@myapihq/cli 2.21.1 → 2.23.0

package/dist/commands/account.d.ts

@@ -3,7 +3,7 @@ import type { Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
-export declare const HELP = "Usage: myapi account <subcommand>\n\nSubcommands:\n  api-keys        Manage API keys \u00B7 list / create / revoke\n  config          Manage CLI defaults (org, funnel, domain) \u00B7 supports set-org / set-funnel / set-domain\n  import-key      Import an existing API key non-interactively\n  install-skills  DEPRECATED \u2014 use `myapi install-skills` instead\n  keys            Alias for api-keys\n  link [email]    Upgrade anonymous account to registered (or add a second session)\n                  Use myapi account setup to create a completely new account\n  login           Sign in via your browser \u2014 Google or email code (preview: --mock)\n  mailing-address Get or set the account's mailing address (CAN-SPAM)\n  registrant      Manage stored WHOIS contact info for domain registration \u00B7 set / get / clear\n  setup           Configure your account\n  switch [index]  Switch active account by index or email\n  whoami          Show current account \u00B7 supports --json";
+export declare const HELP = "Usage: myapi account <subcommand>\n\nSubcommands:\n  api-keys        Manage API keys \u00B7 list / create / revoke\n  config          Manage CLI defaults (org, funnel, domain) \u00B7 supports set-org / set-funnel / set-domain\n  import-key      Import an existing API key non-interactively\n  install-skills  DEPRECATED \u2014 use `myapi install-skills` instead\n  keys            Alias for api-keys\n  link [email]    Upgrade anonymous account to registered (or add a second session)\n                  Use myapi account setup to create a completely new account\n  login           Sign in via your browser \u2014 Google or email code (preview: --mock)\n  mailing-address Get or set the account's mailing address (CAN-SPAM)\n  registrant      Manage stored WHOIS contact info for domain registration \u00B7 set / get / clear\n  resume-sending  Turn email sending back on after an automatic pause\n  sending         Whether this account can send email, and how close it is to the limits\n  setup           Configure your account\n  switch [index]  Switch active account by index or email\n  whoami          Show current account \u00B7 supports --json";
 export declare const INSTALL_SKILLS_HELP = "Usage: myapi install-skills\n\nInstalls the MyAPI skills pack for AI coding agents (Claude, Codex, Gemini, \u2026).\n\nThis command writes skill definition files to:\n  ~/.agents/skills/myapi/\n\nAnd creates symlinks in the appropriate agent config directories:\n  ~/.claude/  (Claude)\n  ~/.gemini/  (Gemini)\n  ~/.cursor/  (Cursor, if detected)\n\nThese files teach agents how to use the MyAPI CLI and API directly.\nRun this command again to update existing skills to the latest version.\n\nNote: `myapi account install-skills` is deprecated and will be removed in the next minor.\nUse `myapi install-skills` going forward.";
 export declare const SUBCOMMAND_USAGE: Record<string, string>;
 export declare function link(flags?: Flags, emailArg?: string): Promise<void>;

package/dist/commands/account.js

@@ -17,6 +17,8 @@ export const EXPOSES = [
     'POST /hq/account/verify-code',
     'GET /hq/billing/balance',
     'GET /hq/account/free-tier',
+    'GET /hq/account/sending',
+    'POST /hq/account/resume-sending',
     'GET /hq/account/mailing-address',
     'PATCH /hq/account/mailing-address',
 ];
@@ -54,6 +56,8 @@ Subcommands:
   login           Sign in via your browser — Google or email code (preview: --mock)
   mailing-address Get or set the account's mailing address (CAN-SPAM)
   registrant      Manage stored WHOIS contact info for domain registration · set / get / clear
+  resume-sending  Turn email sending back on after an automatic pause
+  sending         Whether this account can send email, and how close it is to the limits
   setup           Configure your account
   switch [index]  Switch active account by index or email
   whoami          Show current account · supports --json`;
@@ -116,6 +120,23 @@ Subcommands:
   set       Interactive prompt for all fields. Or pass --registrant-json
             '<json>' to set non-interactively (agent-friendly).`;
 export const SUBCOMMAND_USAGE = {
+    sending: `myapi account sending [--json]
+
+  Whether this account can send email, and how close it is to the limits.
+
+  The platform pauses sending when too much of the last 24 hours bounces.
+  The pause message is a photograph of the moment it happened — this is the
+  live picture, and the two can disagree: an account paused yesterday may be
+  well within the limits today and simply need resuming.
+
+  Under 100 sends in 24h the ratios are not judged, and the reply says so.`,
+    'resume-sending': `myapi account resume-sending [--json]
+
+  Turn sending back on after an automatic pause.
+
+  Refused with STILL_OVER_THRESHOLD while the last 24 hours are still over
+  the limit — the numbers come back with the refusal, so you can see how far
+  off you are. Removing the addresses that bounce is what moves them.`,
     'mailing-address': `myapi account mailing-address                       Show current value (null if unset)
 myapi account mailing-address "<address>"            Set the mailing address
 
@@ -410,6 +431,41 @@ async function mailingAddress(args, flags) {
     }
     success(`Mailing address set: ${res.mailing_address}`);
 }
+// The pause is invisible until a send fails, so both verbs lead with the one
+// fact that decides what to do next: can this account send right now.
+async function sendingStatus(flags) {
+    const config = requireConfig();
+    const res = await hq.getSendingStatus(config.api_key);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    info(res.sending_paused ? 'Sending is PAUSED.' : 'Sending is on.');
+    info(`Last 24h: ${res.sends_24h} sent · ${res.bounces_24h} bounced · ${res.complaints_24h} complaints`);
+    info(`Limits:   ${(res.bounce_threshold * 100).toFixed(1)}% bounces · ${(res.complaint_threshold * 100).toFixed(2)}% complaints`);
+    if (res.note)
+        info(res.note);
+    if (res.sending_paused) {
+        if (res.paused_reason_when_paused) {
+            // Labelled as history, because the live numbers above may disagree with
+            // it — and reading the frozen reason as current is the whole confusion.
+            info(`Paused because (at the time): ${res.paused_reason_when_paused}`);
+        }
+        info(res.can_resume_now
+            ? 'Within the limits now — run: myapi account resume-sending'
+            : 'Still over the limit. Remove the addresses that bounce, then resume.');
+    }
+}
+async function resumeSending(flags) {
+    const config = requireConfig();
+    const res = await hq.resumeSending(config.api_key);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(res.message);
+    info(`Last 24h: ${res.sends} sent · ${res.bounces} bounced`);
+}
 export async function run(subcommand, args, flags) {
     if (!subcommand || (flags.help && !subcommand)) {
         info(HELP);
@@ -424,6 +480,8 @@ export async function run(subcommand, args, flags) {
     }
     switch (subcommand) {
         case 'mailing-address': return mailingAddress(args, flags);
+        case 'sending': return sendingStatus(flags);
+        case 'resume-sending': return resumeSending(flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi account --help" for the list.`);
     }
 }

