@myapihq/cli 2.7.1 → 2.7.2

package/dist/commands/account.js

@@ -25,6 +25,21 @@ export const SCHEMA = {
     'no-skills': 'boolean',
     anonymous: 'boolean',
     anon: 'boolean',
+    // Flags belonging to SUBCOMMANDS of `account`. They have to be declared here
+    // because the foreign-flag check runs against the top-level command's schema
+    // and cannot see subcommand parsers. Omitting them made the CLI print
+    // "--registrant-json is not a flag of `myapi account` — the value was
+    // ignored" and then use the value anyway: a warning that was itself false,
+    // which is worse than the missing check it was added to provide.
+    'registrant-json': 'string',
+    'registrant-name': 'string',
+    'registrant-email': 'string',
+    'registrant-phone': 'string',
+    'registrant-street': 'string',
+    'registrant-city': 'string',
+    'registrant-state': 'string',
+    'registrant-postal-code': 'string',
+    'registrant-country-code': 'string',
 };
 export const HELP = `Usage: myapi account <subcommand>
 

package/dist/commands/audience.js

@@ -15,6 +15,8 @@ export const SCHEMA = {
     org: 'string',
     name: 'string',
     description: 'string',
+    from: 'string',
+    // Deprecated alias for --from; undocumented, removable next minor.
     source: 'string',
     filter: 'string',
     limit: 'number',
@@ -47,11 +49,11 @@ function summarizeAudience(a) {
 }
 async function create(nameArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi audience create <name> --source <people|company> --filter <json>');
+    const orgId = requireOrg(flags, config, 'myapi audience create <name> --from <people|company> --filter <json>');
     const name = nameArg || flags.name;
     if (!name)
-        error('Missing required argument <name>.\nUsage: myapi audience create <name> --source <people|company> --filter <json>');
-    const source = flags.source;
+        error('Missing required argument <name>.\nUsage: myapi audience create <name> --from <people|company> --filter <json>');
+    const source = (flags.from ?? flags.source);
     if (source !== 'people' && source !== 'company') {
         error(`--source must be "people" or "company" (got: ${source ?? '<missing>'}).`);
     }
@@ -76,7 +78,7 @@ async function list(flags) {
     }
     printTable(res.map(summarizeAudience), {
         flags,
-        empty: 'No audiences yet. Create one with: myapi audience create <name> --source <people|company> --filter <json>',
+        empty: 'No audiences yet. Create one with: myapi audience create <name> --from <people|company> --filter <json>',
     });
 }
 async function get(id, flags) {
@@ -168,7 +170,7 @@ async function refresh(id, flags) {
     success(`Refreshed. ${res.previous} → ${res.total} (${sign}${res.delta})`);
 }
 const SUBCOMMAND_USAGE = {
-    'create': `myapi audience create <name> --source <people|company> --filter <json> [--description <text>] [--org <id>]
+    'create': `myapi audience create <name> --from <people|company> --filter <json> [--description <text>] [--org <id>]
 
 The Goldfox filter shape is shared across people/company/audience:
   {

package/dist/commands/crm/companies.js

@@ -3,7 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
-import { pageLine } from './pagination.js';
+import { pageLine, originFlag } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/companies',
     'POST /crm/orgs/{org_id}/companies/promote',
@@ -32,7 +32,7 @@ function parseCustom(v) {
 function buildSearchFilter(flags) {
     return {
         lifecycle_stage: csv(flags.stage),
-        source: csv(flags.source),
+        source: csv(originFlag(flags)),
         domain: typeof flags.domain === 'string' ? flags.domain : undefined,
         include_deleted: flags['include-deleted'] === true || undefined,
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
@@ -144,11 +144,11 @@ async function promote(domain, flags) {
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     list: 'myapi crm companies list [--limit N] [--offset N] [--org <id>] [--json]',
-    search: `myapi crm companies search [--stage <csv>] [--source <csv>] [--domain <d>]
+    search: `myapi crm companies search [--stage <csv>] [--origin <csv>] [--domain <d>]
        [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
 
