@myapihq/cli 2.4.2 → 2.5.0

package/dist/commands/webhook.js

@@ -2,12 +2,14 @@ import { webhook as sdkWebhook } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson } from '../output.js';
 import { requireOrg } from '../helpers.js';
+import { formatDate } from '../utils.js';
 export const EXPOSES = [
     'POST /webhook/orgs/{org_id}/endpoints',
     'GET /webhook/orgs/{org_id}/endpoints',
     'PATCH /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
     'DELETE /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
     'GET /webhook/orgs/{org_id}/deliveries/{delivery_id}',
+    'GET /webhook/orgs/{org_id}/deliveries',
 ];
 export const SCHEMA = {
     org: 'string',
@@ -16,6 +18,9 @@ export const SCHEMA = {
     'crm-email-path': 'string',
     // 2026-05-15: backend's POST/PATCH endpoints accept forward_url.
     'forward-url': 'string',
+    'endpoint-id': 'string',
+    limit: 'number',
+    cursor: 'string',
 };
 export async function list(flags) {
     const config = requireConfig();
@@ -130,6 +135,62 @@ export async function delivery(id, flags) {
     const res = await sdkWebhook.getDelivery(config.api_key, orgId, id);
     printJson(res);
 }
+// deliveries — what an endpoint actually received.
+//
+// Before this existed, `delivery <id>` was the only read and the id is only
+// ever handed to whoever POSTed. For a funnel form that is the visitor's
+// browser, so the agent that built the form could not see its own
+// submissions; CRM ingest (email only) was the sole alternative and every
+// other field was unreachable. This is that gap closed.
+export async function deliveries(endpointArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi webhook deliveries [endpoint_id] [--limit N] [--cursor <c>] [--org <id>]');
+    const endpointId = endpointArg ?? flags['endpoint-id'];
+    const page = await sdkWebhook.listDeliveries(config.api_key, orgId, {
+        endpointId,
+        limit: typeof flags.limit === 'number' ? flags.limit : undefined,
+        cursor: typeof flags.cursor === 'string' ? flags.cursor : undefined,
+    });
+    if (flags.json) {
+        printJson(page);
+        return;
+    }
+    if (page.deliveries.length === 0) {
+        info(endpointId
+            ? `No deliveries yet for endpoint ${endpointId}.`
+            : 'No deliveries yet in this org. POST to an endpoint\'s inbound URL to create one.');
+        return;
+    }
+    printTable(page.deliveries.map(d => ({
+        id: d.id,
+        endpoint_id: d.endpoint_id,
+        received_at: formatDate(d.received_at),
+        forward: d.forward_status !== undefined ? String(d.forward_status) : '',
+        payload: summarizePayload(d.payload),
+    })), { flags });
+    // The full payload is the point of this command, so say how to get it
+    // rather than leaving the summary column as the only view.
+    info('');
+    info('Full payload for one delivery:  myapi webhook delivery <id>');
+    if (page.next_cursor) {
+        info(`More available — next page:     myapi webhook deliveries --cursor ${page.next_cursor}`);
+    }
+}
+// One-line preview of an arbitrary JSON payload. The table is for scanning;
+// `webhook delivery <id>` is for reading.
+function summarizePayload(payload) {
+    if (payload === null || payload === undefined)
+        return '';
+    if (typeof payload !== 'object')
+        return String(payload).slice(0, 60);
+    const entries = Object.entries(payload);
+    if (entries.length === 0)
+        return '{}';
+    const shown = entries.slice(0, 3)
+        .map(([k, v]) => `${k}=${typeof v === 'object' ? '…' : String(v).slice(0, 20)}`)
+        .join(' ');
+    return entries.length > 3 ? `${shown} +${entries.length - 3}` : shown;
+}
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     'list': 'myapi webhook list [--org <id>] [--json]',
@@ -153,6 +214,11 @@ endpoint).
 Slug is immutable; create a new endpoint if you need a different slug.`,
     'delete': 'myapi webhook delete <id> [--org <id>]',
     'delivery': 'myapi webhook delivery <delivery_id> [--org <id>]',
+    'deliveries': `myapi webhook deliveries [endpoint_id] [--limit N] [--cursor <c>] [--org <id>] [--json]
+
+Lists what your endpoints actually received, newest first. Use this rather
+than trying to capture delivery ids at POST time — for a funnel form the id
+goes to the visitor's browser, not to you.`,
 };
 export async function run(subcommand, args, flags) {
     if (!subcommand || (flags.help && !subcommand)) {
@@ -161,6 +227,7 @@ export async function run(subcommand, args, flags) {
 Subcommands:
   create     Create a new endpoint to receive data (returns an inbound URL)
   delete     Delete a webhook endpoint
+  deliveries List what your endpoints received (newest first, paginated)
   delivery   Inspect a specific webhook delivery (payload, received_at)
   list       List all inbound webhook endpoints
   update     Patch endpoint name / description / crm-email-path / forward-url
@@ -173,8 +240,12 @@ Payload contract:
   Workflows reference fields with {{ payload.field }} templating.
 