package/dist/commands/container.d.ts

@@ -8,6 +8,7 @@ export declare const NAME_RE: RegExp;
 export declare const RESERVED_NAMES: Set<string>;
 export declare function _validateName(name: string): string | null;
 export declare function _parseEnv(raw: string): Record<string, string> | string;
+export declare function splitEnvEntries(raw: string): string[];
 export declare function create(nameArg: string | undefined, flags: Flags): Promise<void>;
 export declare function list(flags: Flags): Promise<void>;
 export declare function get(id: string, flags: Flags): Promise<void>;

package/dist/commands/container.js

@@ -28,7 +28,7 @@ export const SCHEMA = {
     'min-instances': 'number',
     'max-instances': 'number',
     port: 'number',
-    env: 'string',
+    env: 'list',
     unset: 'string',
     tail: 'number',
     scope: 'string',
@@ -60,15 +60,45 @@ export function _validateName(name) {
 // message string (pure form, for tests).
 export function _parseEnv(raw) {
     const env = {};
-    for (const pair of raw.split(',').map(s => s.trim()).filter(Boolean)) {
+    for (const pair of splitEnvEntries(raw)) {
         const eq = pair.indexOf('=');
         if (eq < 1) {
-            return `Invalid --env entry "${pair}". Use KEY=VALUE, comma-separated.`;
+            return `Invalid --env entry "${pair}". Use KEY=VALUE. ` +
+                `A value containing commas needs its own --env: --env A=1 --env "B=x,y".`;
         }
         env[pair.slice(0, eq)] = pair.slice(eq + 1);
     }
     return env;
 }
+/* Split one --env occurrence into entries.
+ *
+ * A comma means "next variable" only when every segment looks like KEY=VALUE.
+ * Otherwise the commas belong to the value — the case that mattered. An origin
+ * list is ONE variable whose value contains commas, and splitting it produced
+ * `Invalid --env entry "https://dev.example.com"`: the command refused the exact
+ * shape it was added to let people set. Three of one customer's variables are
+ * lists like that, and the same defect at `create` is what sent them through
+ * three container generations in a week.
+ *
+ * The heuristic does not have to be perfect, because --env is now repeatable:
+ * given on its own, `--env "A=x?a=1,b=2"` is unambiguous and always right. The
+ * splitting stays so `--env A=1,B=2` keeps working for everyone already writing
+ * it that way.
+ */
+export function splitEnvEntries(raw) {
+    const parts = raw.split(',').map(s => s.trim()).filter(Boolean);
+    // One entry after dropping empties: a plain pair, or a pair with a trailing
+    // comma. Returning the raw string here would fold that stray comma into the
+    // value — caught by an existing test, which is what it was for.
+    if (parts.length <= 1) {
+        return parts;
+    }
+    if (parts.every(p => p.indexOf('=') > 0)) {
+        return parts;
+    }
+    const whole = raw.trim();
+    return whole ? [whole] : [];
+}
 function summarizeContainer(c) {
     return {
         id: c.id,
@@ -127,11 +157,20 @@ export async function create(nameArg, flags) {
             error(`--health-check must be a path starting with "/" — got "${hc}".`);
         payload.health_check = hc;
     }
-    if (typeof flags.env === 'string') {
-        const env = _parseEnv(flags.env);
-        if (typeof env === 'string')
-            error(env);
-        payload.env = env;
+    // Repeatable, and create must agree with `container env` on what --env means.
+    // If they disagree, a variable settable at creation cannot be changed
+    // afterwards — which is how a customer ended up recreating containers.
+    const createEnvArgs = Array.isArray(flags.env) ? flags.env
+        : typeof flags.env === 'string' ? [flags.env] : [];
+    if (createEnvArgs.length > 0) {
+        const merged = {};
+        for (const occurrence of createEnvArgs) {
+            const parsed = _parseEnv(occurrence);
+            if (typeof parsed === 'string')
+                error(parsed);
+            Object.assign(merged, parsed);
+        }
+        payload.env = merged;
     }
     const result = await sdkContainer.createContainer(config.api_key, orgId, payload);
     success(`Container created: ${result.container.id}`);
@@ -721,10 +760,15 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         const config = requireConfig();
         const orgId = requireOrg(flags, config, 'myapi container env <id> --env K=V [--unset K2]');
         if (!id)
-            error('Missing id.\nUsage: myapi container env <id> --env KEY=VALUE[,K2=V2] [--unset KEY3[,KEY4]]');
+            error('Missing id.\nUsage: myapi container env <id> --env KEY=VALUE [--env K2=V2] [--unset KEY3]\n' +
+                'A value containing commas needs its own --env: --env "ORIGINS=http://a,https://b"');
         const env = {};
-        if (typeof flags.env === 'string') {
-            const parsed = _parseEnv(flags.env);
+        // Each occurrence parsed on its own, so a value containing commas can be
+        // given unambiguously as its own --env.
+        const envArgs = Array.isArray(flags.env) ? flags.env
+            : typeof flags.env === 'string' ? [flags.env] : [];
+        for (const occurrence of envArgs) {
+            const parsed = _parseEnv(occurrence);
             if (typeof parsed === 'string')
                 error(parsed);
             Object.assign(env, parsed);

