@myapihq/cli 2.11.2 → 2.12.0

package/dist/commands/feedback.d.ts

@@ -6,5 +6,6 @@ export declare const SCHEMA: FlagSchema;
 export declare function list(flags: Flags): Promise<void>;
 export declare function create(bodyArg: string | undefined, flags: Flags): Promise<void>;
 export declare function resolve(id: string, flags: Flags): Promise<void>;
+export declare function del(id: string | undefined, flags: Flags): Promise<void>;
 export declare function widget(sub: string | undefined, arg: string | undefined, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/feedback.js

@@ -13,6 +13,7 @@ export const EXPOSES = [
     'GET /feedback/orgs/{org_id}/items',
     'POST /feedback/orgs/{org_id}/items',
     'POST /feedback/orgs/{org_id}/items/{id}/resolve',
+    'DELETE /feedback/orgs/{org_id}/items/{id}',
     'POST /feedback/orgs/{org_id}/widgets',
     'DELETE /feedback/orgs/{org_id}/widgets/{id}',
 ];
@@ -92,6 +93,18 @@ export async function resolve(id, flags) {
     success(`Resolved ${id}`);
     info('(An unknown id answers the same way, so this is not confirmation the item existed.)');
 }
+export async function del(id, flags) {
+    const usage = 'myapi feedback delete <id> [--yes] [--org <id>]';
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, usage);
+    requireArg(id, 'id', usage);
+    // Erases rather than closes. `resolve` is the reversible one; this is not,
+    // so it takes the same confirmation every destructive verb here takes.
+    await confirmDestructive(flags, `permanently delete feedback ${id} (resolve keeps it; this erases it)`, usage);
+    await sdkFeedback.deleteFeedback(config.api_key, orgId, id);
+    success(`Deleted ${id}`);
+    info('(Idempotent — an unknown id answers the same way, so this is not confirmation the item existed.)');
+}
 export async function widget(sub, arg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi feedback widget create <name> | revoke <id>');
@@ -128,6 +141,11 @@ export async function widget(sub, arg, flags) {
     error('Usage: myapi feedback widget create <name> [--origins <list>]\n       myapi feedback widget revoke <id>');
 }
 const SUBCOMMAND_USAGE = {
+    'delete': `myapi feedback delete <id> [--yes] [--org <id>]
+
+Erases an item. \`resolve\` closes one and keeps it; this removes it — for spam,
+or a report where somebody typed personal details into the box. Idempotent, and
+an unknown id answers the same way.`,
     'list': `myapi feedback list [--kind bug|issue|suggestion] [--status open|resolved]
        [--limit N] [--offset N] [--org <id>] [--json]
 
@@ -151,6 +169,7 @@ page submit without a credential; you list, filter and resolve the results.
 
 Subcommands:
   create "<text>"      Record one piece of feedback (--kind bug|issue|suggestion)
+  delete <id>          Erase an item (resolve keeps it; this does not)
   list                 List feedback, newest first (--kind, --status, --limit, --offset)
   resolve <id>         Close a piece of feedback
   widget create <name> Mint a PUBLIC widget key for a site (--origins to restrict)
@@ -167,6 +186,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
     switch (subcommand) {
         case 'create': return create(args[0], flags);
         case 'list': return list(flags);
+        case 'delete': return del(args[0], flags);
         case 'resolve': return resolve(args[0], flags);
         case 'widget': return widget(args[0], args[1], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi feedback --help" for a list of valid subcommands.`);

package/dist/skills/my-feedback-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-feedback-api
-version: 1.1.0
+version: 1.2.0
 description: >
   Collect feedback from the people using what you built. A public widget key lets a page submit without a credential; you list, filter and resolve the results. Kind is chosen by the person reporting, not inferred from their wording.
 triggers: [feedback, bug report, user feedback, feature request, widget, support, complaints, praise]
-checksum: sha256-544fcdb87744431fe7c3adbda341bf858c6d4177695b811a3d29aa4a311c927b
+checksum: sha256-199fba185e85ccc91a6858bce4a60e20167a6591dee28cbc475606c72cb8d787
 ---
 
 # MyFeedbackAPI
@@ -33,30 +33,44 @@ myapi feedback widget create site --origins app.example.com,example.com
 Revoke with `myapi feedback widget revoke <id>`. Submissions stop immediately;
 feedback already collected is kept.
 
