@myapihq/cli 2.4.1 → 2.4.3

package/dist/config-envkey.test.js

@@ -0,0 +1,145 @@
+// loadConfig()'s env-key rule.
+//
+// The bug this pins: MYAPI_API_KEY used to override only `api_key` while the
+// rest of the active account — default_org, default_funnel, default_domain —
+// came along for the ride. Authenticating as account B against account A's
+// default org is a cross-tenant write that no command-level guard can catch,
+// because the org being written to genuinely is the configured default.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const KEY_A = 'hq_live_aaaaaaaaaaaaaaaaaaaa';
+const KEY_B = 'hq_live_bbbbbbbbbbbbbbbbbbbb';
+const ORG_A = 'org-aaaa';
+const ORG_B = 'org-bbbb';
+let tmpHome;
+const FULL_CONFIG = {
+    active: 0,
+    autocomplete_setup: true,
+    accounts: [
+        { api_key: KEY_A, account_id: 'acct-a', default_org: ORG_A, default_funnel: 'fun-a', default_domain: 'a.com' },
+        { api_key: KEY_B, account_id: 'acct-b', default_org: ORG_B, default_funnel: 'fun-b', default_domain: 'b.com' },
+    ],
+};
+// config.ts resolves CONFIG_DIR from os.homedir() at import time, so HOME has
+// to point at the fixture before the dynamic import below. os.homedir() can't
+// be spied in ESM, but on POSIX it reads $HOME — which is also how the smoke
+// tier keeps tests off the real ~/.myapi/config.json.
+let realHome;
+async function loadConfigFresh() {
+    vi.resetModules();
+    const mod = await import('./config.js');
+    return mod.loadConfig();
+}
+beforeEach(() => {
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'myapi-cfg-'));
+    realHome = process.env.HOME;
+    process.env.HOME = tmpHome;
+    fs.mkdirSync(path.join(tmpHome, '.myapi'), { recursive: true });
+    fs.writeFileSync(path.join(tmpHome, '.myapi', 'config.json'), JSON.stringify(FULL_CONFIG));
+    delete process.env.MYAPI_API_KEY;
+    delete process.env.MYAPI_KEY;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+    vi.resetModules();
+    if (realHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = realHome;
+    delete process.env.MYAPI_API_KEY;
+    delete process.env.MYAPI_KEY;
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+describe('loadConfig with no env key', () => {
+    it('returns the active account with its own defaults', async () => {
+        const c = await loadConfigFresh();
+        expect(c?.api_key).toBe(KEY_A);
+        expect(c?.default_org).toBe(ORG_A);
+        expect(c?.autocomplete_setup).toBe(true);
+    });
+});
+describe('loadConfig with an env key belonging to a stored account', () => {
+    it("adopts THAT account's defaults, not the active one's", async () => {
+        // Account A is active; the env key is B's. Every default must follow B.
+        process.env.MYAPI_API_KEY = KEY_B;
+        const c = await loadConfigFresh();
+        expect(c?.api_key).toBe(KEY_B);
+        expect(c?.account_id).toBe('acct-b');
+        expect(c?.default_org).toBe(ORG_B);
+        expect(c?.default_funnel).toBe('fun-b');
+        expect(c?.default_domain).toBe('b.com');
+    });
+});
+describe('MYAPI_CONFIG_DIR', () => {
+    // The agent test-harness used to write the operator's real
+    // ~/.myapi/config.json to point at its throwaway org, then restore it
+    // best-effort. This override is what lets it stop doing that.
+    it('redirects the config surface away from the home directory', async () => {
+        const alt = fs.mkdtempSync(path.join(os.tmpdir(), 'myapi-alt-'));
+        fs.writeFileSync(path.join(alt, 'config.json'), JSON.stringify({
+            active: 0,
+            accounts: [{ api_key: 'hq_live_alt', account_id: 'acct-alt', default_org: 'org-alt' }],
+        }));
+        const prev = process.env.MYAPI_CONFIG_DIR;
+        process.env.MYAPI_CONFIG_DIR = alt;
+        try {
+            const c = await loadConfigFresh();
+            expect(c?.api_key).toBe('hq_live_alt');
+            expect(c?.default_org).toBe('org-alt');
+            // The HOME fixture (account A, org-aaaa) must not bleed through.
+            expect(c?.default_org).not.toBe(ORG_A);
+        }
+        finally {
+            if (prev === undefined)
+                delete process.env.MYAPI_CONFIG_DIR;
+            else
+                process.env.MYAPI_CONFIG_DIR = prev;
+            fs.rmSync(alt, { recursive: true, force: true });
+        }
+    });
+    it('leaves the home-directory config untouched', async () => {
+        const homeCfg = path.join(tmpHome, '.myapi', 'config.json');
+        const before = fs.readFileSync(homeCfg, 'utf-8');
+        const alt = fs.mkdtempSync(path.join(os.tmpdir(), 'myapi-alt-'));
+        fs.writeFileSync(path.join(alt, 'config.json'), JSON.stringify({
+            active: 0, accounts: [{ api_key: 'hq_live_alt', account_id: 'acct-alt' }],
+        }));
+        const prev = process.env.MYAPI_CONFIG_DIR;
+        process.env.MYAPI_CONFIG_DIR = alt;
+        try {
+            await loadConfigFresh();
+            expect(fs.readFileSync(homeCfg, 'utf-8')).toBe(before);
+        }
+        finally {
+            if (prev === undefined)
+                delete process.env.MYAPI_CONFIG_DIR;
+            else
+                process.env.MYAPI_CONFIG_DIR = prev;
+            fs.rmSync(alt, { recursive: true, force: true });
+        }
+    });
+});
+describe('loadConfig with an unknown env key', () => {
+    it('inherits NO namespace pointers from the active account', async () => {
+        // This is the regression. Previously default_org came back as ORG_A,
+        // so a `funnel push` with a stranger's key wrote into account A's org.
+        process.env.MYAPI_API_KEY = 'hq_live_cccccccccccccccccccc';
+        const c = await loadConfigFresh();
+        expect(c?.api_key).toBe('hq_live_cccccccccccccccccccc');
+        expect(c?.default_org).toBeUndefined();
+        expect(c?.default_funnel).toBeUndefined();
+        expect(c?.default_domain).toBeUndefined();
+    });
+    it('still carries non-namespace globals', async () => {
+        process.env.MYAPI_API_KEY = 'hq_live_cccccccccccccccccccc';
+        const c = await loadConfigFresh();
+        expect(c?.autocomplete_setup).toBe(true);
+    });
+    it('applies the same rule to the MYAPI_KEY alias', async () => {
+        process.env.MYAPI_KEY = 'hq_live_cccccccccccccccccccc';
+        const c = await loadConfigFresh();
+        expect(c?.default_org).toBeUndefined();
+    });
+});

