@myapihq/cli 2.6.2 → 2.7.1

package/dist/skills/my-function-api/SKILL.md

@@ -2,26 +2,26 @@
 name: my-function-api
 version: 1.0.0
 description: >
-  Deploy JavaScript functions to the MyAPI edge runtime (Cloudflare Workers). Register a function, upload a single-file JS bundle, get a live HTTP invocation URL or run it on a cron schedule. Each function gets a scoped capability key for cross-slot calls.
+  Deploy JavaScript functions to the MyAPI edge runtime. Register a function, upload a single-file JS bundle, get a live HTTP invocation URL or run it on a cron schedule. Each function gets a scoped capability key for cross-slot calls.
 triggers: [function, deploy function, edge function, serverless, cloudflare worker, cron, scoped api key, capability key, invocation url, bundle]
-checksum: sha256-ada0a52fdd9c0ba14ca86496e1c5c42e8b018155c3e8c83edba071fa6bd0b7e9
+checksum: sha256-08524ea08e91dcb6c8b68b64a7b4034d24a98a18968acd4ba80e45dbd6f85d09
 ---
 
 # MyFunctionAPI
 
-Deploy backend code without running a server. Register a function, upload a single-file JS bundle, and it goes live on the MyAPI edge runtime (Cloudflare Workers) with a public invocation URL — or runs on a cron schedule. Each function carries a scoped capability key so it can call other MyAPI slots with its own authority.
+Deploy backend code without running a server. Register a function, upload a single-file JS bundle, and it goes live on the MyAPI edge runtime with a public invocation URL — or runs on a cron schedule. Each function carries a scoped capability key so it can call other MyAPI slots with its own authority.
 
 The full loop is live: **create → deploy → invoke → inspect runs → set secrets**.
 
 ## Capabilities
 <!-- llm:start -->
-**Two-step lifecycle: register, then deploy.** `myapi fn create --name <slug>` persists the function record and mints a `scoped_api_key`, returned **exactly once** (save it if you need it). `myapi fn deploy <id> <bundle.js>` uploads a single-file JavaScript bundle (≤4MB); the backend wraps it with the MYAPI shim and ships it to Cloudflare Workers. After deploy the function has a live `invocation_url`.
+**Two-step lifecycle: register, then deploy.** `myapi fn create --name <slug>` persists the function record and mints a `scoped_api_key`, returned **exactly once** (save it if you need it). `myapi fn deploy <id> <bundle.js>` uploads a single-file JavaScript bundle (≤4MB); the backend wraps it with the MYAPI shim and ships it to the edge runtime. Propagation is typically 4-45s, so poll the invocation URL rather than redeploying. After deploy the function has a live `invocation_url`.
 
 **Scoped key = capability key.** It is **org-locked**. By default it inherits the deployer's slot grants; narrow it at create time with `--scope <slot>[,<slot>...]` (comma-separated, e.g. `--scope email,storage`) — the primary way to deploy a deliberately narrow function. Grants can never exceed the caller's, so a function never out-reaches the credential that created it. It is rejected with `403 SCOPE_FORBIDDEN` at `/hq/*`, `/admin/*`, `/internal/*`. **Deploy rotates this key** — the fresh value is printed once on every deploy. (Minting a narrow account key first — `myapi keys create --grant ...` — is only needed when the *deploy credential itself* must be constrained, e.g. handing deploy rights to another system.)
 
 **HTTP or cron triggers.** Default is `http` — the function gets a public invocation URL once deployed. Pass `--cron "<expr>"` at create time to run on a schedule (e.g. `"0 8 * * *"`) instead.
 
-**Secrets via Worker Secrets.** `myapi fn env <id> <name> <value>` sets a secret (Stripe key, API token, …) as a Cloudflare Worker Secret on a deployed function. The value is encrypted at rest by Cloudflare and never stored or echoed by MyAPI. The function must already be deployed.
+**Secrets are encrypted at rest.** `myapi fn env <id> <name> <value>` sets a secret (Stripe key, API token, …) on a deployed function. The value is encrypted at rest by the edge runtime and never stored or echoed by MyAPI. The function must already be deployed.
 
 **Inspect invocations.** `myapi fn runs <id>` lists recent invocation records (most recent first, up to 100) with status, duration, and any error message.
 
@@ -35,12 +35,12 @@ Name rules (validated client- and server-side, kept identical):
 | Command | What it does |
 |---|---|
 | `myapi fn create --name <name> [--cron <expr>] [--scope <slot>[,<slot>...]]` | Register a function record + receive scoped API key (returned once). `--scope` narrows the key's slot grants |
-| `myapi fn deploy <id> <bundle.js>` | Upload a single-file JS bundle (≤4MB) and go live; rotates the scoped key |
-| `myapi fn env <id> <name> <value>` | Set a Worker Secret on a deployed function |
+| `myapi fn deploy <id> <bundle.js>` | Upload a single-file JS bundle (≤4MB) and go live; rotates the scoped API key |
+| `myapi fn env <id> <name> <value>` | Set an encrypted secret on a deployed function |
 | `myapi fn runs <id>` | List recent invocation records (status, duration, errors) |
 | `myapi fn list` | List functions in your org |
 | `myapi fn get <id>` | Inspect a function (name, trigger, invocation URL) |
-| `myapi fn delete <id>` | Soft-delete the record + revoke the scoped key |
+| `myapi fn delete <id>` | Soft-delete the record + revoke the scoped API key |
 <!-- generated:end -->
 
 ## Examples
@@ -50,15 +50,15 @@ Name rules (validated client- and server-side, kept identical):
 myapi fn create --name my-app-api
 # → Function created: fn_abc123
 #   Scoped API key (returned once — save it if you need it):
-#     hq_live_...   (scoped keys are not visually distinct from account keys)
+#     hq_live_...   (scoped API keys are not visually distinct from account keys)
 
-# Deploy a single-file JS bundle → goes live, scoped key is rotated
+# Deploy a single-file JS bundle → goes live, scoped API key is rotated
 myapi fn deploy fn_abc123 ./dist/bundle.js
 # → Deployed function fn_abc123
 #   Invocation URL:  https://fn-abc123.<...>.workers.dev
 #   Scoped API key was rotated. New value (returned once): hq_live_...
 