-### How a page submits with it
+### Embedding it: one script tag
 
-`POST https://api.myapihq.com/feedback/in/<widget_key>` — no auth, no SDK, no
-CLI. This is the browser-side half, and it is the whole point of the widget key.
+The platform hosts the widget, compiled per key with that widget's routes and
+theme baked in. This is the intended way in — you do not build a UI:
+
+```html
+<script src="https://api.myapihq.com/feedback/in/<widget_key>/widget.js" async></script>
+```
+
+It renders a button, shows itself only on the routes the widget is configured
+for, and lets the person point at an element or drag a region. It sends `kind`,
+`body`, `page_url`, `route`, `viewport`, plus **either** `target_selector` (they
+clicked something) **or** `target_region` `{x,y,w,h}` (they dragged a box).
+
+A wrong key does not break the page: the response is `application/javascript`
+carrying a JS comment that names the fix, so a typo cannot throw a syntax error
+in your app.
+
+**No screenshots.** The submit body takes no image and there is no multipart
+form — `target_selector` / `target_region` are the platform's answer to "where
+were they pointing". Do not build a capture step expecting somewhere to put it.
+
+### Submitting by hand (only if you cannot use the script)
+
+`POST https://api.myapihq.com/feedback/in/<widget_key>` — no auth, no SDK.
+Same fields the widget sends:
 
 ```js
 await fetch(`https://api.myapihq.com/feedback/in/${WIDGET_KEY}`, {
   method: 'POST',
   headers: { 'Content-Type': 'application/json' },
-  body: JSON.stringify({
-    kind: 'bug',                    // required — bug | issue | suggestion
-    body: text,                     // required — ≤8000 chars, refused not truncated
-    page_url: location.href,        // optional context, all of it
-    route: router.currentRoute,
-    target_selector: '#checkout button',
-    target_region: { x, y, w, h },  // viewport pixels, e.g. a dragged box
-    viewport: { w: innerWidth, h: innerHeight },
-  }),
+  body: JSON.stringify({ kind: 'bug', body: text, page_url: location.href }),
 });
 ```
 
-Errors are `WIDGET_NOT_FOUND` (revoked reads the same as invented, so keys
+Errors: `WIDGET_NOT_FOUND` (a revoked key reads like an invented one, so keys
 cannot be probed), `ORIGIN_NOT_ALLOWED`, `RATE_LIMITED`, `INVALID_KIND`,
-`BODY_REQUIRED`, `BODY_TOO_LONG`. The key can only write — it reads nothing.
+`BODY_REQUIRED`, `BODY_TOO_LONG`. The key only ever writes.
 
 ### Kind is a claim, not a guess
 
@@ -87,7 +101,8 @@ that is deliberate, so ids cannot be probed across orgs.
 |---|---|
 | `myapi feedback create "<text>" --kind <k>` | Record one item (`--page-url`, `--route` for context) |
 | `myapi feedback list [--kind bug\|issue\|suggestion] [--status open\|resolved] [--limit N] [--offset N]` | List feedback, newest first |
-| `myapi feedback resolve <id>` | Close an item |
+| `myapi feedback resolve <id>` | Close an item, keeping it |
+| `myapi feedback delete <id>` | Erase an item — for spam, or personal details typed into the box |
 | `myapi feedback widget create <name> [--origins a.com,b.com]` | Mint a PUBLIC widget key for a site |
 | `myapi feedback widget revoke <id>` | Revoke a key; collected feedback is kept |
 <!-- generated:end -->
@@ -117,6 +132,9 @@ myapi feedback resolve <id>
 - The widget key is public by design — restrict it with `--origins` rather than hiding it.
 - `resolve` is idempotent and deliberately indistinguishable from an unknown id.
 - Feedback survives widget revocation.
+- **`resolve` keeps, `delete` erases.** A public inbox collects spam and the
+  occasional report with personal details in it; `delete` is how those leave.
+  Both are idempotent and answer the same for an unknown id.
 
 ## HTTP (from deployed code)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.11.2",
+  "version": "2.12.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.11.2"
+    "@myapihq/sdk": "^2.12.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",