package/dist/config.js

@@ -1,7 +1,23 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-export const CONFIG_DIR = path.join(os.homedir(), '.myapi');
+// MYAPI_CONFIG_DIR redirects the whole config surface — key, accounts,
+// defaults — somewhere other than ~/.myapi.
+//
+// This exists so an automated caller can run against an isolated config
+// WITHOUT mutating the operator's real one. The agent test-harness used to
+// reach into ~/.myapi/config.json, overwrite `default_org` to point at its
+// throwaway test org, and restore it afterwards on a best-effort basis. A
+// crash between those two points left the operator's default pointing at an
+// org that no longer exists, and the restore swallowed its own failures.
+// Pointing the subprocess at its own config dir removes the shared mutable
+// state instead of trying to undo it.
+//
+// Deliberately not HOME: the harness spawns coding agents that keep their own
+// credentials under HOME, so moving it breaks them.
+export const CONFIG_DIR = process.env.MYAPI_CONFIG_DIR
+    ? path.resolve(process.env.MYAPI_CONFIG_DIR)
+    : path.join(os.homedir(), '.myapi');
 export const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
 function ensureDir() {
     if (!fs.existsSync(CONFIG_DIR))
@@ -30,6 +46,20 @@ export function loadFullConfig() {
     return isFullConfig(raw) ? raw : migrate(raw);
 }
 // loadConfig returns the active account merged with globals — unchanged interface for all callers.
+//
+// The env-key rule is the subtle part. This used to spread the active account
+// (default_org / default_funnel / default_domain and all) and then override
+// only `api_key` from the environment. Export account B's key while account A
+// is active and every command authenticated as B but resolved its target from
+// A's namespace pointers — `funnel push` and `domain assign` take their org
+// from exactly those defaults, so a cross-tenant write looked like a normal
+// one. The command-level guards can't catch it either: the org they check
+// against genuinely IS the configured default.
+//
+// So: an env key is only allowed to inherit defaults that belong to it.
+//   - matches a stored account  → use THAT account's entry, defaults included
+//   - matches nothing stored    → key only, no inherited namespace pointers
+//     (commands then require an explicit --org, which is the safe failure)
 export function loadConfig() {
     const envKey = process.env.MYAPI_API_KEY || process.env.MYAPI_KEY;
     const full = loadFullConfig();
@@ -38,15 +68,21 @@ export function loadConfig() {
     if (!full)
         return null;
     const active = full.accounts[full.active] ?? full.accounts[0];
+    if (envKey) {
+        const owner = full.accounts.find(a => a.api_key === envKey);
+        if (owner) {
+            return { ...owner, autocomplete_setup: full.autocomplete_setup };
+        }
+        // Unknown key: carry only the globals. Deliberately NOT falling back to
+        // the active account's defaults — that is the whole bug.
+        return { api_key: envKey, account_id: '', autocomplete_setup: full.autocomplete_setup };
+    }
     if (!active)
         return null;
-    const config = {
+    return {
         ...active,
         autocomplete_setup: full.autocomplete_setup,
     };
-    if (envKey)
-        config.api_key = envKey;
-    return config;
 }
 // Single point of truth for writes. Ensures CONFIG_DIR exists and that the
 // file is created with mode 0o600 (owner read/write only) — no caller has

