@myapihq/cli 2.7.0 → 2.7.2

package/dist/commands/account.js

@@ -25,6 +25,21 @@ export const SCHEMA = {
     'no-skills': 'boolean',
     anonymous: 'boolean',
     anon: 'boolean',
+    // Flags belonging to SUBCOMMANDS of `account`. They have to be declared here
+    // because the foreign-flag check runs against the top-level command's schema
+    // and cannot see subcommand parsers. Omitting them made the CLI print
+    // "--registrant-json is not a flag of `myapi account` — the value was
+    // ignored" and then use the value anyway: a warning that was itself false,
+    // which is worse than the missing check it was added to provide.
+    'registrant-json': 'string',
+    'registrant-name': 'string',
+    'registrant-email': 'string',
+    'registrant-phone': 'string',
+    'registrant-street': 'string',
+    'registrant-city': 'string',
+    'registrant-state': 'string',
+    'registrant-postal-code': 'string',
+    'registrant-country-code': 'string',
 };
 export const HELP = `Usage: myapi account <subcommand>
 

package/dist/commands/audience.js

@@ -15,6 +15,8 @@ export const SCHEMA = {
     org: 'string',
     name: 'string',
     description: 'string',
+    from: 'string',
+    // Deprecated alias for --from; undocumented, removable next minor.
     source: 'string',
     filter: 'string',
     limit: 'number',
@@ -47,11 +49,11 @@ function summarizeAudience(a) {
 }
 async function create(nameArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi audience create <name> --source <people|company> --filter <json>');
+    const orgId = requireOrg(flags, config, 'myapi audience create <name> --from <people|company> --filter <json>');
     const name = nameArg || flags.name;
     if (!name)
-        error('Missing required argument <name>.\nUsage: myapi audience create <name> --source <people|company> --filter <json>');
-    const source = flags.source;
+        error('Missing required argument <name>.\nUsage: myapi audience create <name> --from <people|company> --filter <json>');
+    const source = (flags.from ?? flags.source);
     if (source !== 'people' && source !== 'company') {
         error(`--source must be "people" or "company" (got: ${source ?? '<missing>'}).`);
     }
@@ -76,7 +78,7 @@ async function list(flags) {
     }
     printTable(res.map(summarizeAudience), {
         flags,
-        empty: 'No audiences yet. Create one with: myapi audience create <name> --source <people|company> --filter <json>',
+        empty: 'No audiences yet. Create one with: myapi audience create <name> --from <people|company> --filter <json>',
     });
 }
 async function get(id, flags) {
@@ -168,7 +170,7 @@ async function refresh(id, flags) {
     success(`Refreshed. ${res.previous} → ${res.total} (${sign}${res.delta})`);
 }
 const SUBCOMMAND_USAGE = {
-    'create': `myapi audience create <name> --source <people|company> --filter <json> [--description <text>] [--org <id>]
+    'create': `myapi audience create <name> --from <people|company> --filter <json> [--description <text>] [--org <id>]
 
