@myapihq/cli 2.4.3 → 2.5.0

package/dist/commands/authproduct.js

@@ -11,7 +11,7 @@ import { requireOrg } from '../helpers.js';
 export const SCHEMA = {
     name: 'string',
     type: 'string', // spa | web
-    redirect: 'string', // comma-separated redirect URIs
+    redirect: 'list', // comma-separated OR repeated; occurrences accumulate
     theme: 'string', // JSON for the hosted login page
     connections: 'string', // comma-separated sign-in methods: google,password,magic
     domain: 'string', // custom auth domain, e.g. auth.acme.com

package/dist/commands/billing.js

@@ -1,6 +1,6 @@
 import { hq } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
-import { success, error, printTable, info, printJson } from '../output.js';
+import { success, error, printTable, info, printJson, banner } from '../output.js';
 import { confirm, isNonInteractive } from '../prompt.js';
 import { formatDate } from '../utils.js';
 export const SCHEMA = {
@@ -185,7 +185,13 @@ export async function topup(amountStr, flags) {
         }
     }
     const config = requireConfig();
-    const result = await hq.topUp(config.api_key, amount);
+    // A replay means our retry collapsed into the original request rather than
+    // topping up again. Say so — an agent that reads "topped up" twice and adds
+    // the amounts up gets the balance wrong.
+    let replayed = false;
+    const result = await hq.topUp(config.api_key, amount, { onReplay: () => { replayed = true; } });
+    if (replayed)
+        banner('› This was a replay of an identical earlier top-up — your balance was charged once, not twice.');
     success(`Top up successful! New balance: ${result.new_balance_display}`);
 }
 export async function setup(_flags) {

package/dist/commands/config.js

@@ -5,6 +5,7 @@ export const SCHEMA = {
     _via: 'string',
 };
 export const EXPOSES = [
+    'PATCH /hq/account/default-org',
     'GET /hq/orgs/{org_id}',
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}',
 ];
@@ -34,10 +35,25 @@ export async function setOrg(id, _flags, via = 'auth config') {
     }
     catch { /* swallow — clearing alone is still correct */ }
     saveConfig(config);
+    // Also pin it account-side. The local default lives in this machine's
+    // ~/.myapi/config.json, so signing in anywhere else used to land on whatever
+    // org the backend picked ("most recently created") — which is how an agent
+    // on a fresh machine ends up writing to the wrong namespace. Best-effort:
+    // the local default is already saved and correct, so a failure here is a
+    // smaller default not following you, never a broken local setup.
+    let pinned = false;
+    try {
+        await hq.setAccountDefaultOrg(config.api_key, org.id);
+        pinned = true;
+    }
+    catch { /* local default stands */ }
     success(`Default organization set to: ${org.name || org.id}`);
     if (config.default_funnel) {
         info(`  Default funnel auto-resolved to ${config.default_funnel}.`);
     }
+    info(pinned
+        ? '  Pinned account-wide — new logins on other machines get this org too.'
+        : '  Set on this machine only (could not pin it account-wide).');
 }
 export async function setFunnel(id, _flags, via = 'auth config') {
     if (!id) {

package/dist/commands/container.d.ts

@@ -7,7 +7,7 @@ export declare const NAME_RE: RegExp;
 export declare const RESERVED_NAMES: Set<string>;
 export declare function _validateName(name: string): string | null;
 export declare function _parseEnv(raw: string): Record<string, string> | string;
-export declare function create(flags: Flags): Promise<void>;
+export declare function create(nameArg: string | undefined, flags: Flags): Promise<void>;
 export declare function list(flags: Flags): Promise<void>;
 export declare function get(id: string, flags: Flags): Promise<void>;
 export declare function del(id: string, flags: Flags): Promise<void>;
@@ -15,4 +15,5 @@ export declare function _isTarball(p: string): boolean;
 export declare function deploy(id: string, image: string, flags: Flags): Promise<void>;
 export declare function logs(id: string, flags: Flags): Promise<void>;
 export declare function domain(id: string, domainArg: string | undefined, flags: Flags): Promise<void>;
+export declare function buildLogs(id: string | undefined, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/container.js