   --stage   cold, warm, qualified, customer, churned
-  --source  goldfox, email, pixel, webhook, manual`,
+  --origin  goldfox, email, pixel, webhook, manual`,
     create: 'myapi crm companies create <domain> [--name <n>] [--stage <s>] [--custom-json <json>] [--org <id>]',
     get: 'myapi crm companies get <id> [--org <id>]',
     update: 'myapi crm companies update <id> [--stage <s>] [--name <n>] [--custom-json <json>] [--org <id>]',

package/dist/commands/crm/contacts.js

@@ -3,7 +3,7 @@ import { crm } from '@myapihq/sdk';
 import { requireConfig } from '../../config.js';
 import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
-import { pageLine } from './pagination.js';
+import { pageLine, originFlag } from './pagination.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/contacts',
     'POST /crm/orgs/{org_id}/contacts/promote',
@@ -35,7 +35,7 @@ function parseCustom(v) {
 function buildSearchFilter(flags) {
     return {
         lifecycle_stage: csv(flags.stage),
-        source: csv(flags.source),
+        source: csv(originFlag(flags)),
         email: typeof flags.email === 'string' ? flags.email : undefined,
         company_id: typeof flags['company-id'] === 'string' ? flags['company-id'] : undefined,
         min_last_engagement_days: typeof flags['min-last-engagement-days'] === 'number' ? flags['min-last-engagement-days'] : undefined,
@@ -179,12 +179,12 @@ async function events(id, flags) {
 // ── Dispatcher ──────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     list: 'myapi crm contacts list [--limit N] [--offset N] [--org <id>] [--json]',
-    search: `myapi crm contacts search [--stage <csv>] [--source <csv>] [--email <e>]
+    search: `myapi crm contacts search [--stage <csv>] [--origin <csv>] [--email <e>]
        [--company-id <id>] [--min-last-engagement-days N] [--max-last-engagement-days N]
        [--include-deleted] [--limit N] [--offset N] [--org <id>] [--json]
 
   --stage     cold, warm, qualified, customer, churned
-  --source    goldfox, email, pixel, webhook, manual
+  --origin    goldfox, email, pixel, webhook, manual
 
   Engagement filters:
     --min-last-engagement-days N   contacts engaged within N days

package/dist/commands/crm/index.js

@@ -16,6 +16,9 @@ export const SCHEMA = {
     'last-name': 'string',
     name: 'string',
     stage: 'string',
+    origin: 'string',
+    // Deprecated alias for --origin. Kept so existing scripts keep working;
+    // undocumented, and removable no earlier than the next minor.
     source: 'string',
     'company-id': 'string',
     'custom-json': 'string',

package/dist/commands/crm/origin-flag.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/crm/origin-flag.test.js

@@ -0,0 +1,38 @@
+// `--source` meant five different things across the CLI: a container build
+// context, a git merge branch, an audience dataset, a task origin, and a CRM
+// provenance enum. An agent that learned it in one place carried a wrong prior
+// into the others, and no linter could catch it — `--source` really is valid
+// for every one of those commands, so nothing was ever "unknown".
+//
+// It is `--origin` for provenance now (crm, task) and `--from` for the
+// audience dataset. `--source` keeps its container meaning, and stays on
+// `git merge` where `--target` anchors it and the pair is idiomatic.
+//
+// The old spellings still work, undocumented, so nobody's scripts break.
+import { describe, it, expect } from 'vitest';
+import { originFlag } from './pagination.js';
+describe('originFlag', () => {
+    it('reads the new flag', () => {
+        expect(originFlag({ origin: 'webhook' })).toBe('webhook');
+    });
+    it('still accepts the old one', () => {
+        expect(originFlag({ source: 'webhook' })).toBe('webhook');
+    });
+    // Someone mid-migration may have both in a script. The new name is the
+    // one they meant.
+    it('prefers --origin when both are given', () => {
+        expect(originFlag({ origin: 'manual', source: 'webhook' })).toBe('manual');
+    });
+    it('is undefined when neither is given', () => {
+        expect(originFlag({})).toBeUndefined();
+    });
+    // csv() downstream splits this; the helper must not mangle it.
+    it('passes a comma-separated list through untouched', () => {
+        expect(originFlag({ origin: 'goldfox,webhook' })).toBe('goldfox,webhook');
+    });
+    // An explicitly empty --origin is a real (if useless) input, and must not
+    // silently fall through to a stale --source in the same command.
+    it('does not fall back when --origin is present but empty', () => {
+        expect(originFlag({ origin: '', source: 'webhook' })).toBe('');
+    });
+});