 Discovering delivery IDs:
-  Each POST to an inbound URL responds with {"delivery_id":"<uuid>"}.
-  Capture it from the response, then pass to: myapi webhook delivery <id>
+  myapi webhook deliveries            — list what came in, newest first
+  myapi webhook delivery <id>         — full payload for one
+
+  A POST to an inbound URL does return {"delivery_id":"<uuid>"}, but for a
+  funnel form that response goes to the visitor's browser, not to you — so
+  list them rather than trying to capture ids at submit time.
 
 Example — wire a contact form to email + Slack:
   WID=$(myapi webhook create "contact-form" --json | jq -r .id)
@@ -199,6 +270,7 @@ See the my-webhook-api skill for the full HTML + JS recipe.`);
         case 'update': return update(args[0], flags);
         case 'delete': return del(args[0], flags);
         case 'delivery': return delivery(args[0], flags);
+        case 'deliveries': return deliveries(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi webhook --help" for a list of valid subcommands.`);
     }
 }

package/dist/errors.js

@@ -28,6 +28,12 @@ export const ERROR_MESSAGES = {
     INSUFFICIENT_BALANCE: 'Insufficient balance. Run: myapi billing topup <amount>',
     INVALID_AMOUNT: 'Amount out of range. Maximum single top-up is $100. Run: myapi billing topup <amount>',
     SERVICE_NOT_LAUNCHED: 'This service is disabled pre-launch. Track availability via: myapi status',
+    // Every other blocker in the CLI names the command that unblocks it
+    // (DOMAIN_NOT_OWNED → `domain register`, MAILBOX_NOT_OWNED → …). This one
+    // stated the fact and stopped, so an agent had to go read `database --help`
+    // to discover namespaces are created explicitly. Observed during the
+    // 2026-07-27 from-scratch run.
+    NAMESPACE_NOT_FOUND: 'Namespace not found. Namespaces are created explicitly — run: myapi database create <name>  (list them with: myapi database namespaces)',
     RECORD_NOT_FOUND: 'DNS record not found in this zone.',
     INVALID_RECORD_TYPE: 'Unsupported record type. Allowed: A, AAAA, CNAME, MX, TXT.',
     MX_PRIORITY_REQUIRED: 'MX records require --priority (typical value: 10).',

package/dist/flags.d.ts

@@ -1,4 +1,4 @@
-export type FlagType = 'string' | 'boolean' | 'number';
+export type FlagType = 'string' | 'boolean' | 'number' | 'list';
 export type FlagSchema = Record<string, FlagType>;
 export declare const GLOBAL_FLAGS: FlagSchema;
 export interface ParsedArgs {

