@myapihq/cli 2.24.0 → 2.25.0

package/dist/commands/crm/companies.js

@@ -97,9 +97,10 @@ async function get(id, flags) {
 }
 async function update(id, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi crm companies update <id> [--stage <s>] [--name <n>] [--custom-json <json>] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi crm companies update <id> [--domain <d>] [--stage <s>] [--name <n>] [--custom-json <json>] [--org <id>]');
     requireArg(id, 'id', 'myapi crm companies update <id>');
     const patch = {
+        domain: typeof flags.domain === 'string' ? flags.domain : undefined,
         name: typeof flags.name === 'string' ? flags.name : undefined,
         lifecycle_stage: typeof flags.stage === 'string' ? flags.stage : undefined,
         custom: parseCustom(flags['custom-json']),

package/dist/commands/crm/contacts.js

@@ -111,9 +111,10 @@ async function get(id, flags) {
 }
 async function update(id, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi crm contacts update <id> [--stage <s>] [--first-name <n>] [--last-name <n>] [--company-id <id>] [--custom-json <json>] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi crm contacts update <id> [--email <a>] [--stage <s>] [--first-name <n>] [--last-name <n>] [--company-id <id>] [--custom-json <json>] [--org <id>]');
     requireArg(id, 'id', 'myapi crm contacts update <id>');
     const patch = {
+        email: typeof flags.email === 'string' ? flags.email : undefined,
         first_name: typeof flags['first-name'] === 'string' ? flags['first-name'] : undefined,
         last_name: typeof flags['last-name'] === 'string' ? flags['last-name'] : undefined,
         company_id: typeof flags['company-id'] === 'string' ? flags['company-id'] : undefined,
@@ -125,6 +126,14 @@ async function update(id, flags) {
         printJson(c);
         return;
     }
+    // The API returns the row it re-read, so a change that did not take is
+    // visible here. Email is the one that can collide with another contact, and
+    // reporting "updated" for a write that did not happen is worse than the
+    // failure itself.
+    if (patch.email && c.email?.toLowerCase() !== patch.email.trim().toLowerCase()) {
+        error(`The email was NOT changed — it is still ${c.email}.\n` +
+            `Another contact in this org most likely already uses ${patch.email}.`);
+    }
     success(`Contact ${c.id} updated (stage=${c.lifecycle_stage})`);
 }
 async function del(id, flags) {

package/dist/commands/flag-reachability.test.js

@@ -40,7 +40,7 @@ const sdk = vi.hoisted(() => ({
         promoteRevision: vi.fn(),
         createContainer: vi.fn(),
     },
-    crm: { searchContacts: vi.fn(), searchCompanies: vi.fn() },
+    crm: { searchContacts: vi.fn(), searchCompanies: vi.fn(), updateContact: vi.fn(), updateCompany: vi.fn() },
     fn: { listFunctions: vi.fn() },
     // Top-level SDK exports the handlers reach for. Mocking the module
     // wholesale drops anything not listed, and the failure reads as a missing
@@ -295,3 +295,40 @@ describe('git commit — authorship must not silently default', () => {
         expect(sdk.git.commit.mock.calls[0][3].author).toBeUndefined();
     });
 });
+// A CRM contact's email is its identity: the field most likely to be wrong
+// after an import and the one that changes when someone switches employer.
+// `--email` was declared in the crm flag schema (create and the filters use
+// it), so it parsed on `contacts update` and was then dropped on the floor —
+// the patch object simply never read it. The only way to correct an address
+// was to delete the contact and create another, losing the timeline, the
+// campaign history and the audience it was promoted from.
+//
+// Found by asking the reverse of the usual question: not "does the API accept
+// everything we send", but "do we send everything the API accepts".
+describe('crm update — identity fields must REACH the patch', () => {
+    const CONTACT = { id: 'ct1', email: 'new@example.com', lifecycle_stage: 'lead' };
+    const COMPANY = { id: 'co1', domain: 'new.example.com', lifecycle_stage: 'lead' };
+    it('sends --email on contacts update', async () => {
+        sdk.crm.updateContact.mockResolvedValue(CONTACT);
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('contacts', ['update', 'ct1'], { email: 'new@example.com', org: ORG }));
+        expect(sdk.crm.updateContact).toHaveBeenCalledWith('hq_live_test', ORG, 'ct1', expect.objectContaining({ email: 'new@example.com' }));
+    });
+    it('sends --domain on companies update', async () => {
+        sdk.crm.updateCompany.mockResolvedValue(COMPANY);
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('companies', ['update', 'co1'], { domain: 'new.example.com', org: ORG }));
+        expect(sdk.crm.updateCompany).toHaveBeenCalledWith('hq_live_test', ORG, 'co1', expect.objectContaining({ domain: 'new.example.com' }));
+    });
+    // The backend applies each field with its own UPDATE and does not check the
+    // result, so an email colliding with another contact leaves the row
+    // unchanged and still answers 200. It re-reads the row before replying, so
+    // the truth is in the response — and reporting "updated" for a write that
+    // did not happen is worse than the failure.
+    it('refuses to report success when the email did not actually change', async () => {
+        sdk.crm.updateContact.mockResolvedValue({ ...CONTACT, email: 'old@example.com' });
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('contacts', ['update', 'ct1'], { email: 'new@example.com', org: ORG }));
+        expect(exitError).toMatch(/NOT changed/);
+    });
+});

package/dist/skills/my-crm-api/SKILL.md

@@ -1,15 +1,15 @@
 ---
 name: my-crm-api
-version: 1.2.0
+version: 1.2.1
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-fab860f3f7592640ab15b4f91670cba8217330617d7c9e96dd8e9e5f76abb657
+checksum: sha256-8bc061c79940045d1f95ec4104a452c83342f9ebe2be3c0e087b4c4953524ce6
 ---
 
 # MyCRMAPI
 
-The store that closes the funnel. Without CRM the loop ends nowhere: discover people (Goldfox) → audience → email → pixel → form-fill via webhook → … nothing. People who *engage* live nowhere. CRM is where they land.
+The store that closes the funnel: discover people (Goldfox) → audience → email → pixel → form-fill via webhook → and then nowhere. CRM is where people who *engage* land.
 