package/dist/commands/crm/pagination.d.ts

@@ -1,3 +1,5 @@
+import { type Flags } from '../../helpers.js';
 import type { Exposes } from '../../exposes.js';
 export declare const EXPOSES: Exposes;
+export declare function originFlag(flags: Flags): string | boolean | number | undefined;
 export declare function pageLine(returned: number, total: number | undefined, hasMore: boolean | undefined, singular: string, plural: string): string;

package/dist/commands/crm/pagination.js

@@ -18,6 +18,15 @@
 // exempted, so the coverage gate's "every module states its surface" rule
 // stays absolute.
 export const EXPOSES = [];
+// --source meant five different things across the CLI: a build context, a
+// merge branch, a dataset, a task origin, and this — where a contact came
+// from. An agent that learned it once carried a wrong prior everywhere else,
+// and no linter could catch it because --source really is valid for each.
+//
+// It is --origin here now. The old name still works and is undocumented.
+export function originFlag(flags) {
+    return flags.origin !== undefined ? flags.origin : flags.source;
+}
 // "3 contacts" · "3 of 128 contacts" · "3 of 128 contacts (more available)".
 //
 // `total` is only rendered when the API supplied it, and the more-available

package/dist/commands/domain.js

@@ -89,6 +89,17 @@ export async function check(domainArg, flags) {
     else {
         const msg = typeof res.message === 'string' ? res.message : res.message ? JSON.stringify(res.message) : 'Not available';
         info(`${domain} — ${msg} ✗`);
+        // "This TLD is not currently supported" reads as a dead end, and a team
+        // building for Switzerland took it as one and settled for a .com. It is
+        // not: registering elsewhere and importing the nameservers gives the same
+        // DNS, SSL and mail behaviour, with no registrar credentials needed. The
+        // answer belongs in the same message as the refusal.
+        if (/TLD is not (currently )?supported|not supported/i.test(msg)) {
+            info('');
+            info(`→ You can still use ${domain} on MyAPI. Register it with any registrar,`);
+            info(`  point its nameservers at MyAPI, then:  myapi domain import ${domain}`);
+            info('  DNS, SSL and mail records work the same way afterwards.');
+        }
     }
 }
 export async function register(domainArg, flags) {

package/dist/commands/fn.js

@@ -54,7 +54,10 @@ function summarizeFn(f) {
         id: f.id,
         name: f.name,
         trigger: f.trigger_type === 'cron' ? `cron ${f.cron_schedule ?? '?'}` : 'http',
-        url: f.invocation_url || '(not deployed)',
+        // A cron function is never reachable over HTTP — its URL 404s. Printing
+        // one contradicted the docs more loudly than the docs denied it, and a
+        // user wrote a `fetch` handler for manual runs that could never fire.
+        url: f.trigger_type === 'cron' ? '— (cron: not HTTP-invocable)' : (f.invocation_url || '(not deployed)'),
         updated_at: f.updated_at,
     };
 }
@@ -128,7 +131,9 @@ export async function get(id, flags) {
     info(`ID:              ${fn.id}`);
     info(`Name:            ${fn.name}`);
     info(`Trigger:         ${fn.trigger_type}${fn.cron_schedule ? ` (${fn.cron_schedule})` : ''}`);
-    info(`Invocation URL:  ${fn.invocation_url || '(not deployed)'}`);
+    info(fn.trigger_type === 'cron'
+        ? 'Invocation URL:  — (cron functions are not reachable over HTTP)'
+        : `Invocation URL:  ${fn.invocation_url || '(not deployed)'}`);
     info(`Created:         ${fn.created_at}`);
     info(`Updated:         ${fn.updated_at}`);
 }