package/dist/errors.js

@@ -16,6 +16,10 @@ export const ERROR_MESSAGES = {
     DOMAIN_NOT_AVAILABLE: 'This domain is not available for registration.',
     db_error: 'Resource not found or invalid ID.',
     NOT_FOUND: 'Resource not found.',
+    // Lowercase variant — what the funnel/org handlers actually return. Only
+    // the uppercase form was mapped, so a real 404 printed the bare code
+    // `not_found` with no guidance. Observed live 2026-07-26.
+    not_found: 'Resource not found. Check the id, and that --org points at the org that owns it.',
     domain_not_found: 'Domain not found.',
     invalid_domain: 'Invalid domain name.',
     invalid_org: 'Invalid organization.',
@@ -34,6 +38,13 @@ export const ERROR_MESSAGES = {
     // invalid_json_response intentionally absent — the SDK's MyApiError now
     // builds a useful detailed message for that case (status + URL + body
     // snippet), and friendlyError(err.code) would override it.
+    //
+    // Transport-level codes (status 0). The SDK used to let these escape as a
+    // bare `TypeError: fetch failed`, which told an agent nothing about whether
+    // retrying was sensible. Each of these says so explicitly.
+    network_error: 'Could not reach the MyAPI backend — check your network connection. The request never arrived, so nothing was charged or changed.',
+    timeout: 'The request timed out. The SDK already retried where it was safe to; raise the deadline with MYAPI_TIMEOUT_MS if this call is legitimately slow.',
+    request_aborted: 'Request cancelled.',
 };
 export function friendlyError(err) {
     const body = err.body ?? {};

package/dist/index.js

@@ -1,12 +1,17 @@
 #!/usr/bin/env node
 import { error, info, success, banner } from './output.js';
 import { loadConfig } from './config.js';
-import { MyApiError } from '@myapihq/sdk';
+import { MyApiError, setUserAgent } from '@myapihq/sdk';
 import { friendlyError } from './errors.js';
 import * as fs from 'fs';
 import { parseFlags } from './flags.js';
 const pkgPath = new URL('../package.json', import.meta.url);
 const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+// Identify the CLI (and its version) on every outbound request. Without this
+// every call looked identical to a raw SDK consumer, so there was no way to
+// tell which client versions are still in the wild — which is what you need
+// before you can deprecate anything server-side.
+setUserAgent(`myapi-cli/${pkg.version} node/${process.versions.node}`);
 import * as accountCmd from './commands/account.js';
 import * as keysCmd from './commands/keys.js';
 import * as billingCmd from './commands/billing.js';

package/dist/sdk-transport.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-transport.test.js