@@ -6,6 +6,7 @@ import { success, error, printTable, info, printJson, banner } from '../output.j
 import { formatDate, pollJob } from '../utils.js';
 import { requireOrg, confirmDestructive } from '../helpers.js';
 export const EXPOSES = [
+    'GET /container/orgs/{org_id}/containers/{id}/build-logs',
     'POST /container/orgs/{org_id}/containers',
     'GET /container/orgs/{org_id}/containers',
     'GET /container/orgs/{org_id}/containers/{id}',
@@ -70,12 +71,15 @@ function summarizeContainer(c) {
         updated_at: c.updated_at ? formatDate(c.updated_at) : '',
     };
 }
-export async function create(flags) {
+export async function create(nameArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi container create --name <name> [--type service|worker|job] [--org <id>]');
-    const name = flags.name;
+    // Positional name is the documented shape across the CLI (`org create`,
+    // `queue create`, `git create`, …); `--name` stayed the only accepted form
+    // here, which made these two the odd ones out. Both work now.
+    const name = nameArg ?? flags.name;
     if (!name) {
-        error('Missing --name.\nUsage: myapi container create --name <name> [--type service|worker|job] [--org <id>]\n\n→ Name is a kebab-case slug, 1-50 chars (e.g. "my-worker").');
+        error('Missing --name.\nUsage: myapi container create <name> [--type service|worker|job] [--org <id>]\n\n→ Name is a kebab-case slug, 1-50 chars (e.g. "my-worker").');
     }
     const nameErr = _validateName(name);
     if (nameErr)
@@ -326,6 +330,25 @@ export async function domain(id, domainArg, flags) {
     info(`Origin:     ${binding.origin}`);
     info(`Status:     ${binding.status}`);
 }
+export async function buildLogs(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi container build-logs <id> [--tail N] [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi container build-logs <id> [--tail N]');
+    const tail = typeof flags.tail === 'number' ? flags.tail : undefined;
+    const res = await sdkContainer.buildLogs(config.api_key, orgId, id, tail);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    const lines = res.logs ?? [];
+    if (lines.length === 0) {
+        info('No build logs yet — has this container been deployed with --source?');
+        return;
+    }
+    for (const l of lines)
+        info(l);
+}
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     'create': `myapi container create --name <name> [--type service|worker|job] [--cron <expr>]
@@ -384,13 +407,14 @@ jobs. The heavier-duty sibling of edge functions (myapi fn), for native
 dependencies and long execution.
 
 Subcommands:
+  build-logs <id>      Why the last --source build failed (--tail N; default 100)
   create               Register a container and get its scoped API key (returned once)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <image>  Ship a pre-built image (or --source <dir|tar> to build) and go live
   domain <id> <domain> Bind a custom domain (--remove to unbind)
   get <id>             Inspect a container
   list                 List containers in your org
-  logs <id>            Show recent runtime logs (--tail <n>)
+  logs <id>            Show recent runtime logs (--tail <n>) — see build-logs for build failures
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
@@ -404,7 +428,8 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
     }
     switch (subcommand) {
-        case 'create': return create(flags);
+        case 'create': return create(args[0], flags);
+        case 'build-logs': return buildLogs(args[0], flags);
         case 'deploy': return deploy(args[0], args[1], flags);
         case 'list': return list(flags);
         case 'get': return get(args[0], flags);

package/dist/commands/fn.d.ts

@@ -6,7 +6,7 @@ export declare const SCHEMA: FlagSchema;
 export declare const NAME_RE: RegExp;
 export declare const RESERVED_NAMES: Set<string>;
 export declare function _validateName(name: string): string | null;
-export declare function create(flags: Flags): Promise<void>;
+export declare function create(nameArg: string | undefined, flags: Flags): Promise<void>;
 export declare function list(flags: Flags): Promise<void>;
 export declare function get(id: string, flags: Flags): Promise<void>;
 export declare function del(id: string, flags: Flags): Promise<void>;

