@myapihq/cli 2.2.0 → 2.4.0

package/dist/errors.js

@@ -0,0 +1,62 @@
+// Per-code friendly messages for MyApiError.code. Kept in its own module (not
+// index.ts) so it can be unit-tested without importing the CLI entrypoint,
+// which runs main() on import.
+export const ERROR_MESSAGES = {
+    DOMAIN_NOT_FOUND: 'Domain not found.',
+    INVALID_DOMAIN: 'Invalid domain name.',
+    ORG_NOT_FOUND: 'Organization not found.',
+    org_not_found: 'Organization not found.',
+    FUNNEL_NOT_FOUND: 'Funnel not found.',
+    funnel_not_found: 'Funnel not found.',
+    funnel_already_exists: 'Your org already has a funnel. Use: myapi funnel list',
+    FUNNEL_ALREADY_EXISTS: 'Your org already has a funnel. Use: myapi funnel list',
+    domain_already_registered: 'This domain is already registered under your account.',
+    DOMAIN_ALREADY_REGISTERED: 'This domain is already registered under your account.',
+    domain_not_available: 'This domain is not available for registration.',
+    DOMAIN_NOT_AVAILABLE: 'This domain is not available for registration.',
+    db_error: 'Resource not found or invalid ID.',
+    NOT_FOUND: 'Resource not found.',
+    domain_not_found: 'Domain not found.',
+    invalid_domain: 'Invalid domain name.',
+    invalid_org: 'Invalid organization.',
+    FORBIDDEN: 'You do not have permission to perform this action.',
+    RATE_LIMITED: 'Too many requests. Please wait a moment and try again.',
+    INSUFFICIENT_BALANCE: 'Insufficient balance. Run: myapi billing topup <amount>',
+    INVALID_AMOUNT: 'Amount out of range. Maximum single top-up is $100. Run: myapi billing topup <amount>',
+    SERVICE_NOT_LAUNCHED: 'This service is disabled pre-launch. Track availability via: myapi status',
+    RECORD_NOT_FOUND: 'DNS record not found in this zone.',
+    INVALID_RECORD_TYPE: 'Unsupported record type. Allowed: A, AAAA, CNAME, MX, TXT.',
+    MX_PRIORITY_REQUIRED: 'MX records require --priority (typical value: 10).',
+    INVALID_TTL: 'Invalid TTL. Use the auto sentinel (1) or a value between 60 and 86400 seconds.',
+    INVALID_RECORD_CONTENT: 'Invalid record content for this type.',
+    RECORD_LIMIT_EXCEEDED: 'Cloudflare per-zone record limit reached.',
+    CF_API_ERROR: 'Cloudflare API error.',
+    // invalid_json_response intentionally absent — the SDK's MyApiError now
+    // builds a useful detailed message for that case (status + URL + body
+    // snippet), and friendlyError(err.code) would override it.
+};
+export function friendlyError(err) {
+    const body = err.body ?? {};
+    // CF_API_ERROR: the cf_message already includes a "Cloudflare API error"
+    // prefix, so use it verbatim (with cf_status if present) instead of doubling.
+    if (err.code === 'CF_API_ERROR' && typeof body.cf_message === 'string') {
+        return typeof body.cf_status === 'number'
+            ? `${body.cf_message} (HTTP ${body.cf_status})`
+            : body.cf_message;
+    }
+    // Registrar outages are platform-side and transient. Say so plainly and,
+    // crucially, tell the caller NOT to hammer retries — a retry storm on a
+    // balance/credit failure is what got the registrar to rate-limit us.
+    if (err.code === 'REGISTRAR_UNAVAILABLE') {
+        return 'Domain registration is temporarily unavailable on our side — please try again in a little while. This is a platform issue, not your account, so retrying immediately (or in a loop) will not help.';
+    }
+    if (err.code === 'REGISTRAR_RATE_LIMITED') {
+        return 'Domain registration is busy right now — please wait a few minutes before trying again (avoid automatic retries).';
+    }
+    const base = ERROR_MESSAGES[err.code] || err.code;
+    // Generic fallback: append the backend's `message` when it adds info beyond
+    // the friendly mapping. Future per-service detail fields can be added here.
+    if (err.detail && err.detail !== base)
+        return `${base} — ${err.detail}`;
+    return base;
+}

package/dist/errors.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/errors.test.js

@@ -0,0 +1,28 @@
+import { describe, it, expect } from 'vitest';
+import { friendlyError, ERROR_MESSAGES } from './errors.js';
+import { MyApiError } from '@myapihq/sdk';
+describe('friendlyError', () => {
+    it('REGISTRAR_UNAVAILABLE → clear temporary message that discourages retries', () => {
+        const msg = friendlyError(new MyApiError('REGISTRAR_UNAVAILABLE', 500, 'domain registration is temporarily unavailable'));
+        expect(msg).toMatch(/temporarily unavailable/i);
+        expect(msg).toMatch(/not help|avoid|later|loop/i); // steers away from a retry storm
+        expect(msg).not.toMatch(/openprovider|OP310/i); // never leak the provider
+    });
+    it('REGISTRAR_RATE_LIMITED → back-off message', () => {
+        const msg = friendlyError(new MyApiError('REGISTRAR_RATE_LIMITED', 503));
+        expect(msg).toMatch(/busy|wait a few minutes/i);
+        expect(msg).toMatch(/avoid automatic retries|wait/i);
+        expect(msg).not.toMatch(/openprovider/i);
+    });
+    it('maps a known code verbatim from the table', () => {
+        expect(friendlyError(new MyApiError('DOMAIN_ALREADY_REGISTERED', 409))).toBe(ERROR_MESSAGES.DOMAIN_ALREADY_REGISTERED);
+    });
+    it('appends the backend detail for generic mapped codes', () => {
+        const msg = friendlyError(new MyApiError('INVALID_DOMAIN', 400, 'bad tld'));
+        expect(msg).toContain('Invalid domain name.');
+        expect(msg).toContain('bad tld');
+    });
+    it('falls back to the raw code when unmapped with no detail', () => {
+        expect(friendlyError(new MyApiError('SOME_NEW_CODE', 400))).toBe('SOME_NEW_CODE');
+    });
+});