package/dist/commands/crm/contacts.js

@@ -1,12 +1,16 @@
 // `myapi crm contacts <subcommand>` — the engaged-people half of CRM.
+import * as fs from 'fs';
 import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
+import { retryFunds } from '../../utils.js';
 import { pageLine, originFlag } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/contacts',
     'POST /crm/orgs/{org_id}/contacts/promote',
+    'POST /crm/orgs/{org_id}/contacts/promote-audience',
+    'POST /crm/orgs/{org_id}/contacts/import',
     'POST /crm/orgs/{org_id}/contacts/search',
     'GET /crm/orgs/{org_id}/contacts/{id}',
     'PATCH /crm/orgs/{org_id}/contacts/{id}',
@@ -152,6 +156,71 @@ async function promote(personId, flags) {
     }
     success(`Promoted to ${c.id} (${c.email})`);
 }
+// Walks every page rather than promoting the first 500 and stopping. A bulk
+// import that quietly covers part of an audience is the same failure as a list
+// that truncates: the caller gets a number that looks like an answer.
+async function promoteAudience(audienceId, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi crm contacts promote-audience <audience_id> [--org <id>]');
+    requireArg(audienceId, 'audience_id', 'myapi crm contacts promote-audience <audience_id>');
+    const totals = { created: 0, matched: 0, skipped_no_email: 0, failed: 0, processed: 0 };
+    let offset = 0;
+    let audienceTotal = 0;
+    // A page at a time, resuming from the server's own next_offset — the same
+    // cursor discipline the paged list commands use.
+    for (let page = 0; page < 200; page++) {
+        const r = await retryFunds(() => crm.promoteAudience(config.api_key, orgId, audienceId, { offset }));
+        totals.created += r.created;
+        totals.matched += r.matched;
+        totals.skipped_no_email += r.skipped_no_email;
+        totals.failed += r.failed;
+        totals.processed += r.processed;
+        audienceTotal = r.total;
+        if (!r.has_more || r.processed === 0)
+            break;
+        offset = r.next_offset;
+        if (!flags.json)
+            info(`… ${totals.processed}/${r.total}`);
+    }
+    if (flags.json) {
+        printJson({ audience_id: audienceId, total: audienceTotal, ...totals });
+        return;
+    }
+    success(`${totals.created} new contact(s), ${totals.matched} already known`);
+    if (totals.skipped_no_email > 0) {
+        // Named rather than folded into a total: this is almost always why an
+        // audience of 400 becomes 260 contacts.
+        info(`${totals.skipped_no_email} skipped — the Goldfox row has no email address.`);
+    }
+    if (totals.failed > 0)
+        info(`${totals.failed} failed.`);
+    info(`Reach them from a campaign with: --crm-origin goldfox`);
+}
+async function importCsv(path, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi crm contacts import <file.csv> [--org <id>]');
+    requireArg(path, 'file.csv', 'myapi crm contacts import <file.csv>');
+    if (!fs.existsSync(path))
+        error(`No such file: ${path}`);
+    const csv = fs.readFileSync(path, 'utf-8');
+    const r = await crm.importContacts(config.api_key, orgId, csv, path.split('/').pop());
+    if (flags.json) {
+        printJson(r);
+        return;
+    }
+    success(`${r.created} new contact(s), ${r.matched} already known`);
+    if (r.skipped > 0) {
+        // Every skipped row, with its line number — a count on its own is what
+        // sends somebody back to the spreadsheet to work out which twenty.
+        info(`${r.skipped} row(s) skipped:`);
+        for (const row of r.skipped_rows.slice(0, 20)) {
+            info(`  line ${row.line}: ${row.reason}${row.email ? ` (${row.email})` : ''}`);
+        }
+        if (r.skipped_rows.length > 20)
+            info(`  … and ${r.skipped_rows.length - 20} more (--json for all)`);
+    }
+    info('Reach them from a campaign with: --crm-origin import');
+}
 async function events(id, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm contacts events <id> [--kind <k>] [--limit N] [--cursor <c>] [--org <id>]');
@@ -211,8 +280,10 @@ Subcommands:
   delete <id>                 Soft-delete (events retained)
   events <id>                 Timeline of events on a contact (newest first)
   get <id>                    Fetch one contact (with embedded Goldfox enrichment, when available)
+  import <file.csv>           Import contacts from CSV (header row; email column required)
   list                        Most-recently-engaged contacts (no filter)
   promote <goldfox_person_id> Promote a Goldfox lead → CRM contact (idempotent)
+  promote-audience <audience_id> Promote a whole saved people-audience (idempotent, resumable)
   restore <id>                Undo a soft-delete
   search                      Filter by stage / source / email / engagement window
   update <id>                 Patch stage, names, company_id, custom JSON
@@ -237,6 +308,8 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'delete': return del(args[0], flags);
         case 'restore': return restore(args[0], flags);
         case 'promote': return promote(args[0], flags);
+        case 'promote-audience': return promoteAudience(args[0], flags);
+        case 'import': return importCsv(args[0], flags);
         case 'events': return events(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi crm contacts --help" for valid subcommands.`);
     }

package/dist/commands/crm/index.js

@@ -54,6 +54,7 @@ Each namespace shares the same subcommands:
   delete <id>                Soft delete (events retained)
   restore <id>               Restore a soft-deleted row
   promote <goldfox_id>       Promote a Goldfox lead into your CRM
+  promote-audience <id>     Promote a saved people-audience in bulk (idempotent, resumable)
 
 Contacts also have:
   events <id> [--kind <k>]   Inspect the contact's engagement timeline

package/dist/commands/email/campaign.d.ts

@@ -0,0 +1,5 @@
+import { type Flags } from '../../helpers.js';
+import type { Exposes } from '../../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare const HELP = "Usage: myapi email campaign <subcommand>\n\n  create      Create a draft (--template, --from, and a source)\n  list        Campaigns in this org\n  get <id>    One campaign\n  update <id> Edit a DRAFT's name or source\n  resolve <id>  Freeze who it reaches; reports the count and cost, sends nothing\n  start <id>  Begin sending a resolved campaign\n  pause <id>  Stop after the message in flight\n  resume <id> Continue a paused campaign\n  cancel <id> End it for good; queued recipients are dropped\n  recipients <id>  Who it resolved to, and what happened to each\n  stats <id>  Counts by state, sent today, and the daily limit\n\nA campaign drains at its per-day limit rather than sending at once, so it is\ncommonly still active tomorrow \u2014 that is the design, not a stall.\n\nRecipients come from a SOURCE, not a list you upload:\n  --crm-stage / --crm-origin / --crm-max-days   filter CRM contacts\n  --crm-audience <id>                           only people promoted from it\n  --addresses a@x.com,b@y.com                   an explicit short list";
+export declare function run(sub: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/email/campaign.js