 The Goldfox filter shape is shared across people/company/audience:
   {

package/dist/commands/container.js

@@ -133,7 +133,7 @@ export async function create(nameArg, flags) {
     info(`Name:            ${result.container.name}`);
     info(`Type:            ${result.container.type}${result.container.cron_schedule ? ` (${result.container.cron_schedule})` : ''}`);
     info(`Resources:       ${result.container.cpu} CPU, ${result.container.memory}, instances ${result.container.min_instances}-${result.container.max_instances}`);
-    // The scoped key is returned ONCE — it's delivered to the running
+    // The scoped API key is returned ONCE — it's delivered to the running
     // container as the MYAPI_KEY env var. Deploy rotates it.
     info('');
     info(`Scoped API key (returned once — save it if you need it):`);
@@ -221,6 +221,36 @@ export async function deploy(id, image, flags) {
     const orgId = requireOrg(flags, config, 'myapi container deploy <id> <image-ref> | --source <dir|tar> [--org <id>]');
     if (!id)
         error('Missing id.\nUsage: myapi container deploy <id> <image-ref>   (or --source <dir|tar>)');
+    // --no-promote and --smoke are REFUSED, not honoured, as of 2026-07-28.
+    //
+    // They shipped in 2.7.0 and do not work on either deploy path. A customer
+    // found it by testing rather than trusting the flags, which is the outcome
+    // this CLI spends most of its error messages trying to prevent:
+    //
+    //   --source: the multipart body accepts only `source`. The flags were
+    //     silently dropped — accepted by our flag parser, never sent. That was
+    //     our bug, and it is the exact failure these flags exist to stop.
+    //
+    //   image ref: the API accepts promote/smoke, then the deploy fails with a
+    //     runtime error setting traffic to the revision it just created. The
+    //     previous revision keeps serving, so it is safe, but it does not work.
+    //
+    // Refusing is strictly better than accepting. A missing guard makes people
+    // write their own; a guard that silently passes makes them stop. Restore
+    // these the moment the upstream fix lands — see
+    // docs/cross-repo-prompts/backend-consolidated-2026-07-28.md.
+    if (flags['no-promote'] === true || typeof flags.smoke === 'string') {
+        const which = flags['no-promote'] === true ? '--no-promote' : '--smoke';
+        error(`${which} is not honoured yet, so this CLI refuses it rather than letting you believe a deploy was guarded.\n\n` +
+            'It shipped in 2.7.0 and does not work end to end on either deploy path:\n' +
+            '  --source     the API accepts only the tarball on that path; the flag never reaches it\n' +
+            '  <image-ref>  the API accepts the flag, then fails while moving traffic\n\n' +
+            'Until it lands, the safe sequence is:\n' +
+            `  1. deploy to a non-production container first\n` +
+            `  2. check it yourself (curl for a string only a real build emits)\n` +
+            `  3. deploy the same image to production\n\n` +
+            'Reported upstream; this message goes away when the flag works.');
+    }
     const source = typeof flags.source === 'string' ? flags.source : undefined;
     // --image is an alias for the positional image ref.
     if (!image && typeof flags.image === 'string')
@@ -290,15 +320,10 @@ export async function deploy(id, image, flags) {
     // ── Pre-built image path (sync) ─────────────────────────────────────────
     if (!image)
         error('Missing image ref.\nUsage: myapi container deploy <id> <image-ref>\n   or: myapi container deploy <id> --source <dir|tar>\n\n→ <image-ref> is a pre-built container image (e.g. a registry path).');
-    const opts = {};
-    if (flags['no-promote'] === true)
-        opts.promote = false;
-    if (typeof flags.smoke === 'string')
-        opts.smoke = _parseSmoke(flags.smoke);
-    if (opts.promote === false && opts.smoke) {
-        error('--smoke already withholds traffic until the check passes, then promotes.\nUse one or the other: --smoke to verify-and-promote, --no-promote to hold the revision back.');
-    }
-    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image, opts);
+    // No DeployOptions built here: --no-promote and --smoke are refused above
+    // until the upstream fix lands. The SDK still carries them so the wiring is
+    // one commit away, and sdk-container.test.ts keeps them covered.
+    const result = await sdkContainer.deployContainer(config.api_key, orgId, id, image);
     if (flags.json) {
         printJson(result);
         return;
@@ -306,6 +331,9 @@ export async function deploy(id, image, flags) {
     // An unpromoted revision must NOT read like a completed deploy. A response
     // that looked the same either way is how an agent concludes it has shipped
     // when it has not — the original outage in miniature.
+    // Unreachable while the flags are refused above. Kept because it is the
+    // render we want the moment they are restored, and deleting it would mean
+    // rewriting it from memory later.
     if (result.promoted === false) {
         success(`Revision ${result.revision_id} built — NOT serving traffic`);
         info(`Test it:         ${result.revision_url ?? '(no revision URL returned)'}`);
@@ -392,8 +420,10 @@ export async function revisions(id, flags) {
     if (revs.length > 0 && revs.every(r => !r.serving && !r.traffic_percent) && container?.status === 'active') {
         info('');
         info('Note: every revision reports 0% traffic while this container is active and serving.');
-        info('That is a known reporting bug for containers deployed before 2026-07-28, not an outage.');
-        info('Rollback depends on this data, so it is unreliable here until the container is redeployed.');
+        info('The traffic column is wrong, not the container. Verified on a container created');
+        info('today, so this is not limited to older ones — an earlier version of this message');
+        info('said redeploying fixes it, which was wrong.');
+        info('promote depends on this data and currently fails. Reported upstream.');
     }
 }
 // promote moves all traffic to one revision. Omitting the revision rolls back
@@ -535,23 +565,19 @@ Two ways to deploy:
            built server-side (typically ~4 minutes), then deployed.
            Asynchronous — the CLI polls until it's live.
 