package/dist/flags.js

@@ -17,6 +17,7 @@ export function parseFlags(argv, schema = {}) {
     const args = [];
     const flags = {};
     const unknownFlags = [];
+    const seenValueFlags = new Set();
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         if (arg === '-h') {
@@ -91,6 +92,26 @@ export function parseFlags(argv, schema = {}) {
                 flags[key] = true;
                 continue;
             }
+            // Repeatable flag: accumulate rather than overwrite.
+            if (type === 'list') {
+                const prev = flags[key];
+                flags[key] = typeof prev === 'string' && prev.length > 0 ? `${prev},${raw}` : raw;
+                continue;
+            }
+            // A value flag given twice used to keep the LAST occurrence, silently.
+            // Reported from the field (Skout, 2026-07-27): three `--redirect` flags
+            // on `auth client create` registered one URI, reported success, and the
+            // production redirect was the one dropped — sign-in would have worked in
+            // dev and failed only for real users. Repeating a flag is a natural
+            // mistake when the docs say "comma-separated"; silently honouring the
+            // last is the one behaviour that can't be recovered from. Refuse, and
+            // say what to do instead.
+            if (seenValueFlags.has(key)) {
+                throw new Error(`--${key} was given more than once. Only the last value would be used, ` +
+                    `which silently discards the others.\n` +
+                    `→ If you meant to pass several values, comma-separate them: --${key} a,b,c`);
+            }
+            seenValueFlags.add(key);
             if (type === 'number') {
                 const n = Number(raw);
                 flags[key] = isNaN(n) ? raw : n;

package/dist/flags.test.js

@@ -155,3 +155,38 @@ describe('parseFlags', () => {
         expect(flags['no-enable']).toBe(true);
     });
 });
+// Repeated flags. Reported from the field (Skout, 2026-07-27): three
+// `--redirect` flags on `auth client create` registered ONE URI and reported
+// success. The dropped one was production, so sign-in worked in dev and would
+// have failed only for real users. The reporter caught it solely by reading
+// the confirmation line.
+describe('parseFlags — repeated flags are never silently collapsed', () => {
+    it('accumulates a repeatable (list) flag instead of keeping the last', () => {
+        const { flags } = parseFlags(['--redirect', 'https://prod/cb', '--redirect', 'http://localhost:5173/cb'], { redirect: 'list' });
+        expect(flags.redirect).toBe('https://prod/cb,http://localhost:5173/cb');
+    });
+    it('still accepts the documented comma-separated form for a list flag', () => {
+        const { flags } = parseFlags(['--redirect', 'a,b,c'], { redirect: 'list' });
+        expect(flags.redirect).toBe('a,b,c');
+    });
+    it('mixes repeated and comma forms', () => {
+        const { flags } = parseFlags(['--redirect', 'a,b', '--redirect', 'c'], { redirect: 'list' });
+        expect(flags.redirect).toBe('a,b,c');
+    });
+    it('REFUSES a non-repeatable value flag given twice rather than keeping the last', () => {
+        expect(() => parseFlags(['--name', 'prod', '--name', 'dev'], { name: 'string' }))
+            .toThrow(/given more than once/);
+    });
+    it('names the comma-separated escape hatch in the refusal', () => {
+        expect(() => parseFlags(['--name', 'a', '--name', 'b'], { name: 'string' }))
+            .toThrow(/comma-separate them/);
+    });
+    it('does not refuse repeated boolean flags — harmless and idempotent', () => {
+        const { flags } = parseFlags(['--yes', '--yes'], {});
+        expect(flags.yes).toBe(true);
+    });
+    it('a single occurrence of a value flag is unaffected', () => {
+        const { flags } = parseFlags(['--name', 'prod'], { name: 'string' });
+        expect(flags.name).toBe('prod');
+    });
+});