package/dist/exposes.test.js

@@ -44,6 +44,7 @@ const COMMAND_MODULES = [
     './commands/queue.js',
     './commands/task.js',
     './commands/doctor.js',
+    './commands/login.js',
 ];
 const ENDPOINT_PATTERN = /^(GET|POST|PATCH|PUT|DELETE) \/[A-Za-z0-9_\-./{}]*$/;
 describe('every CLI command exports a typed EXPOSES array (S-101)', () => {

package/dist/flags.js

@@ -23,7 +23,7 @@ export function parseFlags(argv, schema = {}) {
             flags.help = true;
             continue;
         }
-        if (arg === '-v') {
+        if (arg === '-v' || arg === '-V') {
             flags.version = true;
             continue;
         }
@@ -51,7 +51,7 @@ export function parseFlags(argv, schema = {}) {
             // `--on-error <email>` without breaking back-compat.
             if (type === undefined) {
                 flags[key] = inlineValue ?? true;
-                unknownFlags.push(`--${key}`);
+                let note = `--${key}`;
                 // If no inline value and the next token doesn't look like another
                 // flag, the user almost certainly intended it as the flag's value
                 // (e.g. `--on-error someone@x.com`). Consume it so it doesn't
@@ -60,9 +60,11 @@ export function parseFlags(argv, schema = {}) {
                     const next = argv[i + 1];
                     if (next !== undefined && !next.startsWith('--') && !next.startsWith('-h') && !next.startsWith('-v')) {
                         flags[key] = next;
+                        note = `--${key} (took value "${next}")`;
                         i++;
                     }
                 }
+                unknownFlags.push(note);
                 continue;
             }
             if (type === 'boolean') {
@@ -104,7 +106,7 @@ export function parseFlags(argv, schema = {}) {
     // disappear. Don't block — the value is still in `flags` for any handler
     // that wants it — just print one line on stderr.
     if (unknownFlags.length > 0 && !process.env.MYAPI_QUIET_UNKNOWN_FLAGS) {
-        process.stderr.write(`› Note: ignoring unknown flag(s): ${unknownFlags.join(', ')}\n`);
+        process.stderr.write(`› Note: unknown flag(s) not recognized by this command: ${unknownFlags.join(', ')} — check for typos.\n`);
     }
     return { args, flags };
 }

package/dist/flags.test.js

@@ -103,7 +103,7 @@ describe('parseFlags', () => {
             process.stderr.write = origWrite;
         }
         const out = stderrChunks.join('');
-        expect(out).toMatch(/ignoring unknown flag/i);
+        expect(out).toMatch(/unknown flag/i);
         expect(out).toMatch(/--mystery/);
         expect(out).toMatch(/--also-unknown/);
     });

package/dist/helpers.d.ts

@@ -3,4 +3,5 @@ export type Flags = Record<string, string | boolean | number>;
 export declare function requireOrg(flags: Flags, config: Config, usage: string): string;
 export declare function requireDomain(arg: string | undefined, flags: Flags, config: Config, usage: string): string;
 export declare function requireArg(value: string | undefined, name: string, usage: string): string;
+export declare function confirmDestructive(flags: Flags, description: string, usage: string): Promise<void>;
 export declare function requireFlag(flags: Flags, name: string, usage: string): string;

package/dist/helpers.js

@@ -1,7 +1,14 @@
 import { error } from './output.js';
+import { confirm, isNonInteractive } from './prompt.js';
 // error() returns `never`, so after `if (!x) error(...)` TS narrows x to a
 // non-falsy value and the casts disappear.
 export function requireOrg(flags, config, usage) {
+    // A present-but-empty --org (e.g. --org "$ORG" with $ORG unset, or a bare
+    // --org that swallowed no value) must never degrade to the default org —
+    // that is exactly the silent wrong-tenant path. Fail loudly instead.
+    if ('org' in flags && (flags.org === '' || flags.org === true)) {
+        error(`--org was passed without a value. Refusing to fall back to the default org.\nUsage: ${usage}`);
+    }
     const orgId = (typeof flags.org === 'string' ? flags.org : '') || config.default_org;
     if (!orgId) {
         error(`Missing required arguments.\nUsage: ${usage}\n(Or set default: myapi config set-org <id>)`);
@@ -22,6 +29,21 @@ export function requireArg(value, name, usage) {
         error(`Missing required argument: ${name}.\nUsage: ${usage}`);
     return value;
 }
+// Gate for irreversible writes. Interactive runs get a y/N prompt; --yes
+// skips it; non-interactive runs (CI, agents) hard-refuse without --yes so a
+// destructive command can never ride a silent default. `description` should
+// name the exact target incl. the org it lives in, e.g.
+// `delete funnel "landing" in org abc-123`.
+export async function confirmDestructive(flags, description, usage) {
+    if (flags.yes)
+        return;
+    if (isNonInteractive()) {
+        error(`Refusing to ${description} without --yes.\nUsage: ${usage}`);
+    }
+    const ok = await confirm(`› Really ${description}? This cannot be undone. (y/N) `, false);
+    if (!ok)
+        error('Aborted.');
+}
 export function requireFlag(flags, name, usage) {
     const v = flags[name];
     if (v === undefined || v === true || v === false || v === '') {