 ## Capabilities
 <!-- llm:start -->
@@ -32,6 +32,10 @@ cold | warm | qualified | customer | churned
 
 Move stage with `myapi crm contacts update <id> --stage qualified`. Every stage change emits a `stage_changed` event with `{from, to}` so the timeline shows the journey.
 
+Correct an address with `--email` (companies: `--domain`) rather than recreating
+the record — a new contact has no timeline, no campaign history and no link to
+its source audience. A collision with another contact is refused.
+
 ### Contact sources (fixed enum)
 
 ```
@@ -54,7 +58,7 @@ Agents cannot write events directly — the enum is closed on purpose. For custo
 
 ### Auto-ingest
 
-- **Webhook** (live): set per endpoint via `crm_email_path`, a JSON dot-path. Default `"email"` ingests `{"email":"x@y.com"}`. For Stripe, set `data.object.customer_email`; for GitHub, `sender.email`. Empty string disables ingest.
+- **Webhook** (live): set per endpoint via `crm_email_path`, a JSON dot-path. Default `"email"`. Stripe: `data.object.customer_email`; GitHub: `sender.email`. Empty string disables ingest.
 
 Coming next:
 - **Email**: every `myapi email message send` writes `email_sent`; opens/clicks fire `email_opened`/`email_clicked`
@@ -66,7 +70,7 @@ An unknown email auto-creates the contact with `source=` the originating service
 
 ### Soft delete + restore
 
-`myapi crm contacts delete <id>` sets `deleted_at` but **keeps the event timeline**. By default soft-deleted contacts are excluded from search — pass `--include-deleted` to see them. Restore with `myapi crm contacts restore <id>`.
+`myapi crm contacts delete <id>` sets `deleted_at` but **keeps the event timeline**. Soft-deleted contacts are excluded from search unless you pass `--include-deleted`. Restore with `myapi crm contacts restore <id>`.
 
 ### Goldfox enrichment (deferred)
 
@@ -94,7 +98,7 @@ A promoted contact carries a `goldfox_person_id`; the embedded `goldfox_person`
 | `myapi crm contacts search [--stage ...] [--origin ...] [--email ...] [--min/max-last-engagement-days N]` | Filter contacts |
 | `myapi crm contacts create <email> [--first-name ...] [--last-name ...] [--stage ...] [--custom-json ...]` | Manually create (source='manual') |
 | `myapi crm contacts get <id>` | Fetch one contact (with embedded Goldfox enrichment when available) |
-| `myapi crm contacts update <id> [--stage ...] [...]` | Patch fields. Stage change emits `stage_changed` event |
+| `myapi crm contacts update <id> [--email <a>] [--stage ...] [...]` | Patch fields, `--email` included. Stage change emits `stage_changed` event |
 | `myapi crm contacts delete <id>` | Soft delete (events retained) |
 | `myapi crm contacts restore <id>` | Restore a soft-deleted contact |
 | `myapi crm contacts promote <goldfox_person_id>` | Idempotent Goldfox → CRM promote |
@@ -132,9 +136,11 @@ myapi crm contacts create alice@acme.com \
   --custom-json '{"intro_via":"riccardo","topic":"video editing"}'
 
 # Update stage as the deal progresses — emits a stage_changed event
-myapi crm contacts update <id> --stage qualified
 myapi crm contacts update <id> --stage customer
 
+# Fix a mistyped address without losing the timeline
+myapi crm contacts update <id> --email alice@acme.com
+
 # See the full engagement timeline
 myapi crm contacts events <id>
 
@@ -159,14 +165,13 @@ myapi crm contacts events <id> --kind webhook_received
 
 ## Notes
 
-- **Paginate with `--limit` + `--offset`.** `total` is the true match count
-  and the response carries `has_more`; branch on `has_more` rather than doing
-  arithmetic against `total`. (Both were broken until 2026-07-28. Cached
-  guidance saying the CRM cannot paginate is stale.)
-- **Reserved event kinds — no custom events in v1.** If an agent needs custom state per contact, use `myapi database` keyed by contact id. The curated timeline stays the authoritative engagement record.
-- **`external_id` on an event payload** is the backend's idempotency key — a duplicate of the action's natural id (`goldfox_person_id`, `delivery_id`). Read the semantic field instead; legacy `message_id` rows hold the same value.
+- **Paginate with `--limit` + `--offset`.** Branch on `has_more`, not on
+  arithmetic against `total`. (Cached guidance saying CRM cannot paginate is
+  stale — fixed 2026-07-28.)
+- **Reserved event kinds — no custom events in v1.** For custom per-contact state use `myapi database` keyed by contact id; the curated timeline stays authoritative.
+- **`external_id` on an event payload** is the backend's idempotency key, duplicating the action's natural id (`goldfox_person_id`, `delivery_id`). Read the semantic field instead.
 - **Only `webhook_received` fires today.** Email and pixel auto-ingest are coming; the CLI surface will not change.
-- **Free in v1.** Metered later if usage warrants.
+- **Free in v1.** Metered later if usage warrants it.
 
 ## HTTP (from deployed code)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.24.0",
+  "version": "2.25.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.24.0"
+    "@myapihq/sdk": "^2.25.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",