package/dist/index.js

@@ -47,6 +47,65 @@ import * as loginCmd from './commands/login.js';
 // Each command file declares the value flags it understands. We union them
 // into a single schema for the upfront parse, so adding a new value flag in
 // one command means editing one file (its SCHEMA), not a global allowlist.
+// Which command owns which flag schema. parseFlags necessarily runs against
+// the UNION of every schema (it has to know whether `--foo` eats the next
+// token before it knows the command), and its unknown-flag warning therefore
+// only fires for a flag no command declares. The consequence, found by
+// building a company from scratch on 2026-07-27: `myapi task create "x"
+// --priority 9` was accepted in silence and the value discarded, because
+// `priority` is a real flag — on `domain`, for MX records. The agent gets a
+// success and a task with default importance.
+//
+// This map lets us re-check the flags against the schema of the command that
+// actually ran, so a flag borrowed from a sibling is called out the same way a
+// typo already was. Commands absent from the map (setup, update) are skipped
+// rather than guessed at.
+const COMMAND_SCHEMAS = {
+    account: accountCmd.SCHEMA,
+    audience: audienceCmd.SCHEMA,
+    auth: authProductCmd.SCHEMA,
+    billing: billingCmd.SCHEMA,
+    company: companyCmd.SCHEMA,
+    config: configCmd.SCHEMA,
+    container: containerCmd.SCHEMA,
+    crm: crmCmd.SCHEMA,
+    database: databaseCmd.SCHEMA,
+    doctor: doctorCmd.SCHEMA,
+    domain: domainCmd.SCHEMA,
+    email: emailCmd.SCHEMA,
+    fn: fnCmd.SCHEMA,
+    funnel: funnelCmd.SCHEMA,
+    git: gitCmd.SCHEMA,
+    image: imageCmd.SCHEMA,
+    keys: keysCmd.SCHEMA,
+    llm: llmCmd.SCHEMA,
+    login: loginCmd.SCHEMA,
+    org: orgCmd.SCHEMA,
+    payments: paymentsCmd.SCHEMA,
+    people: peopleCmd.SCHEMA,
+    pixel: pixelCmd.SCHEMA,
+    queue: queueCmd.SCHEMA,
+    status: statusCmd.SCHEMA,
+    storage: storageCmd.SCHEMA,
+    task: taskCmd.SCHEMA,
+    url: urlCmd.SCHEMA,
+    webhook: webhookCmd.SCHEMA,
+    workflow: workflowCmd.SCHEMA,
+};
+// Flags the dispatcher itself consumes, valid on any command.
+const DISPATCH_FLAGS = new Set(['help', 'h', 'json', 'verbose', 'yes', 'y', 'version', 'v', 'V', 'org']);
+function warnForeignFlags(command, flags) {
+    if (!command || process.env.MYAPI_QUIET_UNKNOWN_FLAGS)
+        return;
+    const schema = COMMAND_SCHEMAS[command];
+    if (!schema)
+        return; // command has no declared schema — nothing to compare against
+    const foreign = Object.keys(flags).filter(k => !DISPATCH_FLAGS.has(k) && !(k in schema));
+    if (foreign.length === 0)
+        return;
+    banner(`› Note: ${foreign.map(f => `--${f}`).join(', ')} ${foreign.length === 1 ? 'is' : 'are'} not a flag of \`myapi ${command}\` — ` +
+        `the value was ignored. Run \`myapi ${command} --help\`.`);
+}
 const COMBINED_SCHEMA = {
     ...accountCmd.SCHEMA,
     ...authProductCmd.SCHEMA,
@@ -92,6 +151,7 @@ async function main() {
         return;
     }
     const { args, flags } = parseFlags(process.argv.slice(2), COMBINED_SCHEMA);
+    warnForeignFlags(args[0], flags);
     if (flags.version || flags.v || flags.V) {
         // Read the last-known published version from cache — no network call, so
         // `myapi --version` stays instant. The cache is refreshed by the

package/dist/output.js

@@ -26,6 +26,14 @@ export function spinnerFrame(i) {
     return SPINNER_FRAMES[i % SPINNER_FRAMES.length];
 }
 export function spinnerWrite(s) {
+    // Spinner frames rely on \r overwriting the line, which only happens on a
+    // terminal. Piped or captured — which is how every agent runs this — each
+    // frame just accumulates, so a single image generation produced
+    // "Generating image ⠋Generating image ⠙Generating image ⠹…" in the output an
+    // agent then has to read. Progress animation is for humans; suppress it
+    // when nobody is watching.
+    if (!process.stderr.isTTY)
+        return;
     process.stderr.write(s);
 }
 export function clearLine() {

