@myapihq/cli 2.10.0 → 2.11.0

package/dist/skills/my-storage-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-storage-api
-version: 1.0.0
+version: 1.1.0
 description: >
   Edge-hosted asset storage. Upload a local file of any content type directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
 triggers: [storage, upload, ingest, asset, cdn, image hosting, file upload, get-url, download, public url]
-checksum: sha256-1f3e7f6de3435e0334a808b9d2faa978c9cb70982509a376abc0e539cb44e1ed
+checksum: sha256-1452c30c103d0bb8b76a8f6d8e1688cadd556922b8c60e7ac754222c33b65524
 ---
 
 # MyStorageAPI
@@ -13,7 +13,7 @@ Per-org asset storage with edge CDN delivery. Two ways in: direct upload (local
 
 ## Capabilities
 <!-- llm:start -->
-Storage is the asset layer. Anything you upload or ingest is served from the edge under a permanent public URL — embed it in funnel pages, email templates, anywhere.
+Storage is the asset layer. By default an upload is served from the edge under a permanent public URL — embed it in funnel pages, email templates, anywhere. Pass `--private` for anything holding personal data: no public URL is created and reads go through a signed, expiring link (see **Notes**).
 
 `upload` accepts **any content type** from the local filesystem. There is no
 extension allowlist — an unrecognized type is stored as an opaque blob and
@@ -49,6 +49,9 @@ Use `get` for a round-trip metadata fetch. Use `get-url` when you just need the
 | `myapi storage ingest <url>` | Server fetches a public URL into storage |
 | `myapi storage get <asset_id>` | Round-trip the API for full metadata (`--json` or human block) |
 | `myapi storage get-url <asset_id>` | Pure local URL constructor — no API call, no auth |
+| `myapi storage visibility <asset_id> <public\|private>` | Flip an asset's visibility. Going private stops the plain URL serving, immediately |
+| `myapi storage sign <asset_id> [--ttl <seconds>]` | Time-limited link to a private asset (default 900s, max 86400). Billable |
+| `myapi storage revoke-links <asset_id>` | Kill every signed link, including unexpired ones |
 | `myapi storage delete <asset_id>` | Permanently delete the asset |
 <!-- generated:end -->
 
@@ -70,6 +73,14 @@ URL=$(myapi storage get-url <asset_id>)
 echo "<img src=\"$URL\" />"
 curl -O "$URL"
 