package/dist/commands/fn.js

@@ -1,7 +1,7 @@
 import { readFile } from 'fs/promises';
 import { fn as sdkFn } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
-import { success, error, printTable, info, printJson, banner } from '../output.js';
+import { success, error, printTable, info, printJson, banner, spinnerFrame, spinnerWrite, clearLine } from '../output.js';
 import { formatDate } from '../utils.js';
 import { requireOrg, confirmDestructive } from '../helpers.js';
 export const EXPOSES = [
@@ -14,8 +14,12 @@ export const EXPOSES = [
     'GET /function/orgs/{org_id}/functions/{id}/runs',
 ];
 export const SCHEMA = {
+    // `create` takes a positional name; --name stays accepted for
+    // back-compat (RELEASING.md's stated convention) and must be declared
+    // here so the command-aware flag check in index.ts doesn't flag it.
+    name: 'string',
     cron: 'string',
-    scope: 'string',
+    scope: 'list',
     set: 'string',
 };
 // Backend: Story 1 (function CRUD + scoped key) and Story 2/4/5 (deploy a
@@ -54,12 +58,15 @@ function summarizeFn(f) {
         updated_at: f.updated_at,
     };
 }
-export async function create(flags) {
+export async function create(nameArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi fn create --name <name> [--cron <expr>] [--org <id>]');
-    const name = flags.name;
+    // Positional name is the documented shape across the CLI (`org create`,
+    // `queue create`, `git create`, …); `--name` stayed the only accepted form
+    // here, which made these two the odd ones out. Both work now.
+    const name = nameArg ?? flags.name;
     if (!name) {
-        error('Missing --name.\nUsage: myapi fn create --name <name> [--cron <expr>] [--org <id>]\n\n→ Name is a kebab-case slug, 1-50 chars (e.g. "my-app-api").');
+        error('Missing --name.\nUsage: myapi fn create <name> [--cron <expr>] [--org <id>]\n\n→ Name is a kebab-case slug, 1-50 chars (e.g. "my-app-api").');
     }
     validateName(name);
     const cron = flags.cron;
@@ -69,9 +76,10 @@ export async function create(flags) {
     };
     if (cron)
         payload.cron_schedule = cron;
-    // --scope narrows the minted key's slot grants. Repeatable, but the flag
-    // parser keeps only the last occurrence, so we also accept a comma-joined
-    // list (e.g. --scope email,storage). Grants can never exceed the caller's.
+    // --scope narrows the minted key's slot grants. Declared 'list', so repeated
+    // occurrences accumulate (`--scope email --scope storage`) and a comma-joined
+    // form works too (`--scope email,storage`). It used to keep only the last
+    // occurrence silently. Grants can never exceed the caller's.
     if (typeof flags.scope === 'string') {
         const scopes = flags.scope.split(',').map(s => s.trim()).filter(Boolean);
         if (scopes.length > 0)
@@ -161,10 +169,44 @@ export async function deploy(id, bundlePath, flags) {
     }
     success(`Deployed function ${id}`);
     info(`Invocation URL:  ${result.invocation_url}`);
+    // The edge takes ~15-45s to start serving a freshly-deployed bundle, and
+    // until it does the invocation URL returns 404. That is a trap for the
+    // correct agent behaviour — deploy, then verify — because the obvious
+    // reading of a 404 is "the deploy failed", and the obvious recovery is to
+    // deploy again. Redeploying ROTATES THE SCOPED KEY, breaking anything
+    // already wired to the old one. So: wait for it here, and if it hasn't come
+    // up, say explicitly that redeploying is the wrong move.
+    if (result.invocation_url) {
+        await waitForLive(result.invocation_url);
+    }
     info('');
     info(`Scoped API key was rotated. New value (returned once — save it if you need it):`);
     info(`  ${result.scoped_api_key}`);
 }
+// Poll until the edge serves the new bundle. Best-effort and never fatal —
+// the deploy already succeeded, so a slow or unreachable edge must not turn a
+// successful write into a non-zero exit.
+async function waitForLive(url, budgetMs = 75_000) {
+    const started = Date.now();
+    let frame = 0;
+    while (Date.now() - started < budgetMs) {
+        try {
+            const res = await fetch(url, { method: 'GET', signal: AbortSignal.timeout(5000) });
+            if (res.status !== 404) {
+                clearLine();
+                info(`Status:          live (${Math.round((Date.now() - started) / 1000)}s)`);
+                return;
+            }
+        }
+        catch { /* edge not answering yet */ }
+        spinnerWrite(`\r${spinnerFrame(frame++)} waiting for the edge to serve it…`);
+        await new Promise(r => setTimeout(r, 3000));
+    }
+    clearLine();
+    info(`Status:          not serving yet after ${Math.round(budgetMs / 1000)}s.`);
+    info(`                 The deploy itself succeeded — give it another minute.`);
+    info(`                 Do NOT redeploy to "fix" it: that rotates the scoped key again.`);
+}
 // _parseSetPairs parses `--set K=V` entries into a map. Accepts a single
 // string (comma-joined: K=V,K2=V2) or an array of strings (when the flag is
 // repeated and the parser preserves them). Returns the map or an error
@@ -312,7 +354,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;
     }
     switch (subcommand) {
-        case 'create': return create(flags);
+        case 'create': return create(args[0], flags);
         case 'deploy': return deploy(args[0], args[1], flags);
         case 'env': return setEnv(args[0], args[1], args[2], flags);
         case 'runs': return runs(args[0], flags);