package/dist/sdk-container.test.js

@@ -126,7 +126,7 @@ describe('container.getContainerLogs', () => {
     });
 });
 describe('container.EXPOSES', () => {
-    it('covers the 8 container endpoints', () => {
+    it('covers the 9 container endpoints', () => {
         expect(container.EXPOSES).toEqual([
             'POST /container/orgs/{org_id}/containers',
             'GET /container/orgs/{org_id}/containers',
@@ -136,6 +136,10 @@ describe('container.EXPOSES', () => {
             'GET /container/orgs/{org_id}/containers/{id}/logs',
             'POST /container/orgs/{org_id}/containers/{id}/domain',
             'DELETE /container/orgs/{org_id}/containers/{id}/domain',
+            // Added 2026-07-27: build-logs answers WHY a --source build failed,
+            // separately from the runtime `logs` stream (which interleaves platform
+            // audit records with application output).
+            'GET /container/orgs/{org_id}/containers/{id}/build-logs',
         ]);
     });
 });

package/dist/skills/my-audience-api/README.md

@@ -28,7 +28,7 @@ myapi audience refresh <id>
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**.

package/dist/skills/my-auth-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Add authentication to apps you build on MyAPI — a managed OIDC identity provider for your app's END USERS (à la Kinde/Auth0). One auth tenant per org; register OIDC clients; sign users in with managed Google or the hosted login page; verify RS256 tokens against the tenant JWKS.
 triggers: [auth, authentication, login, sign-in, oidc, oauth, jwt, jwks, sso, google sign-in, user accounts, identity provider, kinde, auth0, clerk]
-checksum: sha256-11dac8e8da70bd6bbf63fe11fae5adc038584dc23a09350b9e7b977a669aed41
+checksum: sha256-b5eca82bb59647677fdb5796778329160572598ac6914887768fd33529cdfe84
 ---
 
 # MyAuthAPI
@@ -113,3 +113,5 @@ myapi auth client list
 - Redirect URIs are matched exactly: absolute `https://…` (or
   `http://localhost…` for local dev).
 - `402 INSUFFICIENT_FUNDS` = empty wallet → `myapi billing topup <amount>` (or keep it funded automatically: `myapi billing auto-recharge set`). `402 SPEND_CAP_EXCEEDED` = you hit your account spend ceiling → raise it with `myapi billing spend-cap`.
+
+**End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (verify the id_token for identity; the access token is a bearer credential for `<issuer>/userinfo`).

package/dist/skills/my-company-api/README.md

@@ -23,7 +23,7 @@ myapi company get company_06 --include-people 5
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**.

package/dist/skills/my-container-api/README.md

@@ -22,7 +22,7 @@ myapi container domain <id> app.yourbrand.com
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` + `org_id` from **myapihq**. Custom domains require the parent domain registered via **mydomainapi**.

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-ce30765b31f9c29012dcfc13b538cf47bb90e21bc015b4cfc75c1e55b21b4d75
+checksum: sha256-0bd2fdee306f944702faf18b0cbb5d976a2bdc39c1f940c037600b0c0f6a4691
 ---
 
 # MyContainerAPI
@@ -75,3 +75,5 @@ myapi container domain <id> --remove
 - Containers are for dynamic apps and native deps. For static sites use `my-funnel-api`; for edge functions use `my-function-api`.
 