package/dist/commands/task.js

@@ -15,6 +15,12 @@ export const EXPOSES = [
     'POST /task/orgs/{org_id}/tasks/{id}/fail',
     'POST /task/orgs/{org_id}/tasks/{id}/resolve',
 ];
+// --source meant five different things across the CLI. Here it is --origin;
+// the old name still works and is undocumented. See crm/pagination.ts.
+function taskOrigin(flags) {
+    const v = flags.origin !== undefined ? flags.origin : flags.source;
+    return typeof v === 'string' ? v : undefined;
+}
 export const SCHEMA = {
     body: 'string',
     importance: 'string',
@@ -24,6 +30,8 @@ export const SCHEMA = {
     'depends-on': 'string',
     'dedup-key': 'string',
     'resolve-on': 'string',
+    origin: 'string',
+    // Deprecated alias for --origin; undocumented, removable next minor.
     source: 'string',
     status: 'string',
     limit: 'number',
@@ -106,7 +114,7 @@ export async function create(description, flags) {
         dependsOn: _splitList(flags['depends-on']),
         dedupKey: typeof flags['dedup-key'] === 'string' ? flags['dedup-key'] : undefined,
         resolveOn,
-        source: typeof flags.source === 'string' ? flags.source : undefined,
+        source: taskOrigin(flags),
     });
     if (flags.json) {
         printJson(t);
@@ -125,7 +133,7 @@ export async function list(flags) {
         tag: typeof flags.tag === 'string' ? flags.tag : undefined,
         importance: typeof flags.importance === 'string' ? flags.importance : undefined,
         assignee: typeof flags.assignee === 'string' ? flags.assignee : undefined,
-        source: typeof flags.source === 'string' ? flags.source : undefined,
+        source: taskOrigin(flags),
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
     });
     if (flags.json) {
@@ -235,8 +243,8 @@ export async function cancel(id, flags) {
 }
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    'create': 'myapi task create "<description>" [--body <md|@file>] [--importance <i>] [--due <rfc3339>] [--assignee <email>] [--tag <t,t>] [--depends-on <id,id>] [--dedup-key <k>] [--resolve-on <event[:field=value]>] [--source <s>] [--org <id>]',
-    'list': 'myapi task list [--status <s>] [--tag <t>] [--importance <i>] [--assignee <email>] [--source <s>] [--limit <n>] [--org <id>] [--json]',
+    'create': 'myapi task create "<description>" [--body <md|@file>] [--importance <i>] [--due <rfc3339>] [--assignee <email>] [--tag <t,t>] [--depends-on <id,id>] [--dedup-key <k>] [--resolve-on <event[:field=value]>] [--origin <s>] [--org <id>]',
+    'list': 'myapi task list [--status <s>] [--tag <t>] [--importance <i>] [--assignee <email>] [--origin <s>] [--limit <n>] [--org <id>] [--json]',
     'get': 'myapi task get <id> [--body] [--org <id>] [--json]\n\n--body additionally fetches the Markdown body tier (a separate read).',
     'claim': 'myapi task claim <id> [--lease <seconds>] [--worker <name>] [--org <id>]',
     'extend': 'myapi task extend <id> [--lease <seconds>] [--org <id>]',

package/dist/skills/my-api-hq/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Auth, organizations, and billing hub. Start here to get an api_key and org_id — every other service depends on both.
 triggers: [api key, account, organization, org, billing, balance, topup, credits, setup, defaults, brand, sync brand, doctor, health check, is my org healthy]
-checksum: sha256-80bee1daf601eb33abc5d66b7f8053b20abec1c9c0ec07f26e86e26a2d3bdb78
+checksum: sha256-fab324491446026e1600ac531bfbb164c10d46a617e528e6886be74b7dbdb4b1
 ---
 
 # MyApiHQ
@@ -98,4 +98,28 @@ Each org gets a free preview subdomain (`*.makeautonomous.com`) usable before re
 - API keys have format `hq_live_...` and are sent as `Authorization: Bearer <key>`.
 - `org sync-brand` is async (scrapes the site, polls the job).
 