package/dist/index.js

@@ -2,6 +2,7 @@
 import { error, info, success, banner } from './output.js';
 import { loadConfig } from './config.js';
 import { MyApiError } from '@myapihq/sdk';
+import { friendlyError } from './errors.js';
 import * as fs from 'fs';
 import { parseFlags } from './flags.js';
 const pkgPath = new URL('../package.json', import.meta.url);
@@ -37,6 +38,7 @@ import * as gitCmd from './commands/git.js';
 import * as queueCmd from './commands/queue.js';
 import * as taskCmd from './commands/task.js';
 import * as doctorCmd from './commands/doctor.js';
+import * as loginCmd from './commands/login.js';
 // Each command file declares the value flags it understands. We union them
 // into a single schema for the upfront parse, so adding a new value flag in
 // one command means editing one file (its SCHEMA), not a global allowlist.
@@ -70,60 +72,11 @@ const COMBINED_SCHEMA = {
     ...queueCmd.SCHEMA,
     ...taskCmd.SCHEMA,
     ...doctorCmd.SCHEMA,
+    ...loginCmd.SCHEMA,
     // Top-level flags
     version: 'boolean',
     V: 'boolean',
 };
-const ERROR_MESSAGES = {
-    DOMAIN_NOT_FOUND: 'Domain not found.',
-    INVALID_DOMAIN: 'Invalid domain name.',
-    ORG_NOT_FOUND: 'Organization not found.',
-    org_not_found: 'Organization not found.',
-    FUNNEL_NOT_FOUND: 'Funnel not found.',
-    funnel_not_found: 'Funnel not found.',
-    funnel_already_exists: 'Your org already has a funnel. Use: myapi funnel list',
-    FUNNEL_ALREADY_EXISTS: 'Your org already has a funnel. Use: myapi funnel list',
-    domain_already_registered: 'This domain is already registered under your account.',
-    DOMAIN_ALREADY_REGISTERED: 'This domain is already registered under your account.',
-    domain_not_available: 'This domain is not available for registration.',
-    DOMAIN_NOT_AVAILABLE: 'This domain is not available for registration.',
-    db_error: 'Resource not found or invalid ID.',
-    NOT_FOUND: 'Resource not found.',
-    domain_not_found: 'Domain not found.',
-    invalid_domain: 'Invalid domain name.',
-    invalid_org: 'Invalid organization.',
-    FORBIDDEN: 'You do not have permission to perform this action.',
-    RATE_LIMITED: 'Too many requests. Please wait a moment and try again.',
-    INSUFFICIENT_BALANCE: 'Insufficient balance. Run: myapi billing topup <amount>',
-    INVALID_AMOUNT: 'Amount out of range. Maximum single top-up is $100. Run: myapi billing topup <amount>',
-    SERVICE_NOT_LAUNCHED: 'This service is disabled pre-launch. Track availability via: myapi status',
-    RECORD_NOT_FOUND: 'DNS record not found in this zone.',
-    INVALID_RECORD_TYPE: 'Unsupported record type. Allowed: A, AAAA, CNAME, MX, TXT.',
-    MX_PRIORITY_REQUIRED: 'MX records require --priority (typical value: 10).',
-    INVALID_TTL: 'Invalid TTL. Use the auto sentinel (1) or a value between 60 and 86400 seconds.',
-    INVALID_RECORD_CONTENT: 'Invalid record content for this type.',
-    RECORD_LIMIT_EXCEEDED: 'Cloudflare per-zone record limit reached.',
-    CF_API_ERROR: 'Cloudflare API error.',
-    // invalid_json_response intentionally absent — the SDK's MyApiError now
-    // builds a useful detailed message for that case (status + URL + body
-    // snippet), and friendlyError(err.code) would override it.
-};
-function friendlyError(err) {
-    const body = err.body ?? {};
-    // CF_API_ERROR: the cf_message already includes a "Cloudflare API error"
-    // prefix, so use it verbatim (with cf_status if present) instead of doubling.
-    if (err.code === 'CF_API_ERROR' && typeof body.cf_message === 'string') {
-        return typeof body.cf_status === 'number'
-            ? `${body.cf_message} (HTTP ${body.cf_status})`
-            : body.cf_message;
-    }
-    const base = ERROR_MESSAGES[err.code] || err.code;
-    // Generic fallback: append the backend's `message` when it adds info beyond
-    // the friendly mapping. Future per-service detail fields can be added here.
-    if (err.detail && err.detail !== base)
-        return `${base} — ${err.detail}`;
-    return base;
-}
 async function main() {
     // Shell tab-completion: when the shell invokes us for completion it passes
     // a --comp* marker. Handle it via a lazily-imported module so completion
@@ -246,6 +199,9 @@ async function main() {
             case 'doctor':
                 await doctorCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'login':
+                await loginCmd.login(flags);
+                break;
             // Convenience aliases
             case 'setup':
                 await setupCmd.setup(flags);
@@ -353,6 +309,7 @@ async function dispatchAccount(subcommand, restArgs, flags) {
         case 'setup': return setupCmd.setup(flags);
         case 'import-key': return setupCmd.importKey(restArgs[0], flags);
         case 'whoami': return accountCmd.whoami(flags);
+        case 'login': return loginCmd.login(flags);
         case 'link': return accountCmd.link(flags, restArgs[0]);
         case 'switch': return accountCmd.switchCmd(flags, restArgs[0]);
         case 'install-skills':
@@ -370,7 +327,7 @@ async function dispatchAccount(subcommand, restArgs, flags) {
         case 'registrant': return accountCmd.registrant(restArgs[0], flags);
         case 'api-keys':
         case 'keys': return keysCmd.runApiKeys(restArgs[0], restArgs.slice(1), flags);
-        default: info('Unknown subcommand. Run: myapi account --help');
+        default: error('Unknown subcommand. Run: myapi account --help');
     }
 }
 const HELP_TARGETS = {
@@ -400,6 +357,7 @@ const HELP_TARGETS = {
     billing: f => billingCmd.run(undefined, [], f),
     keys: f => keysCmd.run(undefined, [], f),
     config: f => configCmd.run(undefined, [], f),
+    login: f => loginCmd.login(f),
 };
 async function dispatchHelp(target) {
     if (!target) {
@@ -446,6 +404,7 @@ Commands:
   image           Generate AI images and manage them in storage
   install-skills  Install or update the MyAPI skills pack for AI agents
   llm             Run LLM completions and embeddings (chat + embed, with usage/cost)
+  login           Sign in via your browser — Google or email code (preview: --mock)
   org             Manage organizations (tip: myapi org create "name" --yes to auto-set as default)
   payments        Take payments with Stripe Checkout (connect, charge, refund)
   people          Search the contact database (filter by industry, seniority, country, ...)