@@ -0,0 +1,244 @@
+import { email as sdkEmail } from '@myapihq/sdk';
+import { requireConfig } from '../../config.js';
+import { success, error, info, printTable, printJson } from '../../output.js';
+import { retryFunds } from '../../utils.js';
+import { requireOrg, requireArg } from '../../helpers.js';
+export const EXPOSES = [
+    'POST /email/orgs/{org_id}/campaigns',
+    'GET /email/orgs/{org_id}/campaigns',
+    'GET /email/orgs/{org_id}/campaigns/{campaign_id}',
+    'PATCH /email/orgs/{org_id}/campaigns/{campaign_id}',
+    'POST /email/orgs/{org_id}/campaigns/{campaign_id}/resolve',
+    'POST /email/orgs/{org_id}/campaigns/{campaign_id}/start',
+    'POST /email/orgs/{org_id}/campaigns/{campaign_id}/pause',
+    'POST /email/orgs/{org_id}/campaigns/{campaign_id}/resume',
+    'POST /email/orgs/{org_id}/campaigns/{campaign_id}/cancel',
+    'GET /email/orgs/{org_id}/campaigns/{campaign_id}/recipients',
+    'GET /email/orgs/{org_id}/campaigns/{campaign_id}/stats',
+];
+export const HELP = `Usage: myapi email campaign <subcommand>
+
+  create      Create a draft (--template, --from, and a source)
+  list        Campaigns in this org
+  get <id>    One campaign
+  update <id> Edit a DRAFT's name or source
+  resolve <id>  Freeze who it reaches; reports the count and cost, sends nothing
+  start <id>  Begin sending a resolved campaign
+  pause <id>  Stop after the message in flight
+  resume <id> Continue a paused campaign
+  cancel <id> End it for good; queued recipients are dropped
+  recipients <id>  Who it resolved to, and what happened to each
+  stats <id>  Counts by state, sent today, and the daily limit
+
+A campaign drains at its per-day limit rather than sending at once, so it is
+commonly still active tomorrow — that is the design, not a stall.
+
+Recipients come from a SOURCE, not a list you upload:
+  --crm-stage / --crm-origin / --crm-max-days   filter CRM contacts
+  --crm-audience <id>                           only people promoted from it
+  --addresses a@x.com,b@y.com                   an explicit short list`;
+// Building the source from flags is the one place the CLI has an opinion: a
+// campaign names where its people come from, and mixing two sources in one
+// command is a request nobody can mean.
+function sourceFromFlags(flags) {
+    const addrs = typeof flags.addresses === 'string' && flags.addresses
+        ? flags.addresses.split(',').map(s => s.trim()).filter(Boolean)
+        : [];
+    const crm = {};
+    if (typeof flags['crm-stage'] === 'string' && flags['crm-stage'])
+        crm.stage = flags['crm-stage'];
+    if (typeof flags['crm-origin'] === 'string' && flags['crm-origin'])
+        crm.origin = flags['crm-origin'];
+    if (typeof flags['crm-company'] === 'string' && flags['crm-company'])
+        crm.company_id = flags['crm-company'];
+    // The people promoted from ONE saved audience, rather than every lead ever
+    // promoted — which is rarely the campaign anybody means.
+    if (typeof flags['crm-audience'] === 'string' && flags['crm-audience'])
+        crm.audience_id = flags['crm-audience'];
+    if (typeof flags['crm-max-days'] === 'number')
+        crm.max_last_engagement_days = flags['crm-max-days'];
+    if (typeof flags['crm-min-days'] === 'number')
+        crm.min_last_engagement_days = flags['crm-min-days'];
+    const hasCRM = Object.keys(crm).length > 0;
+    if (addrs.length && hasCRM) {
+        error('Pass either --addresses or the --crm-* filters, not both — a campaign draws from one source.');
+    }
+    if (addrs.length)
+        return { source_kind: 'list', source_ref: { addresses: addrs } };
+    if (hasCRM)
+        return { source_kind: 'crm_query', source_ref: crm };
+    // An unfiltered CRM query is every contact in the org. That is a legitimate
+    // campaign and a very easy accident, so it has to be asked for by name.
+    if (flags['all-contacts'])
+        return { source_kind: 'crm_query', source_ref: {} };
+    error('No source. Use --addresses <csv>, a --crm-* filter, or --all-contacts to mean every CRM contact.');
+    throw new Error('unreachable');
+}
+function fmtCents(c) {
+    if (c == null)
+        return '—';
+    return c < 100 ? `${c.toFixed(2)}¢` : `$${(c / 100).toFixed(2)}`;
+}
+async function create(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi email campaign create --name <n> --template <id> --from <addr> [--addresses <csv> | --crm-stage <s>]');
+    const name = typeof flags.name === 'string' ? flags.name : '';
+    const template = typeof flags.template === 'string' ? flags.template : '';
+    const from = typeof flags.from === 'string' ? flags.from : '';
+    if (!name || !template || !from) {
+        error('Missing required flags: --name, --template <template-id>, --from <mailbox address>.');
+    }
+    const src = sourceFromFlags(flags);
+    const c = await sdkEmail.createCampaign(config.api_key, orgId, {
+        name, template_id: template, from_address: from, ...src,
+    });
+    if (flags.json) {
+        printJson(c);
+        return;
+    }
+    success(`Draft campaign ${c.id}`);
+    info(`Next: myapi email campaign resolve ${c.id}   # who it reaches and what it costs — sends nothing`);
+}
+async function list(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi email campaign list [--org <id>]');
+    const rows = await sdkEmail.listCampaigns(config.api_key, orgId);
+    if (flags.json) {
+        printJson(rows);
+        return;
+    }
+    printTable(rows.map(c => ({
+        id: c.id,
+        name: c.name,
+        status: c.status,
+        source: c.source_kind,
+        recipients: c.recipient_count ?? '—',
+        est: fmtCents(c.estimated_cost_cents),
+    })), { flags, empty: 'No campaigns yet. Create one with: myapi email campaign create --name ... --template ... --from ...' });
+}
+async function get(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi email campaign get <id>');
+    const c = await sdkEmail.getCampaign(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(c);
+        return;
+    }
+    info(`${c.name}  [${c.status}]`);
+    info(`from ${c.from_address} · template ${c.template_id} · source ${c.source_kind}`);
+    info(`recipients ${c.recipient_count ?? '—'} · estimated ${fmtCents(c.estimated_cost_cents)}`);
+    if (c.resolved_at)
+        info(`resolved ${c.resolved_at}`);
+}
+async function update(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi email campaign update <id> [--name <n>] [--addresses <csv>]');
+    const patch = {};
+    if (typeof flags.name === 'string' && flags.name)
+        patch.name = flags.name;
+    const wantsSource = flags.addresses || flags['crm-stage'] || flags['crm-origin']
+        || flags['crm-company'] || flags['crm-audience'] || flags['crm-max-days']
+        || flags['crm-min-days'] || flags['all-contacts'];
+    if (wantsSource)
+        Object.assign(patch, sourceFromFlags(flags));
+    if (Object.keys(patch).length === 0)
+        error('Nothing to change. Pass --name or a source flag.');
+    const c = await sdkEmail.updateCampaign(config.api_key, orgId, id, patch);
+    if (flags.json) {
+        printJson(c);
+        return;
+    }
+    success(`Updated ${c.id}`);
+}
+async function resolve(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi email campaign resolve <id>');
+    const r = await sdkEmail.resolveCampaign(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(r);
+        return;
+    }
+    success(`${r.recipients} recipient(s) · estimated ${fmtCents(r.estimated_cost_cents)}`);
+    const excluded = Object.entries(r.excluded ?? {});
+    if (excluded.length) {
+        // Saying WHY the number shrank is the difference between a product and a
+        // black box — the source had more rows than this, and the caller is owed
+        // the reason.
+        info(`From ${r.source_rows} source row(s); excluded ${excluded.map(([k, n]) => `${n} ${k}`).join(', ')}.`);
+    }
+    info('Nothing has been sent. Start it with: myapi email campaign start ' + id);
+}
+async function transition(verb, id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, `myapi email campaign ${verb} <id>`);
+    const fn = {
+        start: sdkEmail.startCampaign,
+        pause: sdkEmail.pauseCampaign,
+        resume: sdkEmail.resumeCampaign,
+        cancel: sdkEmail.cancelCampaign,
+    }[verb];
+    // start is the billable one: it commits the account to the resolved cost.
+    const c = verb === 'start'
+        ? await retryFunds(() => fn(config.api_key, orgId, id))
+        : await fn(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(c);
+        return;
+    }
+    success(`${c.name} is now ${c.status}`);
+    if (verb === 'start') {
+        info(`It sends up to its daily limit and continues tomorrow — check with: myapi email campaign stats ${id}`);
+    }
+}
+async function recipients(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi email campaign recipients <id> [--state queued|sent|failed|excluded]');
+    const state = typeof flags.state === 'string' ? flags.state : undefined;
+    const rows = await sdkEmail.listCampaignRecipients(config.api_key, orgId, id, state);
+    if (flags.json) {
+        printJson(rows);
+        return;
+    }
+    printTable(rows.map(r => ({
+        address: r.address,
+        state: r.state,
+        reason: r.excluded_reason ?? r.error ?? '',
+        sent_at: r.sent_at ?? '',
+    })), { flags, empty: 'No recipients. Resolve the campaign first.' });
+}
+async function stats(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi email campaign stats <id>');
+    const s = await sdkEmail.getCampaignStats(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(s);
+        return;
+    }
+    info(`status ${s.status} · ${s.sent_today} sent today · limit ${s.per_day_limit}/day`);
+    const parts = Object.entries(s.by_state ?? {}).map(([k, n]) => `${n} ${k}`);
+    info(parts.length ? parts.join(' · ') : 'no recipients resolved yet');
+    if (s.status === 'paused_insufficient_funds') {
+        info('Paused because the account could not pay. Top up or enable auto-recharge, then: myapi email campaign resume ' + id);
+    }
+}
+export async function run(sub, args, flags) {
+    if (!sub || (flags.help && !sub)) {
+        info(HELP);
+        return;
+    }
+    const need = (usage) => requireArg(args[0], '<id>', usage);
+    switch (sub) {
+        case 'create': return create(flags);
+        case 'list': return list(flags);
+        case 'get': return get(need('myapi email campaign get <id>'), flags);
+        case 'update': return update(need('myapi email campaign update <id>'), flags);
+        case 'resolve': return resolve(need('myapi email campaign resolve <id>'), flags);
+        case 'start': return transition('start', need('myapi email campaign start <id>'), flags);
+        case 'pause': return transition('pause', need('myapi email campaign pause <id>'), flags);
+        case 'resume': return transition('resume', need('myapi email campaign resume <id>'), flags);
+        case 'cancel': return transition('cancel', need('myapi email campaign cancel <id>'), flags);
+        case 'recipients': return recipients(need('myapi email campaign recipients <id>'), flags);
+        case 'stats': return stats(need('myapi email campaign stats <id>'), flags);
+        default: error(`Unknown subcommand: email campaign ${sub}. Run "myapi email campaign --help".`);
+    }
+}

