@myapihq/cli 2.7.0 → 2.7.2

package/dist/skills/my-storage-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Edge-hosted asset storage. Upload a local file of any content type directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
 triggers: [storage, upload, ingest, asset, cdn, image hosting, file upload, get-url, download, public url]
-checksum: sha256-b55e3f0aa592330cadfdc2b87e730333300bfffb08866b3bc59cb0ce15d2f953
+checksum: sha256-9172b0d8590a3102ce35b94ef48015ec36c624ab9bcc37fe0f7efa15bc54cf62
 ---
 
 # MyStorageAPI
@@ -89,8 +89,37 @@ Both produce identical asset records — `list` doesn't distinguish.
 
 ## Notes
 
-- Assets are public by default — don't store sensitive files.
+- **Assets are public, permanently, with no auth.** Anyone with the URL can
+  fetch it; there is no private mode, no signed URL, and no revocation. The id
+  being long and random is **not** access control — treat the URL as public the
+  moment it exists.
+- **For personal or regulated data, encrypt before upload.** Storage only ever
+  sees ciphertext. A team shipping Swiss lease documents (names, dates of
+  birth, permit type, IBAN) used AES-256-GCM envelope encryption with a
+  per-document data key wrapped under a master key held in function secrets.
+  That is the pattern to copy until private assets exist.
 - Delete is immediate and unrecoverable — run `myapi storage list` first to confirm the asset, pass `--org` explicitly, and pass `--yes` in non-interactive runs.
 - The URL is permanent until you `myapi storage delete <id>` — embed it freely.
 
+
+## Calling this from deployed code (HTTP)
+
+The CLI is not what runs in production — a deployed function or container calls
+the HTTP API directly. That surface was previously only discoverable by
+grepping the CLI bundle, which cost one team an hour per slot.
+
+```
+base    https://api.mystorageapi.com   ← not the gateway
+path    /storage/orgs/{org_id}/assets/upload   (multipart, field: file)
+auth    Authorization: Bearer <api key>
+        (inside a function: env.__MYAPI_KEY · inside a container: env.MYAPI_KEY)
+body    multipart/form-data
+reply   { "success": true, "data": …, "error": null, "meta": {…} }
+        Unwrap `data`. On failure `success` is false and `error` is
+        { code, message }.
+```
+
+**The org id goes in the PATH, not a header.** There is no `X-Org-Id`.
+**Base URLs differ per slot** — do not assume one host for everything.
+
 Run `myapi storage --help` for full flag reference.

package/dist/skills/my-task-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Agent-task queue — file units of work, rank them, claim under a lease, then resolve, fail, or cancel. The agent-loop hot path.
 triggers: [task, task queue, agent loop, work queue, claim task, resolve task, lease, backlog, to-do, assignee]
-checksum: sha256-ead9513eafbdd4d384a3cb297facf934f786f7067028c75cc08ef2ba1ac61cf7
+checksum: sha256-ceb6cdfffe465d8b0cd232eaa16868c1b8c8b10288f1cf9b4174fdd48a8d2c18
 ---
 
 # MyTaskAPI
@@ -71,4 +71,12 @@ myapi task create "Ship once payment clears" \
 - `resolve` unblocks dependents; `fail` cascades to dependents that can never proceed.
 - `resolve_on` matches platform events. Today few event kinds are emitted in production — verify the kind exists before relying on it.
 
+## Idempotency and provenance
+
+- `--dedup-key <k>` — creating a task with a key that already exists returns
+  the existing task instead of a duplicate. Use it whenever a task is created
+  from a retryable event, which for an agent is nearly always.
+- `--origin <s>` — records what created the task, and filters `task list`.
+  (Formerly `--source`, which still works and is undocumented.)
+
 Run `myapi task --help` for the full flag reference.

package/dist/skills/my-webhook-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Inbound webhook endpoints for non-funnel sources — Stripe, GitHub, custom services. Funnel forms use the my-funnel-api proxy.
 triggers: [webhook, inbound, receiver, stripe events, github webhook, slack notification, delivery, payload, event ingest]
-checksum: sha256-82666c883230a775b07c8e1ec6243e812e58f246dd9a7cf1659aee77b877ee73
+checksum: sha256-17b358d780333cabe76cb01df3be3c3f11db10a2b068449bcf9e10e2ed89393d
 ---
 
 # MyWebhookAPI
@@ -97,4 +97,15 @@ The form sends `{name, email, message}` → webhook stores it → workflow runs
 - Failed workflow runs don't affect the delivery record — the inbound POST is always saved.
 - Inbound responses: `200` on success, `4xx` if the endpoint is missing or body isn't valid JSON.
 
+## Auto-ingest and forwarding
+
+- `--crm-email-path <dot-path>` — where to find the email in an incoming
+  payload, so submissions become CRM contacts automatically. Default `email`
+  (top level). Stripe: `data.object.customer_email`. GitHub: `sender.email`.
+  An empty string disables ingest for that endpoint.
+- `--forward-url <url>` — POST a copy of every delivery onward. The forward
+  status is recorded on the delivery, so a failing forward is visible in
+  `webhook deliveries` rather than silent.
+- `--description <text>` — free text, shown in `webhook list`.
+
 Run `myapi webhook --help` for full flag reference.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.7.0",
+  "version": "2.7.2",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -37,11 +37,12 @@
     "lint:request-fields": "node scripts/lint-request-fields.js",
     "audit:doctor": "npm run build && node scripts/audit-doctor.js",
     "lint:docs": "node scripts/lint-docs.js",
+    "lint:skill-coverage": "node scripts/lint-skill-coverage.js",
     "lint:skills": "node scripts/copy-skills.js && node scripts/lint-skills.js",
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.7.0"
+    "@myapihq/sdk": "^2.7.2"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",