {
+            info(`\n${d.next}`);
+        }
     };
     if (action === 'show') {
         try {
@@ -215,6 +236,35 @@ async function domain(args, flags) {
         showDomain(d);
         return;
     }
+    if (action === 'verify') {
+        try {
+            const d = await sdkAuth.verifyDomain(config.api_key, orgId);
+            if (flags.json) {
+                printJson(d);
+                return;
+            }
+            if (d.status === 'awaiting_verification') {
+                // Shouldn't normally happen (backend returns 422 when unverified), but
+                // be defensive.
+                info('Still awaiting verification — the TXT record was not found.');
+                showDomain(d);
+            }
+            else {
+                success(`Ownership verified — domain is now "${d.status}".`);
+                showDomain(d);
+            }
+        }
+        catch (e) {
+            if (e?.code === 'DOMAIN_NOT_VERIFIED') {
+                const exp = e?.body?.expected;
+                error(`Ownership TXT record not found yet (DNS can take a few minutes). Create it and retry:\n  ${exp ? `${exp.type}  ${exp.name}  →  ${exp.value}` : 'see: myapi auth domain show'}`);
+            }
+            if (e?.code === 'NO_DOMAIN' || e?.status === 404)
+                error('No custom auth domain set. Set one first: myapi auth domain set --domain auth.example.com');
+            throw e;
+        }
+        return;
+    }
     if (action === 'delete' || action === 'remove') {
         const host = flags.domain || args[1];
         let target = host;
@@ -231,12 +281,12 @@ async function domain(args, flags) {
         success(`Custom auth domain removed: ${target}`);
         return;
     }
-    error(`Unknown action "${action}". Use: myapi auth domain [show|set|delete]`);
+    error(`Unknown action "${action}". Use: myapi auth domain [show|set|verify|delete]`);
 }
 async function client(args, flags) {
     const action = args[0] || 'list';
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi auth client <list|create> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi auth client <list|create|delete|rotate> [--org <id>]');
     if (action === 'list') {
         const res = await sdkAuth.listClients(config.api_key, orgId);
         if (flags.json) {
@@ -282,5 +332,48 @@ async function client(args, flags) {
         }
         return;
     }
-    error(`Unknown action "${action}". Use: myapi auth client <list|create>`);
+    if (action === 'delete') {
+        const clientId = args[1];
+        if (!clientId)
+            error('Usage: myapi auth client delete <client_id> [--yes]');
+        // Destructive + irreversible — echo the exact client_id and confirm (the
+        // client stops authenticating immediately). --yes bypasses; refuse to hang
+        // in non-interactive contexts without it.
+        if (!flags.yes && !flags.y) {
+            if (isNonInteractive()) {
+                error(`Deleting client ${clientId} is irreversible. Re-run with --yes:\n  myapi auth client delete ${clientId} --yes`);
+            }
+            const ok = await confirm(`› Delete OIDC client ${clientId}? It stops authenticating immediately. (y/N) `, false);
+            if (!ok) {
+                info('Cancelled.');
+                return;
+            }
+        }
+        const res = await sdkAuth.deleteClient(config.api_key, orgId, clientId);
+        if (flags.json) {
+            printJson(res);
+            return;
+        }
+        success(`Client deleted: ${clientId}`);
+        return;
+    }
+    if (action === 'rotate') {
+        const clientId = args[1];
+        if (!clientId)
+            error('Usage: myapi auth client rotate <client_id>');
+        const c = await sdkAuth.rotateClient(config.api_key, orgId, clientId);
+        if (flags.json) {
+            printJson(c);
+            return;
+        }
+        success(`Secret rotated for client: ${c.client_id || clientId}`);
+        info('The previous secret stops working immediately.');
+        if (c.client_secret) {
+            info('');
+            info('New client secret (shown ONCE — store it now, it cannot be retrieved again):');
+            info(`  ${c.client_secret}`);
+        }
+        return;
+    }
+    error(`Unknown action "${action}". Use: myapi auth client <list|create|delete|rotate>`);
 }