package/dist/commands/keys.js

@@ -1,3 +1,4 @@
+import { formatDate } from '../utils.js';
 import { hq } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson } from '../output.js';
@@ -132,6 +133,10 @@ export async function list(flags) {
         Cap: k.spend_cap_cents != null
             ? `$${((k.current_period_spend_cents ?? 0) / 100).toFixed(2)} / $${(k.spend_cap_cents / 100).toFixed(2)} (${k.spend_cap_period})`
             : '—',
+        Created: k.created_at ? formatDate(k.created_at) : '',
+        // A key that has never authenticated a request is the one that's safe to
+        // revoke — so "never" is a useful answer here, not a missing value.
+        'Last used': k.last_used_at ? formatDate(k.last_used_at) : 'never',
     }));
     printTable(rows, {
         flags,

package/dist/commands/login.d.ts

@@ -17,4 +17,5 @@ export interface OpenerCommand {
 }
 export declare function browserCommand(url: string, platform?: string): OpenerCommand;
 export declare function openBrowser(url: string, opener?: OpenerCommand): Promise<boolean>;
+export declare function deviceLabel(): string;
 export declare function login(flags?: Flags): Promise<void>;

package/dist/commands/login.js

@@ -10,11 +10,13 @@
 // `--mock` still runs the whole browser UX against an in-process fake of the
 // hosted login page (real loopback server, real PKCE, fake identity, persists
 // nothing) for offline UX previews and demos.
+import { hq } from '@myapihq/sdk';
 import * as http from 'http';
+import * as os from 'os';
 import * as crypto from 'crypto';
 import { spawn } from 'child_process';
 import { info, success, error } from '../output.js';
-import { addAccount } from '../config.js';
+import { addAccount, loadConfig } from '../config.js';
 export const EXPOSES = [
     'POST /hq/account/exchange',
 ];
@@ -341,12 +343,62 @@ async function exchangeCodeForTokens(code, verifier, redirectUri) {
     }
     return data.id_token;
 }
+// A stable, human-meaningful label for this machine. Signing in on four
+// machines used to leave four indistinguishable account-wide keys with no way
+// to tell which was which — this is the half that makes `keys list`
+// actionable.
+export function deviceLabel() {
+    try {
+        return os.hostname() || 'cli';
+    }
+    catch {
+        return 'cli';
+    }
+}
+// Ids of keys already named for THIS device. Best-effort: if we have no
+// usable key yet (first sign-in on this machine) there is nothing to
+// supersede, and a failed lookup must never block signing in.
+async function priorKeysForThisDevice() {
+    const label = `cli@${deviceLabel()}`;
+    try {
+        const cfg = loadConfig();
+        if (!cfg?.api_key)
+            return [];
+        const keys = await hq.listApiKeys(cfg.api_key);
+        return keys.filter(k => k.name === label).map(k => k.id);
+    }
+    catch {
+        return [];
+    }
+}
+// Revoke the keys this device superseded. Runs AFTER the new key is saved, so
+// a failure here leaves the user signed in with a working key and one extra
+// stale key — the safe direction. Never fatal.
+async function revokeSuperseded(newKey, ids) {
+    if (ids.length === 0)
+        return;
+    let revoked = 0;
+    for (const id of ids) {
+        try {
+            await hq.revokeApiKey(newKey, id);
+            revoked++;
+        }
+        catch { /* leave it listed */ }
+    }
+    if (revoked > 0) {
+        info(`  Replaced ${revoked} previous key${revoked === 1 ? '' : 's'} for this device (cli@${deviceLabel()})`);
+    }
+}
 // exchangeTokenForKey trades the verified id_token for an hq API key + defaults.