package/dist/skills/my-api-hq/SKILL.md

@@ -49,7 +49,7 @@ An anonymous account can upgrade at any time via `myapi account link <email>`
 | `myapi org create --name "..."` | Create a new org (`--yes` auto-sets as default) |
 | `myapi org get [id]` | Inspect one org (defaults to current default) |
 | `myapi org update [id]` | Update fields (name, tagline, description, business-sector, logo-url) |
-| `myapi org delete <id>` | Delete an org and cascade |
+| `myapi org delete <id>` | Delete an org and cascade (funnels included). Verify the target with `myapi org get <id>` first; asks for confirmation — `--yes` required in non-interactive runs |
 | `myapi org sync-brand <domain>` | Scrape a live site and auto-fill brand info |
 | `myapi keys list / create / revoke <id>` | Manage API keys (alias `myapi account api-keys`) |
 | `myapi billing balance` | Check balance |
@@ -87,7 +87,7 @@ myapi org sync-brand acme.com
 myapi account switch 2
 ```
 
-If any service returns `402 INSUFFICIENT_FUNDS`, top up (`myapi billing topup`) — or enable `myapi billing auto-recharge` so it refills itself. A `402 SPEND_CAP_EXCEEDED` is different: you hit a spend ceiling you set, so raise it with `myapi billing spend-cap` rather than topping up.
+If any service returns `402 INSUFFICIENT_FUNDS`, top up (`myapi billing topup`) — or enable `myapi billing auto-recharge` so it refills itself. With auto-recharge enabled, billable CLI commands (llm, image, email send, domain register/renew, git commit) handle a refill-in-flight automatically: they wait the server-hinted interval and retry instead of failing, so don't add your own retry loop. A `402 SPEND_CAP_EXCEEDED` is different: you hit a spend ceiling you set, so raise it with `myapi billing spend-cap` rather than topping up.
 
 Each org gets a free preview subdomain (`*.makeautonomous.com`) usable before registering a custom domain.
 <!-- llm:end -->

package/dist/skills/my-domain-api/SKILL.md

@@ -48,9 +48,9 @@ Resolution at register time (highest wins): `--registrant-json` → per-field fl
 |---|---|
 | `myapi domain check <domain>` | Check availability and yearly price |
 | `myapi domain register <domain> [--years N] <registrant flags>` | Register a new domain (deducts credits). Requires ICANN WHOIS contact info — store once with `myapi account registrant set`, or pass per-call via `--registrant-json` / `--registrant-*` flags |
-| `myapi domain renew <domain>` | Renew a registered domain for another period |
+| `myapi domain renew <domain> [--yes]` | Renew a registered domain for another period. Charges the org balance; asks for confirmation — pass `--yes` in non-interactive runs |
 | `myapi domain list [--filter all\|unassigned\|org]` | List domains in your account |
-| `myapi domain assign <domain>` | Assign domain to your default (or `--org`) org |
+| `myapi domain assign <domain> --org <id>` | Assign domain to an org. **Also the reassign path** — re-running moves a domain already assigned elsewhere. Pre-flight with `myapi domain list --filter all` and always pass `--org` explicitly |
 | `myapi domain unassign <domain>` | Remove domain from its org |
 | `myapi domain import <domain>` | Bring-your-own-domain. Snapshots current DNS, returns nameservers to set at your existing registrar — no registrar credentials needed |
 | `myapi domain status <domain> [--watch]` | Registration + DNS propagation status. `--watch` polls until terminal (10s × 30 → 30s × 60) |
@@ -74,11 +74,11 @@ myapi account registrant set
 # Register and bring online
 myapi domain check example.com
 myapi domain register example.com
-myapi domain assign example.com
+myapi domain assign example.com --org <org_id>   # explicit --org: assign also reassigns
 myapi domain status example.com   # poll until status = active
 
-# Renew before expiry
-myapi domain renew example.com
+# Renew before expiry (charges the org balance; --yes for non-interactive runs)
+myapi domain renew example.com --yes
 
 # Tune the edge for AI bot traffic
 myapi domain update-settings example.com \

package/dist/skills/my-email-verify-api/SKILL.md

@@ -9,7 +9,7 @@ checksum: sha256-pending
 
 # MyEmailVerifyAPI
 
-A cheap, fast quality gate for a single email address. Runs three layers in sequence: syntax check (instant) → DNS / MX lookup (sub-second) → Microsoft GetCredentialType probe (sub-second for non-Microsoft, slower for federated domains). Returns a definitive `deliverable` / `undeliverable` verdict for about half of inputs; the rest get `verdict: 'unknown'` with `smtp_recommended: true`, suggesting a downstream SMTP probe that isn't part of this API today.
+A cheap, fast quality gate for a single email address. Runs three layers in sequence: syntax check (instant) → DNS / MX lookup (sub-second) → Microsoft GetCredentialType probe (sub-second for non-Microsoft, slower for federated domains). Returns a definitive `deliverable` / `undeliverable` verdict for about half of inputs; the rest get `verdict: 'unknown'` with `smtp_recommended: true` — feed those into `verify bulk`, which SMTP-probes the uncertain addresses asynchronously.
 
 ## Capabilities
 <!-- llm:start -->
@@ -18,7 +18,7 @@ Use this before any campaign send — pipe the audience members through `verify`
 Verdicts:
 - **`deliverable`** — high-confidence acceptance. Safe to send.
 - **`undeliverable`** — high-confidence reject. Skip. Most common causes: malformed syntax (`missing '@'`), no MX records, Microsoft positively returns "no such mailbox".
-- **`unknown`** — couldn't determine cheaply. The `smtp_recommended` flag will be `true`; in practice, treat as "send but watch the bounce signal" or run a more expensive SMTP probe externally.
+- **`unknown`** — couldn't determine cheaply. The `smtp_recommended` flag will be `true`; run those addresses through `myapi email verify bulk`, which SMTP-probes the uncertain ones (or treat as "send but watch the bounce signal").
 
 Response shape (full check breakdown available via `--json`):
 ```json
@@ -44,6 +44,8 @@ Latency notes: syntax + DNS are <100ms. Microsoft GetCredentialType is fast for
 | Command | What it does |
 |---|---|
 | `myapi email verify <email> [--json]` | Run all three verification layers on one address; print verdict + confidence + key checks |
+| `myapi email verify bulk [--quick] < emails.txt` | Async batch (newline-separated stdin, ≤500 per job): cheap verdict on every address, then SMTP-probes the uncertain ones. `--quick` skips the catch-all check. Prints a `job_id` |
+| `myapi email verify job <job_id> [--json]` | Poll a bulk job: status + per-address verdicts |
 <!-- generated:end -->
 
 Pass `--json` for the full check breakdown (syntax detail, MX records, Microsoft probe result). The default human render shows the verdict + a one-line summary per check that fired.
@@ -60,7 +62,7 @@ myapi email verify not-an-email
 # Generic domain — unknown verdict, MX visible, confidence 0.5
 myapi email verify hello@gmail.com
 # → Verdict: ? unknown  (confidence 0.50)
-# → SMTP next: yes — consider an SMTP probe
+# → SMTP next: yes — consider a bulk job (SMTP-probes the uncertain ones)
 # → MX: gmail-smtp-in.l.google.com, alt1...
 
 # Full breakdown
@@ -83,7 +85,7 @@ done < emails.txt | grep -v ' undeliverable$' > verified.txt
 
 ## Notes
 
-- This is the **cheap layer only**. The full pipeline at outreach scale typically chains: this verify (free signal) → SMTP probe (medium cost) → catch-all detector (slow). Only the first is exposed today.
+- `verify <email>` is the **cheap layer** (syntax → DNS → Microsoft probe). `verify bulk` completes the pipeline: it re-runs the cheap verdict, then SMTP-probes the uncertain addresses and runs catch-all detection (skip catch-all with `--quick`).
 - The `confidence` field is a hint, not a guarantee. A `deliverable` verdict at 0.95 confidence is still ≈5% bounce risk in practice.
 - For bulk verification use the async batch endpoint: `myapi email verify bulk < emails.txt` (one address per line) returns a `job_id`, then poll `myapi email verify job <job_id>` for status + per-address results.
 - Verification is per-org; you'll get rate-limited if you blast more than ~1 req/sec per key.