package/dist/commands/llm.js

@@ -47,6 +47,25 @@ async function defaultChatModel(apiKey, orgId) {
     }
     return chat.id;
 }
+// Resolve the embed model from --model, else the live catalog. Unlike chat
+// we don't silently pick a default when several are served — embedding
+// vectors aren't cross-model compatible, so an ambiguous pick is a footgun.
+// One served embed model → use it; none → catalog-truthful error (not a
+// hardcoded "not available today"); many → make the caller choose.
+async function resolveEmbedModel(apiKey, orgId, flags) {
+    if (typeof flags.model === 'string' && flags.model)
+        return flags.model;
+    const embeds = (await loadModels(apiKey, orgId)).filter(m => m.kind === 'embed');
+    if (embeds.length === 1)
+        return embeds[0].id;
+    if (embeds.length === 0) {
+        error('No embedding model is currently served — the catalog has none. Run "myapi llm models --kind embed" to check.');
+    }
+    else {
+        error(`Multiple embedding models available — pass --model <id>. Options: ${embeds.map(m => m.id).join(', ')}`);
+    }
+    throw new Error('unreachable'); // satisfy the type checker
+}
 function readPromptArg(promptArg, flags) {
     if (typeof flags.file === 'string' && flags.file) {
         return fs.readFileSync(flags.file, 'utf-8');
@@ -140,10 +159,8 @@ async function complete(promptArg, flags) {
 }
 async function embed(inputArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi llm embed "<text>" --model <id> [--org <id>]');
-    const model = typeof flags.model === 'string' ? flags.model : '';
-    if (!model)
-        error('Missing required flag: --model. Run "myapi llm models" to list embed models.');
+    const orgId = requireOrg(flags, config, 'myapi llm embed "<text>" [--model <id>] [--org <id>]');
+    const model = await resolveEmbedModel(config.api_key, orgId, flags);
     const text = readPromptArg(inputArg, flags);
     if (!text.trim())
         error('Empty input. Pass <text> as an argument, "-" to read stdin, or --file <path>.');
@@ -283,8 +300,7 @@ const SUBCOMMAND_USAGE = {
        [--stop <csv>] [--file <path>] [--org <id>] [--json]
 
   Raw chat completion against a self-hosted catalog model. Without --model,
-  picks the first chat model from "myapi llm models" (today:
-  Qwen/Qwen3-Coder-30B-A3B-Instruct).
+  picks the first chat model from "myapi llm models".
 
   Pass "-" as the prompt to read from stdin. The reply goes to stdout; a
   one-line usage footer (tokens + cost in cents) goes to stderr so it
@@ -293,10 +309,11 @@ const SUBCOMMAND_USAGE = {
   Examples:
     myapi llm complete "summarize: $(cat README.md)"
     cat draft.md | myapi llm complete - --system "You are an editor" --max-tokens 200`,
-    embed: `myapi llm embed "<text>" --model <id> [--file <path>] [--org <id>] [--json]
+    embed: `myapi llm embed "<text>" [--model <id>] [--file <path>] [--org <id>] [--json]
 
-  No embedding model is served on the raw catalog today — this returns
-  EMBED_NOT_AVAILABLE until one is. Use a dedicated embedding API for now.`,
+  Embed text into a dense vector. --model is optional when the catalog serves
+  exactly one embedding model; otherwise pass one from "myapi llm models
+  --kind embed". Returns EMBED_NOT_AVAILABLE if no embedding model is served.`,
     models: `myapi llm models [--kind chat|embed] [--org <id>] [--json]
 
   Lists the live model catalog with per-1M-token pricing in cents.
@@ -358,7 +375,7 @@ Subcommands:
   classify    Pick a label from a set
   complete    Raw chat completion against a catalog model
   draft       Write something (email | reply | message | …)
-  embed       Raw embeddings (no model served on raw today)
+  embed       Raw embeddings against a catalog embed model
   extract     Pull structured data conforming to a JSON Schema
   models      List the live model catalog (id, kind, context, cents/1M)
   summarize   Summarize text (brief | exec | bullet)

package/dist/skills/my-api-hq/SKILL.md

@@ -13,7 +13,7 @@ The root service. It manages accounts, API keys, organizations, and billing. No
 