 Run `myapi container --help` for the full flag reference.
+
+**End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (env vars are create-only; a service is multi-instance; health-check `/livez` not `/healthz`).

package/dist/skills/my-crm-api/README.md

@@ -30,7 +30,7 @@ myapi crm contacts events <id>
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**.

package/dist/skills/my-crm-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-0ee12d579c51b300ff227a094c2082a2c6f3bf83d2d97ab16cb2f47ad3667fd6
+checksum: sha256-1e1e7a8c4674f7a109f5bb0b5e9f053e938d2ee36d56c6ce8a4276826f7d9609
 ---
 
 # MyCRMAPI
@@ -38,7 +38,7 @@ Move stage with `myapi crm contacts update <id> --stage qualified`. Every stage
 goldfox | email | pixel | webhook | manual
 ```
 
-Set automatically based on how the contact entered the CRM. Useful filter when you want "only contacts I've personally added" (`--source manual`) vs "warmed via Goldfox outreach" (`--source goldfox`).
+Set automatically from how the contact entered. Filter with `--source manual` (added by hand) vs `--source goldfox` (from outreach).
 
 ### Event timeline — reserved kinds
 
@@ -48,9 +48,9 @@ email_sent | email_opened | email_clicked | email_replied
 pixel_visit | webhook_received | payment
 ```
 
-Agents cannot write events directly — the closed enum is intentional. If you need custom state, use **mydatabaseapi** (KV) keyed on the contact id; the curated timeline stays authoritative for engagement.
+Agents cannot write events directly — the closed enum is intentional. For custom state use **mydatabaseapi** (KV) keyed on the contact id; the curated timeline stays authoritative.
 
-**Engagement-event kinds bump `last_engagement_at`**: email_sent/opened/clicked/replied, pixel_visit, webhook_received. Admin kinds (created, promoted, stage_changed) don't — promoting a Goldfox lead isn't engagement.
+**Engagement kinds bump `last_engagement_at`**: email_*, pixel_visit, webhook_received. Admin kinds (created, promoted, stage_changed) don't — promoting a lead isn't engagement.
 
 ### Auto-ingest
 
@@ -63,6 +63,8 @@ Coming next (backend wiring in progress):
 
 If a contact doesn't exist for the matched email, it's auto-created with `source=` matching the originating service. The contact's company is auto-linked by email domain (creates the company on first sight).
 
+**Missing lead? Check `myapi webhook deliveries` before concluding it never arrived.** A deadlock under concurrent ingest could drop the contact *after* the form returned success to the visitor (fixed 2026-07-27). Raw payloads were always stored, so the delivery is there even when the contact isn't.
+
 ### Soft delete + restore
 
 `myapi crm contacts delete <id>` sets `deleted_at` but **retains the event timeline**. By default soft-deleted contacts are excluded from search — pass `--include-deleted` to see them. Restore with `myapi crm contacts restore <id>`.

package/dist/skills/my-database-api/README.md

@@ -21,7 +21,7 @@ myapi database keys --ns my-app --values
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**.

package/dist/skills/my-database-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Per-org KV store with named namespaces, JSON values up to 256 KB, prefix-scan listing, and compare-and-swap via etag. The substrate for any stateful agent-built app on MyAPI — user tables, session stores, idempotency keys, per-user lookup maps.
 triggers: [database, kv, key value, namespace, store, state, etag, cas, session, idempotency]
-checksum: sha256-247b0efe4af6d1eebc320a11b9b7ce3f5b1aa6a2f86fa80631bb3fec1e0a8d22
+checksum: sha256-b66f7ebdff5bce05eaab90c6812ffc0f9ec729f6df1dc4a8bca90368406b4c21
 ---
 
 # MyDatabaseAPI
@@ -105,3 +105,5 @@ myapi database get "by-email:$EMAIL" --ns users --json | jq -r .value
 - **Free in v1.** Metered later if usage shows a need. Cost discipline still applies — store data, not blobs.
 