 async function exchangeTokenForKey(idToken) {
     const r = await fetch(`${hqBase()}/hq/account/exchange`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ id_token: idToken }),
+        // `device` names the minted key `cli@<device>` so `keys list` says which
+        // machine each key belongs to. Deterministic per machine, which is what
+        // lets us revoke the key this device is replacing (below). Backend
+        // sanitises it and falls back to plain `cli` when absent.
+        body: JSON.stringify({ id_token: idToken, device: deviceLabel() }),
         signal: AbortSignal.timeout(30_000),
     });
     const env = await r.json().catch(() => ({}));
@@ -406,6 +458,13 @@ export async function login(flags = {}) {
         info('');
         error('Timed out waiting for the browser sign-in (3 minutes). Run: myapi login');
     }, CALLBACK_TIMEOUT_MS);
+    // Snapshot the keys this device already owns BEFORE signing in. Taking the
+    // list first is what makes the revoke safe: the key we are about to mint
+    // cannot be in a set captured before it existed, so there is no way to
+    // revoke the credential we just saved. (Matching afterwards would mean
+    // identifying the new key, and `prefix` is not derivable from the key
+    // string — a wrong guess here locks someone out of their own account.)
+    const supersededKeyIds = await priorKeysForThisDevice();
     let auth;
     let email = '';
     try {
@@ -430,6 +489,7 @@ export async function login(flags = {}) {
         default_org: auth.default_org || undefined,
         default_funnel: auth.default_funnel || undefined,
     });
+    await revokeSuperseded(auth.api_key, supersededKeyIds);
     success(`› Signed in${email ? ` · ${email}` : ''}`);
     info(`  Account: ${auth.account_id}`);
     if (auth.default_org)

package/dist/commands/payments.js

@@ -1,6 +1,6 @@
 import { payments as sdkPayments } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
-import { success, error, printTable, info, printJson } from '../output.js';
+import { success, error, printTable, info, printJson, banner } from '../output.js';
 import { formatDate } from '../utils.js';
 import { requireOrg } from '../helpers.js';
 export const EXPOSES = [
@@ -111,7 +111,11 @@ export async function charge(flags) {
         payload.success_url = flags['success-url'];
     if (flags['cancel-url'])
         payload.cancel_url = flags['cancel-url'];
-    const res = await sdkPayments.createCharge(config.api_key, orgId, payload);
+    // See billing.ts — a replayed charge did not execute a second time.
+    let replayed = false;
+    const res = await sdkPayments.createCharge(config.api_key, orgId, payload, { onReplay: () => { replayed = true; } });
+    if (replayed)
+        banner('› This was a replay of an identical earlier charge — the customer was charged once, not twice.');
     if (flags.json) {
         printJson(res);
         return;

package/dist/commands/pixel.d.ts

@@ -1,5 +1,5 @@
 import type { Exposes } from '../exposes.js';
-import type { Flags } from '../helpers.js';
+import { type Flags } from '../helpers.js';
 import type { FlagSchema } from '../flags.js';
 export declare const SCHEMA: FlagSchema;
 export declare const EXPOSES: Exposes;
@@ -8,4 +8,5 @@ export declare function visits(flags: Flags): Promise<void>;
 export declare function events(flags: Flags): Promise<void>;
 export declare function audience(flags: Flags): Promise<void>;
 export declare function identity(pixelId: string, flags: Flags): Promise<void>;
+export declare function identify(pixelId: string | undefined, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/pixel.js