package/dist/commands/email/index.js

@@ -11,7 +11,19 @@ import * as message from './message.js';
 import * as warmup from './warmup.js';
 import * as template from './template.js';
 import * as verify from './verify.js';
+import * as campaign from './campaign.js';
 export const SCHEMA = {
+    // campaigns (`from` is declared below, shared with `message send`)
+    template: 'string',
+    addresses: 'string',
+    'crm-stage': 'string',
+    'crm-origin': 'string',
+    'crm-company': 'string',
+    'crm-audience': 'string',
+    'crm-max-days': 'number',
+    'crm-min-days': 'number',
+    'all-contacts': 'boolean',
+    state: 'string',
     org: 'string',
     domain: 'string',
     username: 'string',
@@ -60,6 +72,7 @@ async function dispatchNamespace(ns, sub, restArgs, flags) {
         case 'warmup': return warmup.run(sub, restArgs, flags);
         case 'template': return template.run(sub, restArgs, flags);
         case 'verify': return verify.run(sub, restArgs, flags);
+        case 'campaign': return campaign.run(sub, restArgs, flags);
         default: error(`Unknown namespace: ${ns}. Run "myapi email --help" for the list.`);
     }
 }
@@ -68,6 +81,7 @@ export async function run(subcommand, args, flags) {
         info(`Usage: myapi email <namespace> <subcommand>
 
 Namespaces:
+  campaign   Scheduled bulk send (org-scoped) — resolve, start, pause, stats; drains at a daily limit
   mailbox    Mailboxes (account-scoped) — create, list, activate-sending
   message    Send & read mail (account-scoped) — send, status, sent, inbox, outbox, get
   template   Email templates (org-scoped) — generate, list, edit, send-test, delete

package/dist/commands/env-commas.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/env-commas.test.js

@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest';
+import { _parseEnv, splitEnvEntries } from './container.js';
+// A container variable whose VALUE contains commas could not be set.
+//
+// `myapi container env <id> --env "ORIGINS=http://localhost:5173,https://dev.example.com"`
+// was refused with `Invalid --env entry "https://dev.example.com"` — the parser
+// split on every comma, so an origin list became two entries and the second had
+// no `=`. Three of one customer's variables are lists like that, and the same
+// defect at `create` is what sent them through three container generations in a
+// week. The command added to free them from the HTTP API reproduced it.
+describe('splitEnvEntries', () => {
+    it('keeps commas that belong to the value', () => {
+        expect(splitEnvEntries('ORIGINS=http://localhost:5173,https://dev.example.com'))
+            .toEqual(['ORIGINS=http://localhost:5173,https://dev.example.com']);
+    });
+    it('still splits several plain pairs, which is how people already write it', () => {
+        expect(splitEnvEntries('A=1,B=2')).toEqual(['A=1', 'B=2']);
+    });
+    it('treats a single pair as a single pair', () => {
+        expect(splitEnvEntries('A=1')).toEqual(['A=1']);
+    });
+    it('does not split when one segment is not a pair', () => {
+        // "A=1,B" is a value containing a comma, not a pair plus a malformed one.
+        expect(splitEnvEntries('A=1,B')).toEqual(['A=1,B']);
+    });
+});
+describe('_parseEnv', () => {
+    it('sets an origin list as one variable', () => {
+        const got = _parseEnv('ORIGINS=http://localhost:5173,https://dev.example.com');
+        expect(got).toEqual({ ORIGINS: 'http://localhost:5173,https://dev.example.com' });
+    });
+    it('keeps the multi-pair form working', () => {
+        expect(_parseEnv('A=1,B=2')).toEqual({ A: '1', B: '2' });
+    });
+    it('keeps = inside a value', () => {
+        expect(_parseEnv('URL=https://x?a=1')).toEqual({ URL: 'https://x?a=1' });
+    });
+    it('names the unambiguous form when it cannot parse', () => {
+        const got = _parseEnv('novalue');
+        expect(typeof got).toBe('string');
+        // The refusal must say how to succeed, not only that this failed.
+        expect(got).toContain('--env');
+    });
+});

package/dist/completion.js

@@ -35,7 +35,7 @@ export const COMMANDS = [
 // command → subcommands, for `myapi <command> <TAB>`. Mirrors each
 // command's dispatcher; commands absent here take no subcommand.
 export const SUBCOMMANDS = {
-    account: ['setup', 'import-key', 'whoami', 'login', 'link', 'switch', 'install-skills', 'config', 'registrant', 'api-keys', 'keys', 'mailing-address'],
+    account: ['setup', 'import-key', 'whoami', 'login', 'link', 'switch', 'install-skills', 'config', 'registrant', 'api-keys', 'keys', 'mailing-address', 'sending', 'resume-sending'],
     // The end-user auth product. Operator/account commands live under `account`.
     auth: ['tenant', 'client', 'usage', 'domain'],
     org: ['create', 'delete', 'get', 'import', 'list', 'sync-brand', 'update'],

package/dist/exposes.test.js

@@ -22,6 +22,7 @@ const COMMAND_MODULES = [
     './commands/email/template.js',
     './commands/email/warmup.js',
     './commands/email/verify.js',
+    './commands/email/campaign.js',
     './commands/funnel.js',
     './commands/image.js',
     './commands/keys.js',

package/dist/flag-schema-collisions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/flag-schema-collisions.test.js