package/dist/skills/my-funnel-api/SKILL.md

@@ -30,7 +30,8 @@ Every funnel auto-provisions a **webhook** at creation time (`org_webhook_id`).
 | `myapi funnel list` | List all funnels with preview/domain URLs |
 | `myapi funnel get <id>` | Inspect a funnel's metadata + preview URL |
 | `myapi funnel delete <id>` | Delete the funnel and purge its edge pages |
-| `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`). **Overwrites** an existing page — refused without `--force`, prints the resolved org + funnel on success |
+| `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`). **Overwrites** an existing page — refused without `--force`. `--json` prints `{slug, subdomain_url, overwritten, org_id, funnel_id}` |
+| `myapi funnel publish <dir>` | Upload a whole directory as the funnel's site (`--env dev\|prod`, default prod; `--api-fn <id>`; `--json`). Prod refuses to replace a live site without `--force` |
 | `myapi funnel pages [funnel_id]` | List the pages currently published to a funnel |
 | `myapi funnel form [funnel_id]` | Emit canonical form HTML (and register a binding with `--capture-to`) |
 | `myapi funnel verify [slug]` | Verify a published page is reachable + check links/webhooks |
@@ -45,7 +46,7 @@ A write targets a `(org, funnel, slug)` address. Get all three right *before* pu
 3. **A new demo = a new funnel.** Don't reuse an org's existing funnel for an unrelated demo. `myapi funnel create --name <demo> --org <id>` gives you a clean namespace and its own preview subdomain.
 4. **Pin the funnel.** When an org has exactly one funnel, `push`/`publish` auto-pick it — convenient, but it's how a demo lands on the wrong site. Pass `--funnel <id>` (or set a default) so the target is explicit, not inferred.
 
-The CLI backstops you: `push` refuses to overwrite an existing slug (and `publish --env prod` refuses to replace a live site) without `--force`, and both print the resolved **org + funnel** on success. `--force` is the deliberate "yes, replace it" — never reach for it just to clear the error; first check whether the clash means you're aimed at the wrong place.
+The CLI backstops you: `push` refuses to overwrite an existing slug (and `publish --env prod` refuses to replace a live site) without `--force`, and both print the resolved **org + funnel** on success.
 