@@ -0,0 +1,138 @@
+// Transport policy for the SDK's single fetch chokepoint (packages/sdk/src/client.ts).
+//
+// Everything here guards a behaviour that was absent before: a bare `fetch`
+// with no deadline, no retry, no request identity. The rules that matter most
+// are the *negative* ones — a POST must not be replayed, because until the
+// backend honors Idempotency-Key a replayed charge is a second charge.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { hq, crm, request, MyApiError } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+let fetchMock;
+function ok(data) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(status, headers = {}) {
+    return new Response(JSON.stringify({ success: false, error: { code: 'transient' } }), {
+        status,
+        headers: { 'content-type': 'application/json', ...headers },
+    });
+}
+function headersOf(call) {
+    return fetchMock.mock.calls[call][1].headers;
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+    // Backoff is real time; collapse it so the suite stays fast.
+    vi.spyOn(globalThis, 'setTimeout').mockImplementation(((fn) => { fn(); return 0; }));
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+    vi.unstubAllGlobals();
+});
+describe('request identity', () => {
+    it('sends a User-Agent on every request', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        await hq.listOrgs(API_KEY);
+        expect(headersOf(0)['User-Agent']).toMatch(/^myapihq-sdk\/\d+\.\d+\.\d+$/);
+    });
+    it('sends an Idempotency-Key on mutating calls', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: 'c1' }));
+        await crm.createContact(API_KEY, ORG_ID, { email: 'a@b.com' });
+        expect(headersOf(0)['Idempotency-Key']).toBeTruthy();
+    });
+    it('does not send an Idempotency-Key on reads', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        await hq.listOrgs(API_KEY);
+        expect(headersOf(0)['Idempotency-Key']).toBeUndefined();
+    });
+});
+describe('retry policy', () => {
+    it('retries an idempotent call on 503 and returns the eventual success', async () => {
+        fetchMock
+            .mockResolvedValueOnce(fail(503))
+            .mockResolvedValueOnce(ok([{ id: 'org-1' }]));
+        const orgs = await hq.listOrgs(API_KEY);
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+        expect(orgs).toEqual([{ id: 'org-1' }]);
+    });
+    it('retries an idempotent call on a network failure', async () => {
+        fetchMock
+            .mockRejectedValueOnce(new TypeError('fetch failed'))
+            .mockResolvedValueOnce(ok([]));
+        await hq.listOrgs(API_KEY);
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+    });
+    it('gives up after the attempt cap and reports a network_error', async () => {
+        fetchMock.mockRejectedValue(new TypeError('ECONNRESET'));
+        const err = await hq.listOrgs(API_KEY).catch(e => e);
+        expect(err).toBeInstanceOf(MyApiError);
+        expect(err.code).toBe('network_error');
+        expect(fetchMock).toHaveBeenCalledTimes(3);
+    });
+    it('NEVER retries a POST — a replayed charge is a second charge', async () => {
+        fetchMock.mockResolvedValue(fail(503));
+        await crm.createContact(API_KEY, ORG_ID, { email: 'a@b.com' }).catch(() => { });
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+    it('NEVER retries a POST that fails at the transport layer either', async () => {
+        fetchMock.mockRejectedValue(new TypeError('fetch failed'));
+        await crm.createContact(API_KEY, ORG_ID, { email: 'a@b.com' }).catch(() => { });
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+    it('does not retry 500 — the write may already have landed', async () => {
+        fetchMock.mockResolvedValue(fail(500));
+        await hq.listOrgs(API_KEY).catch(() => { });
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+    it('does not retry 4xx client errors', async () => {
+        fetchMock.mockResolvedValue(fail(404));
+        await hq.listOrgs(API_KEY).catch(() => { });
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+    it('reuses one Idempotency-Key across retries, so an opted-in POST can dedupe', async () => {
+        // This is the invariant that makes `retryUnsafe` safe to turn on once the
+        // backend honors the header: every attempt of one logical call must carry
+        // the SAME key. A per-attempt key would deduplicate nothing.
+        fetchMock
+            .mockResolvedValueOnce(fail(429))
+            .mockResolvedValueOnce(ok({ id: 'c1' }));
+        await request('POST', 'https://api.example.com/thing', API_KEY, { a: 1 }, undefined, { retryUnsafe: true });
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+        const first = headersOf(0)['Idempotency-Key'];
+        expect(first).toBeTruthy();
+        expect(headersOf(1)['Idempotency-Key']).toBe(first);
+    });
+    it('honors Retry-After ahead of the backoff schedule', async () => {
+        fetchMock
+            .mockResolvedValueOnce(fail(429, { 'retry-after': '2' }))
+            .mockResolvedValueOnce(ok([]));
+        await hq.listOrgs(API_KEY);
+        // setTimeout is stubbed to fire synchronously; assert the delay we asked for.
+        const delays = setTimeout.mock.calls.map(c => c[1]);
+        expect(delays).toContain(2000);
+    });
+    it('lets a caller-supplied Idempotency-Key win', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: 'c1' }));
+        await request('POST', 'https://api.example.com/thing', API_KEY, { a: 1 }, { 'Idempotency-Key': 'caller-key' });
+        expect(headersOf(0)['Idempotency-Key']).toBe('caller-key');
+    });
+});
+describe('timeout', () => {
+    it('surfaces an aborted request as a timeout, not a raw AbortError', async () => {
+        const abortErr = Object.assign(new Error('aborted'), { name: 'AbortError' });
+        fetchMock.mockRejectedValue(abortErr);
+        const err = await crm.createContact(API_KEY, ORG_ID, { email: 'a@b.com' }).catch(e => e);
+        expect(err).toBeInstanceOf(MyApiError);
+        expect(err.code).toBe('timeout');
+    });
+    it('passes an AbortSignal to fetch so a hung call cannot hang forever', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        await hq.listOrgs(API_KEY);
+        expect(fetchMock.mock.calls[0][1].signal).toBeInstanceOf(AbortSignal);
+    });
+});