@@ -1,7 +1,9 @@
 import { pixel as sdkPixel } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
-import { error, printTable, info, printJson } from '../output.js';
+import { success, error, printTable, info, printJson } from '../output.js';
+import { requireOrg } from '../helpers.js';
 export const SCHEMA = {
+    'external-id': 'string',
     org: 'string',
     website: 'string',
     'campaign-id': 'string',
@@ -12,6 +14,7 @@ export const SCHEMA = {
     offset: 'number',
 };
 export const EXPOSES = [
+    'POST /pixel/orgs/{org_id}/identify',
     'GET /pixel/orgs/{org_id}/interactions',
     'GET /pixel/orgs/{org_id}/visits',
     'GET /pixel/orgs/{org_id}/events',
@@ -151,6 +154,28 @@ const SUBCOMMAND_USAGE = {
     'audience': 'myapi pixel audience [--org <id>]',
     'identity': 'myapi pixel identity <pixel_id> --website <domain> [--org <id>]',
 };
+// identify — the WRITE half of identity resolution.
+//
+// `identity` reads the graph; without a call to this, that graph only ever
+// contains anonymous nodes. Call it on form submit or right after sign-in and
+// the visitor's whole prior anonymous history resolves to that person.
+export async function identify(pixelId, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi pixel identify <pixel_id> (--email <e> | --external-id <id>) [--org <id>]');
+    if (!pixelId)
+        error('Missing pixel_id.\nUsage: myapi pixel identify <pixel_id> --email <email>\n\n→ The pixel id comes from `myapi pixel visits` or `pixel interactions`.');
+    const email = typeof flags.email === 'string' ? flags.email : undefined;
+    const externalId = typeof flags['external-id'] === 'string' ? flags['external-id'] : undefined;
+    if (!email && !externalId) {
+        error('Nothing to identify with.\nPass --email <address> or --external-id <your-user-id>.');
+    }
+    const res = await sdkPixel.identify(config.api_key, orgId, pixelId, { email, externalId });
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Linked pixel ${pixelId} to ${email ?? externalId}`);
+}
 export async function run(subcommand, args, flags) {
     if (!subcommand || (flags.help && !subcommand)) {
         info(`Usage: myapi pixel <subcommand>
@@ -158,6 +183,7 @@ export async function run(subcommand, args, flags) {
 Subcommands:
   audience       Geographic distribution sample of your pixel audience
   events         Engagement events (sent / open / click / page_visit) by campaign or domain
+  identify       Link a known email/user id to an anonymous pixel visitor
   identity       Resolve the identity graph (emails, IPs, profiles) for a pixel ID
   interactions   Get a unified timeline of visits and events
                  (requires at least one filter: --website, --campaign-id, or --domain)
@@ -180,6 +206,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'events': return events(flags);
         case 'audience': return audience(flags);
         case 'identity': return identity(args[0], flags);
+        case 'identify': return identify(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi pixel --help" for a list of valid subcommands.`);
     }
 }

package/dist/commands/queue.d.ts

@@ -8,7 +8,7 @@ export declare function _parseDependsOn(raw: unknown): string[] | undefined;
 export declare function create(name: string, flags: Flags): Promise<void>;
 export declare function list(flags: Flags): Promise<void>;
 export declare function get(name: string, flags: Flags): Promise<void>;
-export declare function enqueue(name: string, flags: Flags): Promise<void>;
+export declare function enqueue(name: string, flags: Flags, extraArgs?: string[]): Promise<void>;
 export declare function jobs(name: string, flags: Flags): Promise<void>;
 export declare function job(jobId: string, flags: Flags): Promise<void>;
 export declare function del(name: string, flags: Flags): Promise<void>;