 ## Examples
 <!-- llm:start -->
@@ -71,7 +72,7 @@ cat new-home.html | myapi funnel push / --funnel <funnel_id> --force
 myapi funnel delete <funnel_id> --org <org_id>
 ```
 
-Omitting `[slug]` defaults to `/`. The funnel id is resolved from `--funnel`, the saved default funnel, or — only if the org has exactly one funnel — auto-picked (so an unintended push can silently land on an existing site; pass `--funnel` to be sure). `push` refuses to overwrite an occupied slug without `--force`.
+Omitting `[slug]` defaults to `/`. The funnel id is resolved from `--funnel`, the saved default funnel, or — only if the org has exactly one funnel — auto-picked; pass `--funnel` to be sure. `push --json` returns the live URL as `subdomain_url` — no follow-up `funnel get` needed.
 <!-- llm:end -->
 
 ## Form submissions (canonical recipe)
@@ -113,7 +114,7 @@ myapi funnel form <funnel_id> --slug survey \
 ## Notes
 
 - Set defaults with `myapi config set-org <id>` and `myapi config set-funnel <id>` to skip flags on every command — but a stale default is exactly how a push lands on the wrong org/funnel. For demos and one-offs, pass `--org`/`--funnel` explicitly instead of relying on whatever default was set last.
-- `push` (any slug) and `publish --env prod` overwrite live content and are refused without `--force` when something already exists at the target. `--force` means "yes, replace the live page/site" — confirm you're aimed at the right `(org, funnel, slug)` before using it, don't use it to silence the error.
+- `--force` means "yes, replace the live page/site" — confirm the `(org, funnel, slug)` target first; don't use it to silence the overwrite error.
 - Deleting a funnel purges all its edge pages immediately.
 - `402 INSUFFICIENT_FUNDS` → top up (`myapi billing topup`) or enable `myapi billing auto-recharge`.
 

package/dist/skills/my-git-api/SKILL.md

@@ -15,7 +15,7 @@ Per-org hosted git repositories, served by a go-git engine (objects in GCS packf
 <!-- llm:start -->
 Git is the source-control layer. Each repo lives under your org and is reachable two ways:
 
-1. **CLI / SDK** — no local clone. `commit` applies a JSON array of file edits atomically; reads (`log`, `show`, `tree`, `blob`, `diff`, `refs`) round-trip the API. Perfect for an agent that edits files server-side.
+1. **CLI / SDK** — no local clone. `commit` writes atomically from three sources: `--dir <path>` (every file under a local directory — the preferred path for committing a generated project), `--file <path> [--as <repo-path>]` (one local file), or an explicit `--changes` JSON array. Reads (`log`, `show`, `tree`, `blob`, `diff`, `refs`) round-trip the API.
 2. **Real git over HTTPS** — `git clone`/`fetch`/`push` against `https://git.mygitapi.com/<org-slug>/<repo>.git` with your MyAPI API key as the password. This is how a normal git workflow connects (see *Clone & push with real git*).
 
 Both surfaces share one engine: a `git push` and a `myapi git commit` converge on the same refs.
@@ -32,14 +32,14 @@ Both surfaces share one engine: a `git push` and a `myapi git commit` converge o
 | `myapi git create <name>` | Create a repository (`--default-branch <b>`) |
 | `myapi git list` | List repositories |
 | `myapi git get <repo>` | Show branch/tag counts + default branch |
-| `myapi git delete <repo>` | Delete a repository |
+| `myapi git delete <repo>` | Delete a repository. Look before you delete: `myapi git list` first, pass `--org` explicitly; asks for confirmation — `--yes` required in non-interactive runs |
 | `myapi git refs <repo>` | List HEAD, branches, and tags |
 | `myapi git log <repo>` | List commits (`--ref`, `--limit`) |
 | `myapi git show <repo> <sha>` | Show a single commit |
 | `myapi git tree <repo> <ref>` | List a ref's file tree (`--path`) |
 | `myapi git blob <repo> <ref> <path>` | Print a file's content (decoded) |
 | `myapi git diff <repo>` | Unified diff of two refs (`--base`, `--head`) |
-| `myapi git commit <repo>` | Atomic commit (`--branch`, `--message`, `--changes`) |
+| `myapi git commit <repo>` | Atomic commit (`--branch`, `--message`, plus `--dir <path>` \| `--file <path> [--as <repo-path>]` \| `--changes <json>`) |
 | `myapi git create-branch <repo> <name>` | Create a branch (`--from <ref>`) |
 | `myapi git delete-branch <repo> <branch>` | Delete a branch |
 | `myapi git tag <repo> <name>` | Create a tag (`--ref <ref>`) |
@@ -55,9 +55,16 @@ myapi git create my-app --default-branch main
 myapi git list
 myapi git refs my-app
 
-# Atomic commit — --changes is a JSON array of file edits
-myapi git commit my-app --branch main --message "init" \
-  --changes '[{"path":"README.md","content":"# My App"}]'
+# Commit a generated project — point --dir at the directory (preferred)