 ## Capabilities
 <!-- llm:start -->
-MyApiHQ is the platform's foundation. Every other service (domain, funnel, email, image, storage, pixel, webhook, workflow, url) requires both an `api_key` and (for org-scoped resources) an `org_id` minted here. Setup is one command — `myapi account setup` — which provisions an account, generates an api_key, creates a default org, and stores everything in `~/.myapi/config.json`. Subsequent commands pick up those defaults automatically.
+MyApiHQ is the platform's foundation. Every other service (domain, funnel, auth, payments, fn, workflow, database, storage, email, webhook, crm, llm, image, pixel, url) requires both an `api_key` and (for org-scoped resources) an `org_id` minted here. Setup is one command — `myapi account setup` — which provisions an account, generates an api_key, creates a default org, and stores everything in `~/.myapi/config.json`. Subsequent commands pick up those defaults automatically.
 
 ```
 myapihq  ──►  org_id + api_key

package/dist/skills/my-auth-api/SKILL.md

@@ -39,9 +39,10 @@ its clients.
   returns a `client_secret` **once** — store it immediately. `--redirect` lists
   allowed callback URIs (absolute https, or http://localhost for dev).
 - **Usage** — `auth usage` shows monthly active users (auth is billed per MAU).
-- **Custom domain** — `auth domain set --domain auth.acme.com` serves auth on
-  your own domain; it prints the DNS record, TLS provisions automatically, and
-  the domain becomes your issuer once active.
+- **Custom domain** — serve auth on `auth.acme.com`. Three steps: `auth domain
+  set --domain auth.acme.com` prints a **TXT ownership challenge**; publish it,
+  then `auth domain verify`; that prints the **A record** to publish, TLS
+  provisions automatically, and the domain becomes your issuer once active.
 
 **Sign-in methods** are chosen per tenant via
 `auth tenant create --connections google,password,magic` (default `google`):
@@ -61,8 +62,10 @@ CLI is only the management surface.
 | `myapi auth tenant create` | Create/enable the tenant (`--connections google,password,magic`; `--theme <json>`) |
 | `myapi auth client list` | List the OIDC clients (apps) registered to your tenant |
 | `myapi auth client create` | Register an OIDC client (`--name`, `--type spa\|web`, `--redirect`) |
-| `myapi auth usage` | Monthly active users (MAU) for the current period |
-| `myapi auth domain` | Show/set/delete a custom auth domain (`set --domain auth.acme.com`) |
+| `myapi auth client delete <id>` | Revoke a client (irreversible); `--yes` to skip the confirm |
+| `myapi auth client rotate <id>` | Re-issue a `web` client's secret (shown once) |
+| `myapi auth usage` | Monthly active users (MAU) for the current period (`as_of` shows freshness) |
+| `myapi auth domain` | Custom auth domain: `set` (TXT challenge) → `verify` → A record; also `show`/`delete` |
 <!-- generated:end -->
 
 ## Examples

package/dist/skills/my-llm-api/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: my-llm-api
-version: 1.1.0
+version: 1.2.0
 description: >
   Two-surface LLM primitive. Raw chat completion against self-hosted
   open-source models (you pick the model), and objective verbs
@@ -14,7 +14,7 @@ checksum: sha256-pending
 
 A two-surface LLM gateway:
 
-- **Raw** — `complete` / `embed` / `models`. You pick a self-hosted catalog model (today: `Qwen/Qwen3-Coder-30B-A3B-Instruct`). Proprietary models are not callable here.
+- **Raw** — `complete` / `embed` / `models`. You pick a self-hosted catalog model (run `myapi llm models` for the live list). Proprietary models are not callable here.
 - **Verbs** — `classify` / `extract` / `summarize` / `draft`. You ask for a task done; the model is implementation detail and is never named in the response.
 
 Pricing is in cents per 1M tokens at the actual upstream rate; cost is debited from your MyAPI balance.
@@ -33,7 +33,7 @@ Use this for workflow tasks — summarize a doc, classify an inbound email, extr
 ### Raw `complete` request
 ```json
 {
-  "model": "Qwen/Qwen3-Coder-30B-A3B-Instruct",
+  "model": "<model-id>",
   "messages": [
     { "role": "system", "content": "You are a terse editor." },
     { "role": "user",   "content": "Tighten this paragraph: ..." }
@@ -49,7 +49,7 @@ Roles: `system | user | assistant`. Multiple system messages collapse to one ins
 ### Raw `complete` response
 ```json
 {
-  "model": "Qwen/Qwen3-Coder-30B-A3B-Instruct",
+  "model": "<model-id>",
   "content": "...assistant reply...",
   "finish_reason": "stop",
   "usage": { "input_tokens": 42, "output_tokens": 87, "cost_cents": 0.029 }
@@ -62,7 +62,7 @@ If `model` isn't in the self-hosted catalog the server returns `MODEL_NOT_IN_RAW
 
 ### Raw `embed`
 
-No embedding model is served on the raw catalog today; calls return `EMBED_NOT_AVAILABLE`. Use a dedicated embedding API for now.
+Embed text into a dense vector. `--model` is optional when the catalog serves exactly one embed model; else pass one from `myapi llm models --kind embed`. Returns `EMBED_NOT_AVAILABLE` when none is served.
 
 ### Model catalog
 - Chat models: `id`, `kind: 'chat'`, `context_window`, `input_cost_per_1m_cents`, `output_cost_per_1m_cents`
@@ -99,11 +99,11 @@ client = OpenAI(
     api_key="hq_live_…",
     base_url="https://api.myapihq.com/llm/orgs/<org_id>/v1",
 )
-r = client.chat.completions.create(model="Qwen/Qwen3-Coder-30B-A3B-Instruct",
+r = client.chat.completions.create(model="<model-id>",
     messages=[{"role":"user","content":"Hi"}])
 ```
 