 Run `myapi database --help` for inline reference.
+
+**End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (KV writes must be wrapped as `{"value": …}`).

package/dist/skills/my-email-api/README.md

@@ -29,7 +29,7 @@ myapi email message send \
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires:

package/dist/skills/my-email-verify-api/README.md

@@ -21,7 +21,7 @@ myapi email verify alice@example.com --json    # full check breakdown
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**.

package/dist/skills/my-git-api/README.md

@@ -28,7 +28,7 @@ git push origin main
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**. For real-git clone/push, the

package/dist/skills/my-image-api/README.md

@@ -20,7 +20,7 @@ myapi image generate "A clean flat-color logo for a sustainable jam company"
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**. ~$0.05 per generation.

package/dist/skills/my-llm-api/README.md

@@ -29,7 +29,7 @@ myapi llm draft --kind email --prompt "Friendly welcome, under 60 words"
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**. Inference cost is debited from your MyAPI balance — top up via `myapi billing topup`, or keep it funded automatically with `myapi billing auto-recharge`.

package/dist/skills/my-people-api/README.md

@@ -23,7 +23,7 @@ myapi people get person_01
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**.

package/dist/skills/my-pixel-api/README.md

@@ -22,7 +22,7 @@ myapi pixel interactions --since 24h
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**.

package/dist/skills/my-queue-api/README.md

@@ -22,7 +22,7 @@ myapi queue jobs thumbnails
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` + `org_id` from **myapihq**.

package/dist/skills/my-storage-api/README.md

@@ -23,7 +23,7 @@ curl -O "$(myapi storage get-url <asset_id>)"
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**.

package/dist/skills/my-task-api/README.md

@@ -24,7 +24,7 @@ myapi task claim <id> && myapi task resolve <id>
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` + `org_id` from **myapihq**.

package/dist/skills/my-webhook-api/README.md

@@ -28,7 +28,7 @@ myapi webhook delivery <delivery_id>
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` and `org_id` from **myapihq**.

package/dist/skills/my-webhook-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Inbound webhook endpoints for non-funnel sources — Stripe, GitHub, custom services. Funnel forms use the my-funnel-api proxy.
 triggers: [webhook, inbound, receiver, stripe events, github webhook, slack notification, delivery, payload, event ingest]
-checksum: sha256-13680a0decdbb5b49d9d80b52203eb68a43450f94477936252b54dfd2b3845bc
+checksum: sha256-82666c883230a775b07c8e1ec6243e812e58f246dd9a7cf1659aee77b877ee73
 ---
 
 # MyWebhookAPI
@@ -32,6 +32,7 @@ Treat the webhook slug as a secret — anyone with the URL can POST.
 | `myapi webhook create "<name>" [--description "..."]` | Create an endpoint, returns id + inbound URL |
 | `myapi webhook list` | List all endpoints in your org |
 | `myapi webhook delete <id>` | Delete an endpoint and all its deliveries |
+| `myapi webhook deliveries [endpoint_id]` | List what came in, newest first (`--limit`, `--cursor`) |
 | `myapi webhook delivery <delivery_id>` | Get the full payload + headers for one delivery |
 <!-- generated:end -->
 
@@ -46,9 +47,12 @@ myapi webhook create "stripe-events" --description "Stripe payment events"
 curl -X POST https://api.mywebhookapi.com/webhook/in/<slug> \
   -H "Content-Type: application/json" \
   -d '{"event":"payment.succeeded"}'
-# → responds with {"delivery_id":"<uuid>"} — capture this to inspect later
+# → responds with {"delivery_id":"<uuid>"}
 
-# 3. Inspect a delivery by id (there is no list-deliveries route)
+# 3. See what actually arrived — list, then read one in full.
+#    Don't rely on capturing delivery_id at POST time: for a funnel form that
+#    response goes to the visitor's browser, not to you.
+myapi webhook deliveries
 myapi webhook delivery <delivery_id>
 ```
 

package/dist/skills/my-workflow-api/README.md

@@ -24,7 +24,7 @@ myapi workflow create "Slack on lead" \
 ## Authentication
 
 ```bash
-export MYAPI_KEY=mak_...
+export MYAPI_KEY=hq_live_...
 ```
 
 Requires `api_key` + `org_id` from **myapihq**, and a webhook endpoint id from **mywebhookapi**.