+myapi git commit my-app --branch main --message "init" --dir ./dist
+
+# Commit one local file (--as places/renames it in the repo)
+myapi git commit my-app --branch main --message "add page" \
+  --file ./out.html --as index.html
+
+# Or hand-author edits as JSON (deletes, modes, base64 content)
+myapi git commit my-app --branch main --message "rm" \
+  --changes '[{"path":"old.txt","delete":true}]'
 # Each entry: {path, content | content_base64 | delete:true, mode?}
 # mode: "100644" (default), "100755" (exec), "120000" (symlink)
 
@@ -105,7 +112,7 @@ surface never leaks which repos exist).
 
 ## Notes
 
-- **Clone-free is the default mode.** The CLI never needs a working copy — `commit` sends file edits as JSON, reads come back over the API. Use real git only when you want a local checkout.
+- **Clone-free is the default mode.** The CLI never needs a working copy — `commit` sends local files (`--dir`/`--file`) or JSON edits (`--changes`), reads come back over the API. Use real git only when you want a local checkout.
 - **`merge` is fast-forward only.** No merge commits; the target must be an ancestor of the source. Rebase/merge locally and push instead for non-FF cases.
 - **`commit --base`** is the concurrency guard: pass the expected tip SHA to reject a stale write, or `--base ""` to require the branch be newly created. Omit it to create-or-update.
 - **Metering.** A `git push` (and `myapi git commit`) is metered like a commit. Clone/fetch (`upload-pack`) is free.

package/dist/skills/my-image-api/SKILL.md

@@ -73,6 +73,6 @@ Tips for agents:
 
 - Cost is per-image at the selected model's catalog rate (`myapi image models`). Failed jobs aren't charged.
 - The asset URL is public — don't generate sensitive content.
-- `delete` is permanent for the asset; the job record (prompt + metadata) stays for history.
+- `delete` is permanent for the asset; the job record (prompt + metadata) stays for history. Look before you delete: `myapi image list` first, pass `--org` explicitly; delete verbs require `--yes` in non-interactive runs.
 
 Run `myapi image --help` or `myapi image <subcommand> --help` for full flag reference.

package/dist/skills/my-llm-api/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: my-llm-api
-version: 1.1.0
+version: 1.2.0
 description: >
   Two-surface LLM primitive. Raw chat completion against self-hosted
   open-source models (you pick the model), and objective verbs
@@ -14,7 +14,7 @@ checksum: sha256-pending
 
 A two-surface LLM gateway:
 
-- **Raw** — `complete` / `embed` / `models`. You pick a self-hosted catalog model (today: `Qwen/Qwen3-Coder-30B-A3B-Instruct`). Proprietary models are not callable here.
+- **Raw** — `complete` / `embed` / `models`. You pick a self-hosted catalog model (run `myapi llm models` for the live list). Proprietary models are not callable here.
 - **Verbs** — `classify` / `extract` / `summarize` / `draft`. You ask for a task done; the model is implementation detail and is never named in the response.
 
 Pricing is in cents per 1M tokens at the actual upstream rate; cost is debited from your MyAPI balance.
@@ -33,7 +33,7 @@ Use this for workflow tasks — summarize a doc, classify an inbound email, extr
 ### Raw `complete` request
 ```json
 {
-  "model": "Qwen/Qwen3-Coder-30B-A3B-Instruct",
+  "model": "<model-id>",
   "messages": [
     { "role": "system", "content": "You are a terse editor." },
     { "role": "user",   "content": "Tighten this paragraph: ..." }
@@ -49,7 +49,7 @@ Roles: `system | user | assistant`. Multiple system messages collapse to one ins
 ### Raw `complete` response
 ```json
 {
-  "model": "Qwen/Qwen3-Coder-30B-A3B-Instruct",
+  "model": "<model-id>",
   "content": "...assistant reply...",
   "finish_reason": "stop",
   "usage": { "input_tokens": 42, "output_tokens": 87, "cost_cents": 0.029 }
@@ -62,7 +62,7 @@ If `model` isn't in the self-hosted catalog the server returns `MODEL_NOT_IN_RAW
 
 ### Raw `embed`
 
-No embedding model is served on the raw catalog today; calls return `EMBED_NOT_AVAILABLE`. Use a dedicated embedding API for now.
+Embed text into a dense vector. `--model` is optional when the catalog serves exactly one embed model; else pass one from `myapi llm models --kind embed`. Returns `EMBED_NOT_AVAILABLE` when none is served.
 
 ### Model catalog
 - Chat models: `id`, `kind: 'chat'`, `context_window`, `input_cost_per_1m_cents`, `output_cost_per_1m_cents`
@@ -99,11 +99,11 @@ client = OpenAI(
     api_key="hq_live_…",
     base_url="https://api.myapihq.com/llm/orgs/<org_id>/v1",
 )
-r = client.chat.completions.create(model="Qwen/Qwen3-Coder-30B-A3B-Instruct",
+r = client.chat.completions.create(model="<model-id>",
     messages=[{"role":"user","content":"Hi"}])
 ```
 