package/dist/sdk-version.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-version.test.js

@@ -0,0 +1,24 @@
+// Drift guard: packages/sdk/src/version.ts carries the version string that
+// ships in the User-Agent of every request. It can't read package.json at
+// runtime (the SDK runs on edge runtimes with no node:fs), so the literal is
+// synced by scripts/release.mjs. This test is what makes a missed sync loud
+// instead of shipping a User-Agent that lies about which client is calling.
+import { describe, it, expect } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { SDK_VERSION } from '@myapihq/sdk';
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const SDK_ROOT = path.resolve(HERE, '..', '..', 'sdk');
+describe('SDK_VERSION', () => {
+    it('matches packages/sdk/package.json', () => {
+        const pkg = JSON.parse(fs.readFileSync(path.join(SDK_ROOT, 'package.json'), 'utf-8'));
+        expect(SDK_VERSION).toBe(pkg.version);
+    });
+    it('is a plain x.y.z literal in version.ts', () => {
+        // Asserted against the source, not the build: release.mjs rewrites the
+        // literal with a regex, so the regex and the source must stay compatible.
+        const src = fs.readFileSync(path.join(SDK_ROOT, 'src', 'version.ts'), 'utf-8');
+        expect(src).toMatch(/export const SDK_VERSION = '\d+\.\d+\.\d+';/);
+    });
+});

package/dist/skills/my-api-hq/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Auth, organizations, and billing hub. Start here to get an api_key and org_id — every other service depends on both.
 triggers: [api key, account, organization, org, billing, balance, topup, credits, setup, defaults, brand, sync brand, doctor, health check, is my org healthy]
-checksum: sha256-pending
+checksum: sha256-80bee1daf601eb33abc5d66b7f8053b20abec1c9c0ec07f26e86e26a2d3bdb78
 ---
 
 # MyApiHQ

package/dist/skills/my-api-hq/claude/.claude-plugin/plugin.json

@@ -2,5 +2,6 @@
   "name": "my-api-hq",
   "description": "Core identity and billing hub. Manage auth, organizations, and billing.",
   "version": "1.0.0",
+  "status": "ga",
   "published": true
 }