-Options:
-  --no-promote          Build the revision without giving it traffic. Test it at
-                        the returned URL, then: myapi container promote <id> <rev>
-  --smoke '<assertion>' Deploy, assert against the new revision, and promote it
-                        ONLY if the assertion holds. A failure leaves the
-                        previous revision serving.
+TEMPORARILY REFUSED: --no-promote and --smoke
+
+  Both shipped in 2.7.0 and do not work end to end. Rather than accept a flag
+  and deploy anyway, the CLI now refuses them and explains what to do instead.
+  A guard that silently passes is worse than no guard.
 
-                        Grammar: [GET|HEAD] [/path] [status N] [contains TEXT]
-                        Assert on content, not just status — "returns 200" is
-                        true of a placeholder page too.
+  Until they land: deploy to a non-production container, verify it yourself,
+  then deploy the same image to production.
 
 Examples:
   myapi container deploy <id> registry.example.com/my-app:v2
   myapi container deploy <id> --source ./my-app
-  myapi container deploy <id> --source ./context.tar.gz
-  myapi container deploy <id> <image> --no-promote
-  myapi container deploy <id> <image> --smoke 'GET / contains assets/'`,
+  myapi container deploy <id> --source ./context.tar.gz`,
     'revisions': `myapi container revisions <id> [--org <id>] [--json]
 
 Every revision the runtime currently holds, newest first, with the traffic
@@ -595,10 +621,8 @@ dependencies and long execution.
 Subcommands:
   build-logs <id>      Why the last --source build failed (--tail N; default 100)
   create               Register a container and get its scoped API key (returned once)
-                       (--health-check /livez to probe with HTTP, not a bare TCP connect)
   delete <id>          Soft-delete and revoke its scoped API key
   deploy <id> <image>  Ship a pre-built image (or --source <dir|tar> to build) and go live
-                       (--no-promote to hold it back; --smoke to verify before promoting)
   domain <id> <domain> Bind a custom domain (--remove to unbind)
   get <id>             Inspect a container
   list                 List containers in your org

package/dist/commands/crm/companies.js

@@ -3,7 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
-import { pageLine } from './pagination.js';
+import { pageLine, originFlag } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/companies',
     'POST /crm/orgs/{org_id}/companies/promote',
@@ -32,7 +32,7 @@ function parseCustom(v) {
 function buildSearchFilter(flags) {
     return {
         lifecycle_stage: csv(flags.stage),
-        source: csv(flags.source),
+        source: csv(originFlag(flags)),
         domain: typeof flags.domain === 'string' ? flags.domain : undefined,
         include_deleted: flags['include-deleted'] === true || undefined,
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
@@ -144,11 +144,11 @@ async function promote(domain, flags) {
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     list: 'myapi crm companies list [--limit N] [--offset N] [--org <id>] [--json]',
-    search: `myapi crm companies search [--stage <csv>] [--source <csv>] [--domain <d>]
+    search: `myapi crm companies search [--stage <csv>] [--origin <csv>] [--domain <d>]
        [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
 