+# Anything holding personal data: upload private, hand out signed links
+myapi storage upload ./lease.pdf --private          # no public URL is created
+myapi storage sign <asset_id> --ttl 900             # 15-minute link to send
+
+# Close an exposure on a file already uploaded public
+myapi storage visibility <asset_id> private         # plain URL stops serving now
+myapi storage revoke-links <asset_id>               # and kill links already sent
+
 # Clean up
 myapi storage delete <asset_id>
 ```
@@ -89,16 +100,18 @@ Both produce identical asset records — `list` doesn't distinguish.
 
 ## Notes
 
-- **Assets are public, permanently, with no auth.** Anyone with the URL can
-  fetch it; there is no private mode, no signed URL, and no revocation. The id
-  being long and random is **not** access control — treat the URL as public the
-  moment it exists.
-- **Private assets exist as of 2026-07-28** — upload with `visibility: private`,
-  or `PATCH` an existing asset to close an exposure, which takes effect
-  immediately. Fetch it with a signed URL (15 minutes default, 24 hours max);
-  `revoke-links` kills every link already handed out, including unexpired ones.
-  A private upload deliberately returns **no plain `url`**, because that URL
-  does not serve the file and would look like the answer.
+- **Public is the default, and public means forever with no credential.**
+  Anyone holding the URL can read it. A long random id is
+  **not** access control — treat the URL as public the moment it exists.
+- **Private assets exist — use them for anything holding personal data.**
+  `storage upload --private` stores a file with no public URL;
+  `storage visibility <id> private` closes an exposure on one already uploaded,
+  and takes effect at once. Read a private asset back with
+  `storage sign <id> --ttl <seconds>` (default 900, max 86400) — the link
+  carries its own authorisation, so it can go to someone with no MyAPI account.
+  `storage revoke-links <id>` kills every link already handed out, including
+  unexpired ones. A private upload deliberately returns **no plain `url`**,
+  because that URL does not serve the file and would look like the answer.
 - **Encrypting before upload is still worth doing for the strictest cases.**
   Private assets protect against the internet; client-side encryption protects
   against the platform, and those are different threat models. A team shipping
@@ -107,25 +120,20 @@ Both produce identical asset records — `list` doesn't distinguish.
 - Delete is immediate and unrecoverable — run `myapi storage list` first to confirm the asset, pass `--org` explicitly, and pass `--yes` in non-interactive runs.
 - The URL is permanent until you `myapi storage delete <id>` — embed it freely.
 
+## HTTP (from deployed code)
 
-## Calling this from deployed code (HTTP)
-
-The CLI is not what runs in production — a deployed function or container calls
-the HTTP API directly. That surface was previously only discoverable by
-grepping the CLI bundle, which cost one team an hour per slot.
-
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
 ```
-base    https://api.mystorageapi.com   ← not the gateway
-path    /storage/orgs/{org_id}/assets/upload   (multipart, field: file)
-auth    Authorization: Bearer <api key>
-        (inside a function: env.__MYAPI_KEY · inside a container: env.MYAPI_KEY)
-body    multipart/form-data
-reply   { "success": true, "data": …, "error": null, "meta": {…} }
-        Unwrap `data`. On failure `success` is false and `error` is
-        { code, message }.
+base   https://api.mystorageapi.com
+path   POST /storage/orgs/{org_id}/assets/upload
+body   multipart/form-data — field name is `file`
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
 ```
 
-**The org id goes in the PATH, not a header.** There is no `X-Org-Id`.
-**Base URLs differ per slot** — do not assume one host for everything.
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
 
 Run `myapi storage --help` for full flag reference.

package/dist/skills/my-task-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Agent-task queue — file units of work, rank them, claim under a lease, then resolve, fail, or cancel. The agent-loop hot path.
 triggers: [task, task queue, agent loop, work queue, claim task, resolve task, lease, backlog, to-do, assignee]
-checksum: sha256-ceb6cdfffe465d8b0cd232eaa16868c1b8c8b10288f1cf9b4174fdd48a8d2c18
+checksum: sha256-d674b4bc9a1cd49e7f9778e3d70418bee0496a85cf49e3381019b618bdca9994
 ---
 
 # MyTaskAPI
@@ -25,7 +25,7 @@ The loop is: **`list` → `get <id> --body` → `claim` → `resolve`/`fail`**.
 
 Task fields at creation: `description` (~100-token triage key), `body` (full Markdown), `importance`, `due`, `assignee` (emails them a magic link), `tags`, `depends_on` (immutable DAG — a task with unresolved deps starts blocked), `dedup_key` (idempotent), `resolve_on` (an event matcher — a matching platform event auto-resolves the task), `source`.
 
-**task vs workflow vs queue** — see `docs/orchestration-decision-guide.md`.
+**task vs workflow vs queue** — see the section at the end of this skill.
 <!-- llm:end -->
 
 ## Commands
@@ -79,4 +79,37 @@ myapi task create "Ship once payment clears" \
 - `--origin <s>` — records what created the task, and filters `task list`.
   (Formerly `--source`, which still works and is undocumented.)
 
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.myapihq.com
+path   POST /task/orgs/{org_id}/tasks
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
+
+## workflow vs queue vs task
+
+| If you are saying… | Use |
+|---|---|
+| "When this webhook arrives, do these steps." | **workflow** |
+| "Run this reliably, eventually — retry it, don't block on it." | **queue** |
+| "Someone (agent or human) needs to look at this and decide." | **task** |
+
+**Retry is not the distinction** — workflow and queue both retry. What differs
+is where the work runs: a workflow step runs inline during the delivery that
+triggered it; a queue job runs asynchronously against an external
+`consumer_url` under a concurrency cap. A task waits for a worker to `claim` it.
+
+They chain one way: a workflow's `enqueue_job` step hands durable work to a
+queue. And they listen to two different surfaces — workflow fires on inbound
+**webhook deliveries**; task `resolve_on` matches the internal **platform
+events** bus, which is not the CRM timeline.
+
 Run `myapi task --help` for the full flag reference.

package/dist/skills/my-url-to/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Stateful URL shortening service. Generate compact `myurlto.com` redirect links to long URLs. Often invoked implicitly by other backend services for outbound links.
 triggers: [shorten url, short link, url shortener, myurlto, redirect, short_code]
-checksum: sha256-2b83a7774da020adc3e61e411ff63b7ced7d9f160d22eb0a9291b701ad0fcf73
+checksum: sha256-11285f6fe1a88115b4f7da4abe4aa0e7706e77e591673b8c5c6377712c0aff85
 ---
 
 # MyURLToAPI
@@ -52,4 +52,19 @@ curl -L "https://myurlto.com/example.com/8f2a1b9c"
 - Short codes are stable — once minted, they don't change.
 - Required: a non-empty `url`. `400` if missing.
 
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.myurlto.com
+path   POST /url/orgs/{org_id}/shorten
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
+
 Run `myapi url --help` for flag reference.

package/dist/skills/my-webhook-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Inbound webhook endpoints for non-funnel sources — Stripe, GitHub, custom services. Funnel forms use the my-funnel-api proxy.
 triggers: [webhook, inbound, receiver, stripe events, github webhook, slack notification, delivery, payload, event ingest]
-checksum: sha256-17b358d780333cabe76cb01df3be3c3f11db10a2b068449bcf9e10e2ed89393d
+checksum: sha256-82459af69db91d535209978c09e011f5b893ba0f04f90d8b6a658058e0dc2374
 ---
 
 # MyWebhookAPI
@@ -56,9 +56,14 @@ myapi webhook deliveries
 myapi webhook delivery <delivery_id>
 ```
 