package/dist/skills/my-audience-api/README.md

@@ -0,0 +1,40 @@
+---
+# my-audience-api
+
+Saved audiences = named filter snapshots over the people/company database. Build a target list once, reuse it across campaigns, refresh to re-evaluate.
+
+## What it does
+
+- Save a filter (over `my-people-api` or `my-company-api`) as a named, addressable audience
+- Get paged members (people or companies depending on source)
+- Refresh on demand — re-evaluates filter against current data, returns delta vs previous count
+- Full CRUD: create / list / get / update / delete
+
+## Quickstart
+
+```bash
+# Create an audience
+myapi audience create "EU SaaS VPs" \
+  --source people \
+  --filter '{"industry":["saas"],"seniority":["vp","c_level"],"country":["DE","FR","GB"]}'
+
+# Inspect members
+myapi audience members <id> --limit 20
+
+# Refresh after new data lands
+myapi audience refresh <id>
+```
+
+## Authentication
+
+```bash
+export MYAPI_KEY=mak_...
+```
+
+Requires `api_key` and `org_id` from **myapihq**.
+
+## Documentation
+
+Full filter contract and end-to-end recipes: see `SKILL.md`.
+
+Run `myapi audience --help` for inline reference.

package/dist/skills/my-audience-api/SKILL.md

@@ -0,0 +1,139 @@
+---
+name: my-audience-api
+version: 1.0.0
+description: >
+  Saved audiences = named Goldfox-filter snapshots over the people or company database. Build a target list once, name it, reuse it across campaigns, refresh to re-evaluate against current data. The persistence layer on top of my-people-api + my-company-api.
+triggers: [audience, segment, target list, saved filter, goldfox, lead list, abm list, refresh, members, prospect database]
+checksum: sha256-5d9a2731d587c476eff2955241001fecb8481bbc5e567f06b8e9e76a079eda92
+---
+
+# MyAudienceAPI
+
+A saved audience is a **named filter snapshot** over the Goldfox people or company database. Instead of repeating the same filter every time you run a campaign, save it once, reference the audience by id, and call `refresh` to re-evaluate against current data when the underlying dataset grows.
+
+## Capabilities
+<!-- llm:start -->
+Use when:
+
+- You'll target the same kind of list across multiple campaigns
+- You want a stable id to feed into email campaigns, workflows, or external tools
+- You need to know how many candidates match a filter without paging the whole result
+- You want to refresh a list as new rows are added to the Goldfox crawl
+
+Each audience has:
+- `name` and optional `description`
+- `source` — `"people"` or `"company"` (which database to filter against)
+- `filter` — the canonical Goldfox filter (same shape as `my-people-api` / `my-company-api`)
+- `member_count` — computed when filter is created or refreshed
+- An `id` for retrieving members, refreshing, deleting
+
+**Filter contract** (full Goldfox shape):
+
+```json
+{
+  "confidence":           ["high"],
+  "country":              ["US", "DE"],
+  "country_consistent":   true,
+  "seniority":            ["c_level", "vp_director"],   // people-source only
+  "email_type":           ["corporate"],                // people-source only
+  "tld_class":            ["cctld"],
+  "has_c_level":          true,
+  "has_decision_maker":   true,
+  "has_careers_page":     true,
+  "has_investors_page":   false,
+  "has_shop_page":        false,
+  "is_registered_entity": true,
+  "min_headcount":        5,
+  "min_source_count":     3,
+  "min_link_confidence":  0.8,                          // people-source only
+  "keyword":              "platform",
+  "limit":                100,
+  "offset":               0
+}
+```
+
+OR within an array; AND across fields. Empty filter = all rows with `confidence=high` (Goldfox's curated default tier).
+
+Allowed values:
+- **confidence**: `high` (default) / `low` / `very_low`
+- **seniority** (people only): `c_level`, `vp_director`, `manager`, `senior_ic`, `ic`
+- **email_type** (people only): `corporate`, `freemail`, `role_based`, `other_corporate`
+- **tld_class**: `cctld`, `generic`, `vanity`, `low_trust`, `other`
+- **country**: ISO 3166-1 alpha-2
+
+**Member fetch:** the response shape is `{ total, limit, offset, has_more, people?: […], companies?: […] }` — only one of `people` / `companies` is populated based on the audience's source. Use `--offset` to paginate.
+
+**Refresh delta:** `audience refresh` returns `{ total, previous, delta, refreshed_at }` — detect newly-matched rows.
+<!-- llm:end -->
+
+## Commands
+<!-- generated:start -->
+| Command | What it does |
+|---|---|
+| `myapi audience create <name> --source <people\|company> --filter '<json>' [--description <text>]` | Save a Goldfox filter as a named audience; returns id + initial member_count |
+| `myapi audience list` | List all audiences in the org |
+| `myapi audience get <id>` | Single audience (name, filter, member_count, timestamps) |
+| `myapi audience update <id> [--name <x>] [--description <y>] [--filter '<json>']` | Patch name/description/filter; member_count re-evaluates if filter changes |
+| `myapi audience delete <id>` | Remove an audience |
+| `myapi audience members <id> [--limit N] [--offset N]` | Paged member snapshot (people or companies depending on source) |
+| `myapi audience refresh <id>` | Re-evaluate filter against current data; returns delta vs previous count |
+<!-- generated:end -->
+
+## Examples
+<!-- llm:start -->
+```bash
+# 1. Create the audience
+AID=$(myapi audience create "EU decision makers w/ corporate emails" \
+  --source people \
+  --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"]}' \
+  --json | jq -r .id)
+
+# 2. Inspect members
+myapi audience members $AID --limit 20
+
+# 3. Refresh after new Goldfox data lands
+myapi audience refresh $AID
+# → Refreshed. 1247 → 1289 (+42)
+
+# 4. Update filter without losing the id
+myapi audience update $AID \
+  --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB","NL"],"email_type":["corporate"]}'
+
+# 5. Delete when done
+myapi audience delete $AID
+```
+
+### End-to-end recipe — outbound campaign driven by an audience
+
+```bash
+# Build with quality controls — definitive links + registered companies + careers signal
+AID=$(myapi audience create "EU growth-stage decision makers" \
+  --source people \
+  --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"],"min_link_confidence":0.9,"has_careers_page":true,"is_registered_entity":true}' \
+  --json | jq -r .id)
+
+# Pull all members as JSON
+myapi audience members $AID --limit 100 --json > targets.json
+
+# (later) Re-check before next batch
+myapi audience refresh $AID
+```
+
+### Company-source audience (ABM)
+
+```bash
+myapi audience create "EU growth-stage SaaS accounts" \
+  --source company \
+  --filter '{"country":["DE","FR","GB","NL"],"has_careers_page":true,"has_decision_maker":true,"is_registered_entity":true,"min_source_count":3}'
+```
+<!-- llm:end -->
+
+## Notes
+
+- The underlying dataset is the **Goldfox crawl** — multi-million-row corporate data with provenance signals. Defaults to `confidence=high` which is the curated tier.
+- `audience refresh` is cheap and idempotent; call it before any campaign run that depends on a current list.
+- `update --filter` REPLACES the whole filter (not merged). To shift one field, fetch the audience, merge in code, then update.
+- Audiences are per-org. Two orgs can have audiences with the same name; ids are globally unique.
+- Look before you delete: confirm the target with `myapi audience get <id>`, pass `--org` explicitly; delete verbs require `--yes` in non-interactive runs.
+
+Run `myapi audience --help` for full flag reference.