   --stage   cold, warm, qualified, customer, churned
-  --source  goldfox, email, pixel, webhook, manual`,
+  --origin  goldfox, email, pixel, webhook, manual`,
     create: 'myapi crm companies create <domain> [--name <n>] [--stage <s>] [--custom-json <json>] [--org <id>]',
     get: 'myapi crm companies get <id> [--org <id>]',
     update: 'myapi crm companies update <id> [--stage <s>] [--name <n>] [--custom-json <json>] [--org <id>]',

package/dist/commands/crm/contacts.js

@@ -3,7 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
-import { pageLine } from './pagination.js';
+import { pageLine, originFlag } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/contacts',
     'POST /crm/orgs/{org_id}/contacts/promote',
@@ -35,7 +35,7 @@ function parseCustom(v) {
 function buildSearchFilter(flags) {
     return {
         lifecycle_stage: csv(flags.stage),
-        source: csv(flags.source),
+        source: csv(originFlag(flags)),
         email: typeof flags.email === 'string' ? flags.email : undefined,
         company_id: typeof flags['company-id'] === 'string' ? flags['company-id'] : undefined,
         min_last_engagement_days: typeof flags['min-last-engagement-days'] === 'number' ? flags['min-last-engagement-days'] : undefined,
@@ -179,12 +179,12 @@ async function events(id, flags) {
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     list: 'myapi crm contacts list [--limit N] [--offset N] [--org <id>] [--json]',
-    search: `myapi crm contacts search [--stage <csv>] [--source <csv>] [--email <e>]
+    search: `myapi crm contacts search [--stage <csv>] [--origin <csv>] [--email <e>]
        [--company-id <id>] [--min-last-engagement-days N] [--max-last-engagement-days N]
        [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
 
   --stage     cold, warm, qualified, customer, churned
-  --source    goldfox, email, pixel, webhook, manual
+  --origin    goldfox, email, pixel, webhook, manual
 
   Engagement filters:
     --min-last-engagement-days N   contacts engaged within N days

package/dist/commands/crm/index.js

@@ -16,6 +16,9 @@ export const SCHEMA = {
     'last-name': 'string',
     name: 'string',
     stage: 'string',
+    origin: 'string',
+    // Deprecated alias for --origin. Kept so existing scripts keep working;
+    // undocumented, and removable no earlier than the next minor.
     source: 'string',
     'company-id': 'string',
     'custom-json': 'string',

package/dist/commands/crm/origin-flag.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/crm/origin-flag.test.js

@@ -0,0 +1,38 @@
+// `--source` meant five different things across the CLI: a container build
+// context, a git merge branch, an audience dataset, a task origin, and a CRM
+// provenance enum. An agent that learned it in one place carried a wrong prior
+// into the others, and no linter could catch it — `--source` really is valid
+// for every one of those commands, so nothing was ever "unknown".
+//
+// It is `--origin` for provenance now (crm, task) and `--from` for the
+// audience dataset. `--source` keeps its container meaning, and stays on
+// `git merge` where `--target` anchors it and the pair is idiomatic.
+//
+// The old spellings still work, undocumented, so nobody's scripts break.
+import { describe, it, expect } from 'vitest';
+import { originFlag } from './pagination.js';
+describe('originFlag', () => {
+    it('reads the new flag', () => {
+        expect(originFlag({ origin: 'webhook' })).toBe('webhook');
+    });
+    it('still accepts the old one', () => {
+        expect(originFlag({ source: 'webhook' })).toBe('webhook');
+    });
+    // Someone mid-migration may have both in a script. The new name is the
+    // one they meant.
+    it('prefers --origin when both are given', () => {
+        expect(originFlag({ origin: 'manual', source: 'webhook' })).toBe('manual');
+    });
+    it('is undefined when neither is given', () => {
+        expect(originFlag({})).toBeUndefined();
+    });
+    // csv() downstream splits this; the helper must not mangle it.
+    it('passes a comma-separated list through untouched', () => {
+        expect(originFlag({ origin: 'goldfox,webhook' })).toBe('goldfox,webhook');
+    });
+    // An explicitly empty --origin is a real (if useless) input, and must not
+    // silently fall through to a stale --source in the same command.
+    it('does not fall back when --origin is present but empty', () => {
+        expect(originFlag({ origin: '', source: 'webhook' })).toBe('');
+    });
+});

package/dist/commands/crm/pagination.d.ts

@@ -1,3 +1,5 @@
+import { type Flags } from '../../helpers.js';
 import type { Exposes } from '../../exposes.js';
 export declare const EXPOSES: Exposes;
+export declare function originFlag(flags: Flags): string | boolean | number | undefined;
 export declare function pageLine(returned: number, total: number | undefined, hasMore: boolean | undefined, singular: string, plural: string): string;