@@ -0,0 +1,112 @@
+// Flags that mean different things in different commands must not be typed by
+// whichever command happens to be spread last.
+//
+// COMBINED_SCHEMA merges every command's SCHEMA to find the command name. A
+// merge resolves duplicate keys by declaration order, silently: `ttl` is
+// `number` in domain and llm and `string` in storage, and because storage
+// merges last, EVERY --ttl in the CLI parsed as a string. `domain records
+// create --ttl 3600` sent "3600", and `llm cache create --ttl 600` dropped the
+// value on a `typeof === 'number'` check — a flag documented in --help, parsed
+// without complaint, and discarded before the request.
+//
+// The dispatcher now re-parses under the command's own schema. This file has
+// two jobs: prove that per-command typing holds, and list the collisions so a
+// new one is a visible decision rather than an accident.
+//
+// It lives in src/ rather than test/smoke/ because it reads the schemas
+// directly and never drives the built binary. Filed under smoke originally, it
+// ran only in the push gate — so `npm test`, the command anyone reaches for,
+// could not catch a new collision. It caught one in CI instead, which is later
+// and more expensive than it needed to be.
+import { describe, it, expect } from 'vitest';
+import { readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { parseFlags } from './flags.js';
+import * as domainCmd from './commands/domain.js';
+import * as storageCmd from './commands/storage.js';
+import * as llmCmd from './commands/llm.js';
+import * as fnCmd from './commands/fn.js';
+import * as containerCmd from './commands/container.js';
+describe('per-command flag typing', () => {
+    it('types --ttl by the command, not by merge order', () => {
+        expect(parseFlags(['--ttl', '3600'], domainCmd.SCHEMA).flags.ttl).toBe(3600);
+        expect(parseFlags(['--ttl', '600'], llmCmd.SCHEMA).flags.ttl).toBe(600);
+        // storage's --ttl is a duration string ("1h"), which is why it is declared
+        // 'string' — the collision is legitimate, the silent resolution was not.
+        expect(parseFlags(['--ttl', '1h'], storageCmd.SCHEMA).flags.ttl).toBe('1h');
+    });
+    it('keeps repeated --scope accumulating for fn', () => {
+        // fn.ts documents that `--scope email --scope storage` accumulates. Under
+        // the merged schema container's 'string' won and this THREW instead.
+        expect(parseFlags(['--scope', 'email', '--scope', 'storage'], fnCmd.SCHEMA).flags.scope)
+            .toBe('email,storage');
+        expect(parseFlags(['--scope', 'all'], containerCmd.SCHEMA).flags.scope).toBe('all');
+    });
+    it('a merge still loses — which is why the dispatcher must not rely on one', () => {
+        // Pinning the old behaviour so the reason for the two-pass parse stays
+        // legible: this is what every command used to get.
+        const merged = { ...domainCmd.SCHEMA, ...storageCmd.SCHEMA };
+        expect(parseFlags(['--ttl', '3600'], merged).flags.ttl).toBe('3600');
+        const merged2 = { ...fnCmd.SCHEMA, ...containerCmd.SCHEMA };
+        expect(() => parseFlags(['--scope', 'a', '--scope', 'b'], merged2)).toThrow(/more than once/);
+    });
+});
+describe('collision inventory', () => {
+    it('every flag declared with two different types is listed here', async () => {
+        // Read every command module and collect flag → types. Plain fs rather than
+        // import.meta.glob: the tests are type-checked by tsc, which does not know
+        // Vite's glob helper.
+        const dir = fileURLToPath(new URL('./commands/', import.meta.url));
+        const files = readdirSync(dir)
+            // Some command modules have a colocated *.test.ts; importing one from
+            // inside a test makes vitest refuse the nested suite.
+            .filter(f => f.endsWith('.ts') && !f.endsWith('.test.ts') && !f.endsWith('.d.ts'));
+        const types = new Map();
+        let schemasSeen = 0;
+        for (const file of files) {
+            const mod = await import(pathToFileURL(join(dir, file)).href);
+            const schema = mod.SCHEMA;
+            if (!schema || typeof schema !== 'object')
+                continue;
+            schemasSeen++;
+            const name = file.replace(/\.ts$/, '');
+            for (const [flag, type] of Object.entries(schema)) {
+                if (!types.has(flag))
+                    types.set(flag, new Map());
+                const byType = types.get(flag);
+                if (!byType.has(type))
+                    byType.set(type, []);
+                byType.get(type).push(name);
+            }
+        }
+        // The scan must have found the command modules; an empty glob would make
+        // "no collisions" a statement about nothing.
+        expect(schemasSeen).toBeGreaterThan(20);
+        const collisions = [...types.entries()]
+            .filter(([, byType]) => byType.size > 1)
+            .map(([flag, byType]) => `${flag}: ` + [...byType.entries()]
+            .map(([t, cmds]) => `${t} (${cmds.sort().join(', ')})`).sort().join(' vs '))
+            .sort();
+        // Known and deliberate. Each is safe ONLY because the dispatcher types
+        // flags per command — adding one here means confirming that still holds.
+        expect(collisions).toEqual([
+            // fn accumulates repeated --scope into a list; container's --scope is a
+            // single value ("all"). Under the old merge, container won and
+            // `fn create --scope email --scope storage` threw "given more than once"
+            // — refusing the exact form fn.ts documents as supported.
+            // container's --env is repeatable so a value containing commas can be
+            // given on its own (`--env "ORIGINS=http://a,https://b"`), which is the
+            // shape an origin list actually has and which the single-string form
+            // refused. funnel's --env names a deploy channel (dev|prod) and is one
+            // value. Safe for the same reason as the others: the dispatcher types
+            // flags per command, so funnel never sees container's 'list'.
+            'env: list (container) vs string (funnel)',
+            'scope: list (fn) vs string (container)',
+            // domain's --ttl is DNS seconds and llm's is cache seconds; storage's is
+            // a duration string ("1h"). Under the old merge, storage won and both
+            // numeric ones silently became strings.
+            'ttl: number (domain, llm) vs string (storage)',
+        ]);
+    });
+});

package/dist/index.js

@@ -411,6 +411,8 @@ async function dispatchAccount(subcommand, restArgs, flags) {
     }
     switch (subcommand) {
         case 'mailing-address': return accountCmd.run('mailing-address', restArgs, flags);
+        case 'sending': return accountCmd.run('sending', restArgs, flags);
+        case 'resume-sending': return accountCmd.run('resume-sending', restArgs, flags);
         case 'setup': return setupCmd.setup(flags);
         case 'import-key': return setupCmd.importKey(restArgs[0], flags);
         case 'whoami': return accountCmd.whoami(flags);

package/dist/skills/my-api-hq/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-api-hq
-version: 1.2.2
+version: 1.3.0
 description: >
   Auth, organizations, and billing hub. Start here to get an api_key and org_id — every other service depends on both.
 triggers: [api key, account, organization, org, billing, balance, topup, credits, setup, defaults, brand, sync brand, doctor, health check, is my org healthy]
-checksum: sha256-e7f0a16a130603ca5664cf5c268658bffd85230fe89dc82a4fda715ff81135b8
+checksum: sha256-fd266da15b05dee12ce1e683612b76e0f5554247f255a9c8db9be006a403a8ff
 ---
 