-Use raw `complete` (MyAPI shape) for first-party integrations; use the OpenAI-compat path for compatibility with existing client code.
+Use raw `complete` for first-party code; the compat path for existing OpenAI/LangChain tooling.
 
 <!-- llm:end -->
 
@@ -113,7 +113,7 @@ Use raw `complete` (MyAPI shape) for first-party integrations; use the OpenAI-co
 |---|---|
 | `myapi llm models [--kind chat\|embed] [--json]` | List the live model catalog with pricing (cents/1M) |
 | `myapi llm complete "<prompt>" [--model <id>] [--system "<s>"] [--max-tokens N] [--temperature 0..1] [--stop <csv>] [--file <path>] [--json]` | Raw chat completion; reply to stdout, usage to stderr. Defaults to the first chat model in the catalog |
-| `myapi llm embed "<text>" --model <id> [--json]` | Embed a string (no model served today — returns EMBED_NOT_AVAILABLE) |
+| `myapi llm embed "<text>" [--model <id>] [--json]` | Embed a string into a vector; `--model` optional when the catalog has one embed model |
 | `myapi llm classify "<input>" --labels <csv> [--multi] [--tier <t>] [--json]` | Pick a label from a set |
 | `myapi llm extract "<input>" --schema <path\|json> [--tier <t>] [--json]` | Pull structured data conforming to a JSON Schema |
 | `myapi llm summarize "<input>" [--style brief\|exec\|bullet] [--tier <t>] [--json]` | Summarize text |
@@ -132,9 +132,9 @@ myapi llm models --kind chat --json | jq '.models[].id'
 # Raw completion — picks the first chat model from the catalog
 myapi llm complete "Summarize in 12 words: $(cat README.md)"
 
-# Pin a specific model
+# Pin a specific model (ids come from `myapi llm models`)
 myapi llm complete "Refactor this function: ..." \
-  --model Qwen/Qwen3-Coder-30B-A3B-Instruct \
+  --model <model-id> \
   --system "You are a careful Go reviewer." \
   --max-tokens 600
 
@@ -163,5 +163,5 @@ INTENT=$(printf '%s' "$BODY" | myapi llm classify - \
 
 - **`draft` context safety.** `context` fields are quoted into the prompt verbatim; sensitive-named keys (`secret`, `api_key`, `password`, …) are NOT redacted. Two guards on top: (a) injection-defense strips `instructions`/`system`/`prompt`/`override` keys and surfaces them in `meta.warnings`; (b) output guardrail substring-scans fact values (length ≥ 4) in the response and lists matches in `meta.guardrails.facts_in_output` (signal, not redaction). Rule of thumb: never put credentials, PII, or internal metadata in `context` — pass identifiers, reference them indirectly.
 - **Self-hosted raw, server-picked verbs.** Raw runs on MyAPI's TPU; verbs route wherever the server picks.
-- **Cost + latency.** `usage.cost_cents` is authoritative — no markup. Qwen3-Coder-30B: 200–600 ms to first token, 1–3 s end-to-end.
+- **Cost + latency.** `usage.cost_cents` is authoritative — no markup. Varies by tier: 200–600 ms to first token, 1–3 s end-to-end.
 - **Live catalog, no streaming, no BYOK.** Don't hard-code ids — `models` is truth (CLI auto-picks if `--model` omitted). Full reply only.