-### End-to-end recipe — contact form on your site
+### End-to-end recipe — contact form on a site you host yourself
 
-A contact form on yoursite.com that sends a thank-you email and a Slack ping when submitted:
+**Not for a MyAPI funnel.** This snippet puts the raw inbound URL in page
+source, which is exactly what the scope note above tells you not to do on a
+funnel. Use it only for a page MyAPI does not serve; on a funnel use
+`myapi funnel form` instead.
+
+A contact form that sends a thank-you email and a Slack ping when submitted:
 
 ```bash
 WID=$(myapi webhook create "contact-form" --json | jq -r .id)
@@ -108,4 +113,19 @@ The form sends `{name, email, message}` → webhook stores it → workflow runs
   `webhook deliveries` rather than silent.
 - `--description <text>` — free text, shown in `webhook list`.
 
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.mywebhookapi.com
+path   POST /webhook/orgs/{org_id}/endpoints
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
+
 Run `myapi webhook --help` for full flag reference.

package/dist/skills/my-workflow-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run actions when a webhook fires. Trigger emails, Slack notifications, or HTTP calls in response to inbound webhook deliveries — without writing a backend.
 triggers: [workflow, automation, on webhook, send email on, slack notification, payload templating, drip, trigger, run]
-checksum: sha256-eddc70a8542c3cdfd01866f241ea283164e71fbe748426a13358d1c7ef635cb1
+checksum: sha256-35b09cb26aa3781c78abdc2b362bdb8f0817a9580467bf94e65e0f2f335d502a
 ---
 
 # MyWorkflowAPI
@@ -97,11 +97,37 @@ myapi workflow enable <id>
 - Disable to stop firing without losing the configuration.
 - Deleting a workflow purges its run history; the webhook endpoint remains. Look before you delete: `myapi workflow list` first, pass `--org` explicitly; delete asks for confirmation — `--yes` required in non-interactive runs.
 
-## See also
+## workflow vs queue vs task
 
-`workflow` is one of three orchestration slots. Use **workflow** to react to
-inbound webhooks; use **my-queue-api** for durable retried machine work; use
-**my-task-api** for work that needs an agent/human decision. Full comparison:
-`docs/orchestration-decision-guide.md`.
+| If you are saying… | Use |
+|---|---|
+| "When this webhook arrives, do these steps." | **workflow** |
+| "Run this reliably, eventually — retry it, don't block on it." | **queue** |
+| "Someone (agent or human) needs to look at this and decide." | **task** |
+
+**Retry is not the distinction** — workflow and queue both retry. What differs
+is where the work runs: a workflow step runs inline during the delivery that
+triggered it; a queue job runs asynchronously against an external
+`consumer_url` under a concurrency cap.
+
+They chain one way: the `enqueue_job` step above hands durable work to a queue.
+And they listen to two different surfaces — workflow fires on inbound **webhook
+deliveries**; task `resolve_on` matches the internal **platform events** bus,
+which is not the CRM timeline.
+
+## HTTP (from deployed code)
+
+<!-- http:start -->
+<!-- generated by `npm run canonical-sync` — do not edit -->
+```
+base   https://api.myworkflowapi.com
+path   POST /workflow/orgs/{org_id}/workflows
+auth   Authorization: Bearer <key>   (fn: env.__MYAPI_KEY · container: env.MYAPI_KEY)
+reply  { "success": true, "data": …, "error": null, "meta": {…} }
+```
+
+- **Per-slot host** — do not assume one host serves every slot.
+- **Org id goes in the PATH** — there is no `X-Org-Id` header.
+<!-- http:end -->
 
 Run `myapi workflow --help` for full flag reference.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.10.0"
+    "@myapihq/sdk": "^2.11.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",