package/dist/commands/crm/pagination.js

@@ -18,6 +18,15 @@
 // exempted, so the coverage gate's "every module states its surface" rule
 // stays absolute.
 export const EXPOSES = [];
+// --source meant five different things across the CLI: a build context, a
+// merge branch, a dataset, a task origin, and this — where a contact came
+// from. An agent that learned it once carried a wrong prior everywhere else,
+// and no linter could catch it because --source really is valid for each.
+//
+// It is --origin here now. The old name still works and is undocumented.
+export function originFlag(flags) {
+    return flags.origin !== undefined ? flags.origin : flags.source;
+}
 // "3 contacts" · "3 of 128 contacts" · "3 of 128 contacts (more available)".
 //
 // `total` is only rendered when the API supplied it, and the more-available

package/dist/commands/database.js

@@ -106,8 +106,8 @@ async function nsDelete(name, flags) {
 // ── Keys ─────────────────────────────────────────────────────────────────
 async function keysList(flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi database keys --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>]');
-    const ns = requireNs(flags, 'myapi database keys --ns <ns> [--prefix <p>] [--limit N] [--values]');
+    const orgId = requireOrg(flags, config, 'myapi database entries --ns <ns> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>]');
+    const ns = requireNs(flags, 'myapi database entries --ns <ns> [--prefix <p>] [--limit N] [--values]');
     const opts = {};
     if (typeof flags.prefix === 'string')
         opts.prefix = flags.prefix;
@@ -197,12 +197,16 @@ const SUBCOMMAND_USAGE = {
     'create': 'myapi database create <name> [--org <id>]',
     'delete-namespace': `myapi database delete-namespace <name> [--org <id>]
 
-Deletes the namespace AND all keys in it. Irreversible.`,
-    'keys': `myapi database keys --ns <namespace> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>] [--json]
+Deletes the namespace AND all entries in it. Irreversible.`,
+    'entries': `myapi database entries --ns <namespace> [--prefix <p>] [--limit N] [--values] [--cursor <c>] [--org <id>] [--json]
 
-Default render is one key per line. --values inlines each value alongside
-its key + etag. --cursor takes the next_cursor printed at the end of a
-previous page.`,
+Default render is one entry key per line. --values inlines each value
+alongside its key + etag. --cursor takes the next_cursor printed at the end
+of a previous page.
+
+(\`myapi database keys\` still works. It was renamed because "key" also means
+an API credential everywhere else on the platform, and an agent reading
+"list keys" could not tell which was meant.)`,
     'get': `myapi database get <key> --ns <namespace> [--org <id>] [--json]
 
 Prints the value as compact JSON on stdout; etag + updated_at go to
@@ -226,17 +230,17 @@ export async function run(subcommand, args, flags) {
 
 Namespaces:
   create <name>                 Create a namespace
-  delete-namespace <name>       Delete a namespace AND all its keys (irreversible)
+  delete-namespace <name>       Delete a namespace AND all its entries (irreversible)
   namespaces                    List namespaces in the org
 
-Keys (require --ns <namespace>):
-  keys                          List keys in a namespace
-  get <key>                     Get a key's value + etag
-  set <key> <value-json>        Set a key. Value is JSON; CAS via --if-match
-  del <key>                     Delete a key (CAS via --if-match)
+Entries (require --ns <namespace>):
+  entries                       List entries in a namespace
+  get <key>                     Get an entry's value + etag
+  set <key> <value-json>        Set an entry. Value is JSON; CAS via --if-match
+  del <key>                     Delete an entry (CAS via --if-match)
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).
-Values are JSON; per-key size cap is 256 KB. Use myapi storage for binary.`);
+Values are JSON; per-entry size cap is 256 KB. Use myapi storage for binary.`);
         return;
     }
     if (flags.help) {
@@ -251,6 +255,9 @@ Values are JSON; per-key size cap is 256 KB. Use myapi storage for binary.`);
         case 'namespaces': return nsList(flags);
         case 'create': return nsCreate(args[0], flags);
         case 'delete-namespace': return nsDelete(args[0], flags);
+        // `keys` kept as an undocumented alias: renaming a verb people have in
+        // scripts should not break them. Dropped no earlier than the next minor.
+        case 'entries':
         case 'keys': return keysList(flags);
         case 'get': return keyGet(args[0], flags);
         case 'set': return keySet(args[0], args[1], flags);