package/dist/commands/queue.js

@@ -101,10 +101,23 @@ export async function get(name, flags) {
     info(`Max concurrency: ${q.max_concurrency}`);
 }
 // ── Jobs ─────────────────────────────────────────────────────────────────────
-export async function enqueue(name, flags) {
+export async function enqueue(name, flags, extraArgs = []) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi queue enqueue <name> --payload <json> [--org <id>]');
     requireArg(name, 'name', 'myapi queue enqueue <name> --payload <json>');
+    // The payload is a flag, not a positional. Passing it positionally —
+    // `queue enqueue fulfilment '{"order":1}'` — used to be discarded in
+    // silence, and the command still reported "✓ Job enqueued", leaving a job
+    // with an empty payload behind. Refuse rather than warn: a job that ran
+    // with no payload is worse than one that never ran, and the caller
+    // demonstrably meant to send data.
+    if (extraArgs.length > 0) {
+        const looksJson = extraArgs[0].trim().startsWith('{') || extraArgs[0].trim().startsWith('[');
+        error(`Unexpected extra argument "${extraArgs[0].slice(0, 40)}${extraArgs[0].length > 40 ? '…' : ''}".` +
+            (looksJson
+                ? `\nThe payload is a flag, not a positional: myapi queue enqueue ${name} --payload '<json>'`
+                : `\nUsage: myapi queue enqueue <name> --payload <json>`));
+    }
     let payload;
     if (typeof flags.payload === 'string') {
         try {
@@ -219,7 +232,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'list': return list(flags);
         case 'get': return get(args[0], flags);
         case 'delete': return del(args[0], flags);
-        case 'enqueue': return enqueue(args[0], flags);
+        case 'enqueue': return enqueue(args[0], flags, args.slice(1));
         case 'jobs': return jobs(args[0], flags);
         case 'job': return job(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi queue --help" for a list of valid subcommands.`);

package/dist/commands/setup.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import * as crypto from 'crypto';
-import { loadConfig, saveConfig, addAccount, loadFullConfig } from '../config.js';
+import { loadConfig, saveConfig, addAccount, loadFullConfig, CONFIG_FILE } from '../config.js';
 import { info, success, banner } from '../output.js';
 import { ask, confirm } from '../prompt.js';
 import { hq, funnel as sdkFunnel } from '@myapihq/sdk';
@@ -350,7 +350,11 @@ export async function setup(flags = {}) {
         default_funnel: defaultFunnel,
         is_anonymous: isAnonymous,
     }, wantsSkills);
-    success(`› Saved to ~/.myapi/config.json`);
+    // Report where the config ACTUALLY went. This was hardcoded to
+    // `~/.myapi/config.json`, which became a lie the moment MYAPI_CONFIG_DIR
+    // shipped — a caller running isolated was told its config had landed in the
+    // operator's home directory.
+    success(`› Saved to ${CONFIG_FILE}`);
     // Validate key and ensure org/funnel defaults are still correct.
     // (resolveDefaults is non-fatal if the API call fails.)
     try {

package/dist/commands/storage.js

@@ -18,6 +18,7 @@ export const EXPOSES = [
 export const SCHEMA = {
     org: 'string',
     name: 'string',
+    'content-type': 'string',
 };
 // Mirrors UploadContentType in @myapihq/sdk + backend allowlist.
 const EXT_TO_CT = {
@@ -63,10 +64,20 @@ async function upload(filePath, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi storage upload <file> [--name <name>] [--org <id>]');
     requireArg(filePath, 'file', 'myapi storage upload <file> [--name <name>] [--org <id>]');
+    // The extension map is a CLI-side convenience for inferring Content-Type,
+    // NOT the API's allowlist — a user found the API happily accepting a CSV the
+    // CLI refused. Refusing on the client's behalf for something the server
+    // would take is the CLI overreaching, so --content-type is the escape hatch
+    // and the message says the limit is ours.
     const ext = extname(filePath).toLowerCase();
-    const contentType = EXT_TO_CT[ext];
+    const override = typeof flags['content-type'] === 'string' ? flags['content-type'] : undefined;
+    const contentType = override ?? EXT_TO_CT[ext];
     if (!contentType) {
-        error(`Unsupported file extension "${ext}". Supported: ${Object.keys(EXT_TO_CT).join(', ')}.\nFor other types, host the file and use "myapi storage ingest <url>".`);
+        error(`Can't infer a content type for "${ext}".\n` +
+            `Known here: ${Object.keys(EXT_TO_CT).join(', ')}.\n\n` +
+            `→ This list is the CLI's, not the API's — the API may well accept your file.\n` +
+            `  Force it:  myapi storage upload ${filePath} --content-type <mime>\n` +
+            `  Or host it and use:  myapi storage ingest <url>`);
     }
     let data;
     try {

package/dist/commands/webhook.d.ts

@@ -9,4 +9,5 @@ export declare function update(id: string, flags: Flags): Promise<void>;
 export declare function _validateForwardUrl(url: string): string | null;
 export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function delivery(id: string, flags: Flags): Promise<void>;
+export declare function deliveries(endpointArg: string | undefined, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;