 # MyApiHQ
@@ -26,7 +26,7 @@ An anonymous account can upgrade at any time via `myapi account link <email>`
 
 ### Health check
 
-`myapi doctor` runs an org-wide consistency check across every slot (funnels, webhooks, domains, containers, workflows, emails, payments) and layers on customer-perspective DNS/HTTP probes from your machine. It returns per-section findings (`✓` pass / `⚠` warning / `✗` critical) with remediation hints; add `--json` for machine output. The exit code is non-zero **only** on customer-actionable criticals — platform-side issues the MyAPI team is already handling are surfaced with an `ℹ` marker but don't fail the run. Run it to self-check before building (is the org set up?) and after (did everything wire up?).
+`myapi doctor` runs an org-wide consistency check across every slot and layers on customer-perspective DNS/HTTP probes from your machine. It returns per-section findings (`✓` pass / `⚠` warning / `✗` critical) with remediation hints; add `--json` for machine output. The exit code is non-zero **only** on customer-actionable criticals — platform-side issues the MyAPI team is already handling are surfaced with an `ℹ` marker but don't fail the run. Run it to self-check before building (is the org set up?) and after (did everything wire up?).
 <!-- llm:end -->
 
 ## Commands
@@ -53,6 +53,7 @@ An anonymous account can upgrade at any time via `myapi account link <email>`
 | `myapi billing usage [--period month|30d]` | Spend rolled up by service (month or trailing 30d) |
 | `myapi billing spend-cap [<amount> | clear] [--period month|day]` | Set/show/clear the account-level spend ceiling |
 | `myapi billing auto-recharge [show \| set \| disable]` | Keep the wallet funded — off-session refill when balance drops below a threshold, capped monthly |
+| `myapi account sending` / `myapi account resume-sending` | Is sending paused (bounces), and turn it on |
 | `myapi account mailing-address ["<address>"]` | Get or set the account's CAN-SPAM mailing address (required for email send) |
 | `myapi config set-org <id>` / `set-funnel <id>` / `set-domain <name>` | Set CLI defaults |
 | `myapi install-skills` | Install agent skills into ~/.claude/, ~/.gemini/, ~/.cursor/ |

package/dist/skills/my-crm-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-crm-api
-version: 1.0.2
+version: 1.2.0
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-ac33bd091d64089bf1d43b20431eff5361e018406bb5046f3c27fd628f7082fb
+checksum: sha256-fab860f3f7592640ab15b4f91670cba8217330617d7c9e96dd8e9e5f76abb657
 ---
 
 # MyCRMAPI
@@ -21,7 +21,7 @@ The store that closes the funnel. Without CRM the loop ends nowhere: discover pe
 - **mycrmapi** — engaged contacts + companies, *private to your org*, with engagement history
 
 A Goldfox row becomes a CRM contact when:
-1. You explicitly **promote** it (`myapi crm contacts promote <goldfox_person_id>`)
+1. You **promote** it (`myapi crm contacts promote <goldfox_person_id>`)
 2. *Or* a downstream service receives engagement for that email and auto-upserts the contact
 
 ### Lifecycle stages (fixed enum — same for contacts and companies)
@@ -48,22 +48,21 @@ email_sent | email_opened | email_clicked | email_replied
 pixel_visit | webhook_received | payment
 ```
 
-Agents cannot write events directly — the closed enum is intentional. For custom state use **mydatabaseapi** (KV) keyed on the contact id; the curated timeline stays authoritative.
+Agents cannot write events directly — the enum is closed on purpose. For custom state use **mydatabaseapi** keyed on the contact id.
 
 **Engagement kinds bump `last_engagement_at`**: email_*, pixel_visit, webhook_received. Admin kinds (created, promoted, stage_changed) don't — promoting a lead isn't engagement.
 
 ### Auto-ingest
 
-Today (v1):
-- **Webhook**: set per endpoint via `crm_email_path`, a JSON dot-path. Default `"email"` ingests `{"email":"x@y.com"}`. For Stripe, set `data.object.customer_email`; for GitHub, `sender.email`. Empty string disables ingest.
+- **Webhook** (live): set per endpoint via `crm_email_path`, a JSON dot-path. Default `"email"` ingests `{"email":"x@y.com"}`. For Stripe, set `data.object.customer_email`; for GitHub, `sender.email`. Empty string disables ingest.
 
-Coming next (backend wiring in progress):
+Coming next:
 - **Email**: every `myapi email message send` writes `email_sent`; opens/clicks fire `email_opened`/`email_clicked`
 - **Pixel**: `identify` calls with an email write `pixel_visit`
 
-If a contact doesn't exist for the matched email, it's auto-created with `source=` matching the originating service. The contact's company is auto-linked by email domain (creates the company on first sight).
+An unknown email auto-creates the contact with `source=` the originating service, and links its company by email domain.
 
-**Missing lead? Check `myapi webhook deliveries` before concluding it never arrived.** Raw payloads are always stored, so the delivery is there even when the contact isn't.
+**Missing lead? Check `myapi webhook deliveries` first.** Raw payloads are always stored, so the delivery is there even when the contact isn't.
 
 ### Soft delete + restore
 
@@ -71,11 +70,11 @@ If a contact doesn't exist for the matched email, it's auto-created with `source
 
 ### Goldfox enrichment (deferred)
 
-A contact promoted from Goldfox carries a `goldfox_person_id`; the embedded `goldfox_person` is null today, and Goldfox-only fields are not searchable.
+A promoted contact carries a `goldfox_person_id`; the embedded `goldfox_person` is null and Goldfox-only fields are not searchable.
 
 ### Search filter — re-engagement semantics
 
-`--max-last-engagement-days N` returns contacts last engaged *more than* N days ago, and intentionally **includes contacts with no engagement at all** (promoted-but-never-emailed Goldfox leads) — the natural targets of a re-engagement campaign. `--min-last-engagement-days N` is its complement: engaged *within* N days. `--company-id <id>` narrows to one company. To separate "never tried" from "tried and went cold," layer `--origin goldfox`.
+`--max-last-engagement-days N` returns contacts last engaged *more than* N days ago and intentionally **includes contacts never engaged at all** — promoted-but-never-emailed leads are the point of a re-engagement campaign. `--min-last-engagement-days N` is its complement; `--company-id` narrows to one company. Layer `--origin goldfox` to separate "never tried" from "went cold".
 
 ### Failure modes
 
@@ -99,6 +98,8 @@ A contact promoted from Goldfox carries a `goldfox_person_id`; the embedded `gol
 | `myapi crm contacts delete <id>` | Soft delete (events retained) |
 | `myapi crm contacts restore <id>` | Restore a soft-deleted contact |
 | `myapi crm contacts promote <goldfox_person_id>` | Idempotent Goldfox → CRM promote |
+| `myapi crm contacts promote-audience <audience_id>` | Bulk-promote a saved people-audience; idempotent, resumable |
+| `myapi crm contacts import <file.csv>` | CSV import; header row, `email` column required. Existing addresses are matched, never overwritten |
 | `myapi crm contacts events <id> [--kind ...]` | Timeline (newest first), filter by kind |
 
 ### Companies
@@ -114,10 +115,10 @@ All commands accept `--org <id>` (or set default: `myapi config set-org <id>`) a
 ## Examples
 <!-- llm:start -->
 ```bash
-# Discover → promote → engage workflow
-myapi people search --keyword saas --has-c-level --country US --limit 5 --json \
-  | jq -r '.people[].id' \
-  | while read pid; do myapi crm contacts promote "$pid"; done
+# Discover → promote → engage. Bulk resumes and cannot double-create.
+myapi audience list                                # saved Goldfox filters
+myapi crm contacts promote-audience <audience_id>  # whole audience
+myapi crm contacts promote <goldfox_person_id>     # or one lead
 