package/dist/commands/domain.js

@@ -89,6 +89,17 @@ export async function check(domainArg, flags) {
     else {
         const msg = typeof res.message === 'string' ? res.message : res.message ? JSON.stringify(res.message) : 'Not available';
         info(`${domain} — ${msg} ✗`);
+        // "This TLD is not currently supported" reads as a dead end, and a team
+        // building for Switzerland took it as one and settled for a .com. It is
+        // not: registering elsewhere and importing the nameservers gives the same
+        // DNS, SSL and mail behaviour, with no registrar credentials needed. The
+        // answer belongs in the same message as the refusal.
+        if (/TLD is not (currently )?supported|not supported/i.test(msg)) {
+            info('');
+            info(`→ You can still use ${domain} on MyAPI. Register it with any registrar,`);
+            info(`  point its nameservers at MyAPI, then:  myapi domain import ${domain}`);
+            info('  DNS, SSL and mail records work the same way afterwards.');
+        }
     }
 }
 export async function register(domainArg, flags) {

package/dist/commands/fn.js

@@ -22,7 +22,7 @@ export const SCHEMA = {
     scope: 'list',
     set: 'string',
 };
-// Backend: Story 1 (function CRUD + scoped key) and Story 2/4/5 (deploy a
+// Backend: Story 1 (function CRUD + scoped API key) and Story 2/4/5 (deploy a
 // JS bundle to the edge runtime, list runs, set env secrets).
 // Mirrors validateName in myapi-hq/internal/routes/function/crud.go. We
 // pre-validate client-side so typos fail before the network call; backend
@@ -54,7 +54,10 @@ function summarizeFn(f) {
         id: f.id,
         name: f.name,
         trigger: f.trigger_type === 'cron' ? `cron ${f.cron_schedule ?? '?'}` : 'http',
-        url: f.invocation_url || '(not deployed)',
+        // A cron function is never reachable over HTTP — its URL 404s. Printing
+        // one contradicted the docs more loudly than the docs denied it, and a
+        // user wrote a `fetch` handler for manual runs that could never fire.
+        url: f.trigger_type === 'cron' ? '— (cron: not HTTP-invocable)' : (f.invocation_url || '(not deployed)'),
         updated_at: f.updated_at,
     };
 }
@@ -89,7 +92,7 @@ export async function create(nameArg, flags) {
     success(`Function created: ${result.function.id}`);
     info(`Name:            ${result.function.name}`);
     info(`Trigger:         ${result.function.trigger_type}${result.function.cron_schedule ? ` (${result.function.cron_schedule})` : ''}`);
-    // The scoped key is returned ONCE — surface it prominently. It's used by
+    // The scoped API key is returned ONCE — surface it prominently. It's used by
     // the function runtime shim to call other slot endpoints without a
     // baked-in auth token. Deploy rotates this key.
     info('');
@@ -128,7 +131,9 @@ export async function get(id, flags) {
     info(`ID:              ${fn.id}`);
     info(`Name:            ${fn.name}`);
     info(`Trigger:         ${fn.trigger_type}${fn.cron_schedule ? ` (${fn.cron_schedule})` : ''}`);
-    info(`Invocation URL:  ${fn.invocation_url || '(not deployed)'}`);
+    info(fn.trigger_type === 'cron'
+        ? 'Invocation URL:  — (cron functions are not reachable over HTTP)'
+        : `Invocation URL:  ${fn.invocation_url || '(not deployed)'}`);
     info(`Created:         ${fn.created_at}`);
     info(`Updated:         ${fn.updated_at}`);
 }
@@ -205,7 +210,7 @@ async function waitForLive(url, budgetMs = 75_000) {
     clearLine();
     info(`Status:          not serving yet after ${Math.round(budgetMs / 1000)}s.`);
     info(`                 The deploy itself succeeded — give it another minute.`);
-    info(`                 Do NOT redeploy to "fix" it: that rotates the scoped key again.`);
+    info(`                 Do NOT redeploy to "fix" it: that rotates the scoped API key again.`);
 }
 // _parseSetPairs parses `--set K=V` entries into a map. Accepts a single
 // string (comma-joined: K=V,K2=V2) or an array of strings (when the flag is