-# Set a secret (encrypted at rest by Cloudflare; never echoed)
+# Set a secret (encrypted at rest; never echoed)
 myapi fn env fn_abc123 STRIPE_KEY sk_live_...
 
 # Inspect recent invocations
@@ -74,17 +74,17 @@ myapi fn create --name mailer --scope email,storage
 myapi fn list
 myapi fn get fn_abc123
 
-# Delete (revokes the scoped key — future calls with it return 401)
+# Delete (revokes the scoped API key — future calls with it return 401)
 myapi fn delete fn_abc123
 ```
 
-### Using the scoped key
+### Using the scoped API key
 
 ```bash
-# Save the key returned at create/deploy time
+# Save the API key returned at create/deploy time
 SCOPED_KEY="hq_live_..."
 
-# Call slots the key was granted — works (within its org + grants)
+# Call slots the API key was granted — works (within its org + grants)
 curl -H "Authorization: Bearer $SCOPED_KEY" \
   https://api.myapihq.com/database/orgs/$ORG_ID/namespaces
 
@@ -99,6 +99,6 @@ curl -H "Authorization: Bearer $SCOPED_KEY" \
 
 - The bundle is a **single JavaScript file** (≤4MB). Bundle your dependencies before deploy (esbuild/rollup/etc.).
 - `--cron` is set at create time; the trigger type is fixed for the function's lifetime.
-- Deploy rotates the scoped key on every call — re-capture the printed value if other systems use it.
+- Deploy rotates the scoped API key on every call — re-capture the printed value if other systems use it.
 
 Run `myapi fn --help` or `myapi fn <subcommand> --help` for full flag reference.

package/dist/skills/my-git-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Hosted git repositories over HTTP. Create repos, read history (log/show/tree/blob/diff), and write atomically (commit/branch/tag/merge) — no clone needed. Real `git clone`/`push` also work over HTTPS with your API key as the password.
 triggers: [git, repo, repository, clone, push, commit, branch, tag, merge, diff, version control, source control, vcs]
-checksum: sha256-a059c8f2b59205a1d66ecf70556b60fa3a3606044aaa54e242344ea652efb5e9
+checksum: sha256-921cedea836edac33fefabfb46102e241d2618529db2e307cc73f4d910e7fee3
 ---
 
 # MyGitAPI
@@ -90,7 +90,7 @@ myapi git delete-branch my-app feature
 ### Clone & push with real git
 Hosted repos speak the real git smart-HTTP protocol. Clone, fetch, and push
 over HTTPS with **HTTP Basic auth — your MyAPI API key is the password**, any
-username works (git accepts the key in either field).
+username works (git accepts the API key in either field).
 
 ```bash
 # URL: https://git.mygitapi.com/<org-slug>/<repo>.git
@@ -100,7 +100,7 @@ username works (git accepts the key in either field).
 # Clone (key as password; "x" is a throwaway username)
 git clone https://x:$MYAPI_KEY@git.mygitapi.com/my-org-slug/my-app.git
 
-# Or set the remote and let git prompt for the password (paste the key)
+# Or set the remote and let git prompt for the password (paste the API key)
 git remote add origin https://git.mygitapi.com/my-org-slug/my-app.git
 git push origin main
 ```
@@ -117,6 +117,6 @@ surface never leaks which repos exist).
 - **`commit --base`** is the concurrency guard: pass the expected tip SHA to reject a stale write, or `--base ""` to require the branch be newly created. Omit it to create-or-update.
 - **Metering.** A `git push` (and `myapi git commit`) is metered like a commit. Clone/fetch (`upload-pack`) is free.
 - **Limits.** A push body is capped at 100 MiB; per-repo size limits apply (a push past the cap is reported as a receive-pack failure).
-- **Auth field.** git may put the key in the username or password slot — both work. Embedding it in the URL (`https://x:$KEY@…`) avoids the interactive prompt but writes the key into `.git/config`; use a credential helper for anything persistent.
+- **Auth field.** git may put the API key in the username or password slot — both work. Embedding it in the URL (`https://x:$KEY@…`) avoids the interactive prompt but writes the API key into `.git/config`; use a credential helper for anything persistent.
 
 Run `myapi git --help` for the full flag reference.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.6.2",
+  "version": "2.7.1",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -35,12 +35,13 @@
     "lint:help-order": "node scripts/lint-help-order.js",
     "lint:exposes": "node scripts/lint-exposes.js",
     "lint:request-fields": "node scripts/lint-request-fields.js",
+    "audit:doctor": "npm run build && node scripts/audit-doctor.js",
     "lint:docs": "node scripts/lint-docs.js",
     "lint:skills": "node scripts/copy-skills.js && node scripts/lint-skills.js",
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.6.2"
+    "@myapihq/sdk": "^2.7.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",