package/dist/skills/my-audience-api/claude/.claude-plugin/plugin.json

@@ -0,0 +1,7 @@
+{
+  "name": "my-audience-api",
+  "description": "Saved audiences = named filter snapshots over people/company database. Reuse across campaigns; refresh re-evaluates against current data.",
+  "version": "1.0.0",
+  "status": "preview",
+  "published": true
+}

package/dist/skills/my-auth-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Add authentication to apps you build on MyAPI — a managed OIDC identity provider for your app's END USERS (à la Kinde/Auth0). One auth tenant per org; register OIDC clients; sign users in with managed Google or the hosted login page; verify RS256 tokens against the tenant JWKS.
 triggers: [auth, authentication, login, sign-in, oidc, oauth, jwt, jwks, sso, google sign-in, user accounts, identity provider, kinde, auth0, clerk]
-checksum: sha256-pending
+checksum: sha256-11dac8e8da70bd6bbf63fe11fae5adc038584dc23a09350b9e7b977a669aed41
 ---
 
 # MyAuthAPI

package/dist/skills/my-auth-api/claude/.claude-plugin/plugin.json

@@ -2,5 +2,6 @@
   "name": "my-auth-api",
   "description": "Managed OIDC identity provider for the end users of apps built on MyAPI. Per-org auth tenant + OIDC clients, RS256/JWKS, hosted login, managed Google sign-in. A Kinde alternative.",
   "version": "1.0.0",
+  "status": "ga",
   "published": true
 }