package/dist/commands/task.js

@@ -15,6 +15,12 @@ export const EXPOSES = [
     'POST /task/orgs/{org_id}/tasks/{id}/fail',
     'POST /task/orgs/{org_id}/tasks/{id}/resolve',
 ];
+// --source meant five different things across the CLI. Here it is --origin;
+// the old name still works and is undocumented. See crm/pagination.ts.
+function taskOrigin(flags) {
+    const v = flags.origin !== undefined ? flags.origin : flags.source;
+    return typeof v === 'string' ? v : undefined;
+}
 export const SCHEMA = {
     body: 'string',
     importance: 'string',
@@ -24,6 +30,8 @@ export const SCHEMA = {
     'depends-on': 'string',
     'dedup-key': 'string',
     'resolve-on': 'string',
+    origin: 'string',
+    // Deprecated alias for --origin; undocumented, removable next minor.
     source: 'string',
     status: 'string',
     limit: 'number',
@@ -106,7 +114,7 @@ export async function create(description, flags) {
         dependsOn: _splitList(flags['depends-on']),
         dedupKey: typeof flags['dedup-key'] === 'string' ? flags['dedup-key'] : undefined,
         resolveOn,
-        source: typeof flags.source === 'string' ? flags.source : undefined,
+        source: taskOrigin(flags),
     });
     if (flags.json) {
         printJson(t);
@@ -125,7 +133,7 @@ export async function list(flags) {
         tag: typeof flags.tag === 'string' ? flags.tag : undefined,
         importance: typeof flags.importance === 'string' ? flags.importance : undefined,
         assignee: typeof flags.assignee === 'string' ? flags.assignee : undefined,
-        source: typeof flags.source === 'string' ? flags.source : undefined,
+        source: taskOrigin(flags),
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
     });
     if (flags.json) {
@@ -235,8 +243,8 @@ export async function cancel(id, flags) {
 }
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    'create': 'myapi task create "<description>" [--body <md|@file>] [--importance <i>] [--due <rfc3339>] [--assignee <email>] [--tag <t,t>] [--depends-on <id,id>] [--dedup-key <k>] [--resolve-on <event[:field=value]>] [--source <s>] [--org <id>]',
-    'list': 'myapi task list [--status <s>] [--tag <t>] [--importance <i>] [--assignee <email>] [--source <s>] [--limit <n>] [--org <id>] [--json]',
+    'create': 'myapi task create "<description>" [--body <md|@file>] [--importance <i>] [--due <rfc3339>] [--assignee <email>] [--tag <t,t>] [--depends-on <id,id>] [--dedup-key <k>] [--resolve-on <event[:field=value]>] [--origin <s>] [--org <id>]',
+    'list': 'myapi task list [--status <s>] [--tag <t>] [--importance <i>] [--assignee <email>] [--origin <s>] [--limit <n>] [--org <id>] [--json]',
     'get': 'myapi task get <id> [--body] [--org <id>] [--json]\n\n--body additionally fetches the Markdown body tier (a separate read).',
     'claim': 'myapi task claim <id> [--lease <seconds>] [--worker <name>] [--org <id>]',
     'extend': 'myapi task extend <id> [--lease <seconds>] [--org <id>]',

package/dist/skills/my-api-hq/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Auth, organizations, and billing hub. Start here to get an api_key and org_id — every other service depends on both.
 triggers: [api key, account, organization, org, billing, balance, topup, credits, setup, defaults, brand, sync brand, doctor, health check, is my org healthy]
-checksum: sha256-80bee1daf601eb33abc5d66b7f8053b20abec1c9c0ec07f26e86e26a2d3bdb78
+checksum: sha256-fab324491446026e1600ac531bfbb164c10d46a617e528e6886be74b7dbdb4b1
 ---
 
 # MyApiHQ
@@ -98,4 +98,28 @@ Each org gets a free preview subdomain (`*.makeautonomous.com`) usable before re
 - API keys have format `hq_live_...` and are sent as `Authorization: Bearer <key>`.
 - `org sync-brand` is async (scrapes the site, polls the job).
 