-Use raw `complete` (MyAPI shape) for first-party integrations; use the OpenAI-compat path for compatibility with existing client code.
+Use raw `complete` for first-party code; the compat path for existing OpenAI/LangChain tooling.
 
 <!-- llm:end -->
 
@@ -113,7 +113,7 @@ Use raw `complete` (MyAPI shape) for first-party integrations; use the OpenAI-co
 |---|---|
 | `myapi llm models [--kind chat\|embed] [--json]` | List the live model catalog with pricing (cents/1M) |
 | `myapi llm complete "<prompt>" [--model <id>] [--system "<s>"] [--max-tokens N] [--temperature 0..1] [--stop <csv>] [--file <path>] [--json]` | Raw chat completion; reply to stdout, usage to stderr. Defaults to the first chat model in the catalog |
-| `myapi llm embed "<text>" --model <id> [--json]` | Embed a string (no model served today — returns EMBED_NOT_AVAILABLE) |
+| `myapi llm embed "<text>" [--model <id>] [--json]` | Embed a string into a vector; `--model` optional when the catalog has one embed model |
 | `myapi llm classify "<input>" --labels <csv> [--multi] [--tier <t>] [--json]` | Pick a label from a set |
 | `myapi llm extract "<input>" --schema <path\|json> [--tier <t>] [--json]` | Pull structured data conforming to a JSON Schema |
 | `myapi llm summarize "<input>" [--style brief\|exec\|bullet] [--tier <t>] [--json]` | Summarize text |
@@ -132,9 +132,9 @@ myapi llm models --kind chat --json | jq '.models[].id'
 # Raw completion — picks the first chat model from the catalog
 myapi llm complete "Summarize in 12 words: $(cat README.md)"
 
-# Pin a specific model
+# Pin a specific model (ids come from `myapi llm models`)
 myapi llm complete "Refactor this function: ..." \
-  --model Qwen/Qwen3-Coder-30B-A3B-Instruct \
+  --model <model-id> \
   --system "You are a careful Go reviewer." \
   --max-tokens 600
 
@@ -163,5 +163,5 @@ INTENT=$(printf '%s' "$BODY" | myapi llm classify - \
 
 - **`draft` context safety.** `context` fields are quoted into the prompt verbatim; sensitive-named keys (`secret`, `api_key`, `password`, …) are NOT redacted. Two guards on top: (a) injection-defense strips `instructions`/`system`/`prompt`/`override` keys and surfaces them in `meta.warnings`; (b) output guardrail substring-scans fact values (length ≥ 4) in the response and lists matches in `meta.guardrails.facts_in_output` (signal, not redaction). Rule of thumb: never put credentials, PII, or internal metadata in `context` — pass identifiers, reference them indirectly.
 - **Self-hosted raw, server-picked verbs.** Raw runs on MyAPI's TPU; verbs route wherever the server picks.
-- **Cost + latency.** `usage.cost_cents` is authoritative — no markup. Qwen3-Coder-30B: 200–600 ms to first token, 1–3 s end-to-end.
+- **Cost + latency.** `usage.cost_cents` is authoritative — no markup. Varies by tier: 200–600 ms to first token, 1–3 s end-to-end.
 - **Live catalog, no streaming, no BYOK.** Don't hard-code ids — `models` is truth (CLI auto-picks if `--model` omitted). Full reply only.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.1.0",
+  "version": "2.3.1",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -31,7 +31,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.1.0"
+    "@myapihq/sdk": "^2.3.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",