 # Find everyone in 'qualified' for a follow-up email
 myapi crm contacts search --stage qualified --json | jq -r '.contacts[].email'

package/dist/skills/my-email-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-email-api
-version: 1.0.1
+version: 1.2.0
 description: >
   Send transactional and bulk email from your own domain. Create mailboxes, send/receive messages, generate AI templates, and manage warmup.
 triggers: [email, mailbox, send email, transactional email, template, warmup, inbox, outbox, ses, sender reputation]
-checksum: sha256-18f539fc12dd9e9e8f2abecf518aa1ee70741f85cc26ba0a6a941b9c29d537d8
+checksum: sha256-897cf3dbc843ca06d02aecf298151e8635890852a5db8ab4035ee59df8db0aa9
 ---
 
 # MyEmailAPI
@@ -28,6 +28,7 @@ A registered domain via **mydomainapi** is the prerequisite — mailboxes need a
 | `email message` | `send`, `status`, `sent`, `inbox`, `outbox`, `get` | Transactional send + read |
 | `email warmup` | `start`, `stats`, `pause`, `resume`, `stop` | IP/domain warmup for sending reputation |
 | `email template` | `generate`, `list`, `get`, `preview`, `edit`, `send-test`, `delete` | AI-generated HTML templates |
+| `email campaign` | `create`, `list`, `get`, `update`, `resolve`, `start`, `pause`, `resume`, `cancel`, `recipients`, `stats` | Scheduled bulk send that drains at a daily limit |
 <!-- generated:end -->
 
 ## Examples
@@ -72,10 +73,55 @@ myapi email warmup stats --address hello@yourdomain.com
 | `--per-day` | `warmup start` | Cap the daily volume the ramp climbs to |
 | `--emails`, `--quick` | `verify bulk` | Addresses inline rather than on stdin; skip the catch-all probe |
 
+| `--addresses <csv>` | `campaign create` | An explicit short recipient list |
+| `--crm-stage`, `--crm-origin`, `--crm-company` | `campaign create` | Draw recipients from CRM instead |
+| `--crm-audience <id>` | `campaign create` | Only the people promoted from that saved audience |
+| `--crm-max-days`, `--crm-min-days` | `campaign create` | Engaged more than / within N days ago |
+| `--all-contacts` | `campaign create` | Every CRM contact — the unfiltered query, asked for by name |
+| `--state` | `campaign recipients` | Filter by `queued`, `sent`, `failed` or `excluded` |
+
 Forwarding keeps the original: `set-forwarding <user@domain> <forward-to@domain>`
 copies every inbound message to an external address and leaves it in the mailbox.
 `clear-forwarding <user@domain>` stops it.
 
+## Campaigns — a scheduled send, not a bulk one
+
+A campaign is scheduling on top of `message send`. It picks a **source**, freezes
+it, then drains at a daily limit.
+
+```bash
+# Draw from CRM: qualified contacts not engaged in 30+ days
+myapi email campaign create --name "Q3 re-engage" \
+  --template <template-id> --from you@yourdomain.com \
+  --crm-stage qualified --crm-max-days 30
+
+myapi email campaign resolve <id>   # who it reaches + what it costs. SENDS NOTHING.
+myapi email campaign start <id>     # begins; consent to the cost
+myapi email campaign stats <id>     # counts by state, sent today, daily limit
+```
+
+Four things that decide how you use it:
+
+- **`resolve` before `start`, always.** Resolve freezes the recipient set and
+  reports the count and the estimated cost without sending. It is the only way
+  to see what a start commits to, and `start` refuses an unresolved campaign.
+- **It does NOT send all at once.** A campaign spends `per_day_limit` per day,
+  spread across the day, and continues tomorrow. A campaign still `active` the
+  next morning is working, not stuck — bursting a list is the surest way to get
+  an account's sending paused.
+- **Recipients come from a source, not an upload.** `--crm-*` filters CRM
+  contacts (and sends land on their timeline); `--addresses` is for a short
+  ad-hoc list. There is no file upload: import into CRM first, and suppression,
+  unsubscribes and history then apply to those people like everyone else.
+- **Exclusions are reported, not hidden.** Resolve returns counts by reason —
+  suppressed, duplicate, invalid — so a set smaller than the source is
+  explainable. Suppression is checked AGAIN at send time, so someone who
+  unsubscribes mid-campaign is dropped rather than mailed.
+
+`pause` stops after the message in flight; `resume` continues; `cancel` ends it
+and drops what was queued. Status `paused_insufficient_funds` means the account
+could not pay — top up or enable auto-recharge, then `resume`.
+
 ## Notes
 
 - A mailbox is uniquely identified by its address (`username@domain`).
@@ -111,6 +157,7 @@ reply  { "success": true, "data": …, "error": null, "meta": {…} }
 
 - **Per-slot host** — do not assume one host serves every slot.
 - **Account-scoped, not org-scoped** — no `{org_id}` segment; the key identifies the account.
+- **Lists page** — one page is not the whole list; check `meta.has_more`.
 <!-- http:end -->
 
 Run `myapi email --help` or `myapi email <namespace> --help` for full flag reference.

package/dist/skills/my-email-verify-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Synchronous single-address email verification — syntax + DNS + Microsoft GetCredentialType probe. Returns a verdict in <1s for ~50% of inputs; the rest get verdict='unknown' with smtp_recommended=true. The pre-send quality gate for any outbound campaign.
 triggers: [email verify, email validation, deliverability, smtp, syntax check, dns mx, microsoft, mx lookup, bounce prevention]
-checksum: sha256-c8ae836c355066eee8a12753f818d3a90c35b99983d74913c8fc76edcc99668f
+checksum: sha256-0a654a6674bb40863d9bbffb3e6862e10f7e7603695e995416779f0a6b312865
 ---
 
 # MyEmailVerifyAPI
@@ -103,6 +103,7 @@ reply  { "success": true, "data": …, "error": null, "meta": {…} }
 
 - **Per-slot host** — do not assume one host serves every slot.
 - **Org id goes in the PATH** — there is no `X-Org-Id` header.
+- **Lists page** — one page is not the whole list; check `meta.has_more`.
 <!-- http:end -->
 
 Run `myapi email verify --help` for inline reference.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.21.1",
+  "version": "2.23.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.21.1"
+    "@myapihq/sdk": "^2.23.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",