+## Minting a least-privilege API key
+
+A key's authority is inline and always a subset of the key that mints it, so
+you can hand work a key that cannot exceed its job:
+
+```bash
+myapi keys create --name ci --grant funnel:write,storage:read
+myapi keys create --name readonly --grant '*:read'          # read anything, write nothing
+myapi keys create --name billing-fn --org <id> --grant email --spend-cap 25
+```
+
+- `--grant <list>` — `slot:read` / `slot:write`; a bare slot means write, `*`
+  means all. **Omitting `--grant` mints an unrestricted key.**
+- `--org <id>` — lock it to one org. Omit for account-wide.
+- `--spend-cap <usd>` — hard ceiling; `0` means the key cannot spend at all.
+- `keys revoke-all --kind function|manual|account` narrows the kill switch.
+
+## Org profile fields
+
+`myapi org create <name>` also takes `--tagline`, `--description`,
+`--business-sector` and `--logo-url`. They populate the org's public profile
+and the funnel created alongside it, so setting them at create avoids editing
+two places later.
+
 Run `myapi --help` or `myapi <command> --help` for full flag reference.

package/dist/skills/my-audience-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Saved audiences = named Goldfox-filter snapshots over the people or company database. Build a target list once, name it, reuse it across campaigns, refresh to re-evaluate against current data. The persistence layer on top of my-people-api + my-company-api.
 triggers: [audience, segment, target list, saved filter, goldfox, lead list, abm list, refresh, members, prospect database]
-checksum: sha256-5d9a2731d587c476eff2955241001fecb8481bbc5e567f06b8e9e76a079eda92
+checksum: sha256-a2c7142e880932ac2aa53cdb29b8632ce2c4d5ef33c3f8b6df705f7e987ab6af
 ---
 
 # MyAudienceAPI
@@ -70,7 +70,7 @@ Allowed values:
 <!-- generated:start -->
 | Command | What it does |
 |---|---|
-| `myapi audience create <name> --source <people\|company> --filter '<json>' [--description <text>]` | Save a Goldfox filter as a named audience; returns id + initial member_count |
+| `myapi audience create <name> --from <people\|company> --filter '<json>' [--description <text>]` | Save a Goldfox filter as a named audience; returns id + initial member_count |
 | `myapi audience list` | List all audiences in the org |
 | `myapi audience get <id>` | Single audience (name, filter, member_count, timestamps) |
 | `myapi audience update <id> [--name <x>] [--description <y>] [--filter '<json>']` | Patch name/description/filter; member_count re-evaluates if filter changes |
@@ -84,7 +84,7 @@ Allowed values:
 ```bash
 # 1. Create the audience
 AID=$(myapi audience create "EU decision makers w/ corporate emails" \
-  --source people \
+  --from people \
   --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"]}' \
   --json | jq -r .id)
 
@@ -108,7 +108,7 @@ myapi audience delete $AID
 ```bash
 # Build with quality controls — definitive links + registered companies + careers signal
 AID=$(myapi audience create "EU growth-stage decision makers" \
-  --source people \
+  --from people \
   --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"],"min_link_confidence":0.9,"has_careers_page":true,"is_registered_entity":true}' \
   --json | jq -r .id)
 
@@ -123,7 +123,7 @@ myapi audience refresh $AID
 
 ```bash
 myapi audience create "EU growth-stage SaaS accounts" \
-  --source company \
+  --from company \
   --filter '{"country":["DE","FR","GB","NL"],"has_careers_page":true,"has_decision_maker":true,"is_registered_entity":true,"min_source_count":3}'
 ```
 <!-- llm:end -->