+## Minting a least-privilege API key
+
+A key's authority is inline and always a subset of the key that mints it, so
+you can hand work a key that cannot exceed its job:
+
+```bash
+myapi keys create --name ci --grant funnel:write,storage:read
+myapi keys create --name readonly --grant '*:read'          # read anything, write nothing
+myapi keys create --name billing-fn --org <id> --grant email --spend-cap 25
+```
+
+- `--grant <list>` — `slot:read` / `slot:write`; a bare slot means write, `*`
+  means all. **Omitting `--grant` mints an unrestricted key.**
+- `--org <id>` — lock it to one org. Omit for account-wide.
+- `--spend-cap <usd>` — hard ceiling; `0` means the key cannot spend at all.
+- `keys revoke-all --kind function|manual|account` narrows the kill switch.
+
+## Org profile fields
+
+`myapi org create <name>` also takes `--tagline`, `--description`,
+`--business-sector` and `--logo-url`. They populate the org's public profile
+and the funnel created alongside it, so setting them at create avoids editing
+two places later.
+
 Run `myapi --help` or `myapi <command> --help` for full flag reference.

package/dist/skills/my-audience-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Saved audiences = named Goldfox-filter snapshots over the people or company database. Build a target list once, name it, reuse it across campaigns, refresh to re-evaluate against current data. The persistence layer on top of my-people-api + my-company-api.
 triggers: [audience, segment, target list, saved filter, goldfox, lead list, abm list, refresh, members, prospect database]
-checksum: sha256-5d9a2731d587c476eff2955241001fecb8481bbc5e567f06b8e9e76a079eda92
+checksum: sha256-a2c7142e880932ac2aa53cdb29b8632ce2c4d5ef33c3f8b6df705f7e987ab6af
 ---
 
 # MyAudienceAPI
@@ -70,7 +70,7 @@ Allowed values:
 <!-- generated:start -->
 | Command | What it does |
 |---|---|
-| `myapi audience create <name> --source <people\|company> --filter '<json>' [--description <text>]` | Save a Goldfox filter as a named audience; returns id + initial member_count |
+| `myapi audience create <name> --from <people\|company> --filter '<json>' [--description <text>]` | Save a Goldfox filter as a named audience; returns id + initial member_count |
 | `myapi audience list` | List all audiences in the org |
 | `myapi audience get <id>` | Single audience (name, filter, member_count, timestamps) |
 | `myapi audience update <id> [--name <x>] [--description <y>] [--filter '<json>']` | Patch name/description/filter; member_count re-evaluates if filter changes |
@@ -84,7 +84,7 @@ Allowed values:
 ```bash
 # 1. Create the audience
 AID=$(myapi audience create "EU decision makers w/ corporate emails" \
-  --source people \
+  --from people \
   --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"]}' \
   --json | jq -r .id)
 
@@ -108,7 +108,7 @@ myapi audience delete $AID
 ```bash
 # Build with quality controls — definitive links + registered companies + careers signal
 AID=$(myapi audience create "EU growth-stage decision makers" \
-  --source people \
+  --from people \
   --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"],"min_link_confidence":0.9,"has_careers_page":true,"is_registered_entity":true}' \
   --json | jq -r .id)
 
@@ -123,7 +123,7 @@ myapi audience refresh $AID
 
 ```bash
 myapi audience create "EU growth-stage SaaS accounts" \
-  --source company \
+  --from company \
   --filter '{"country":["DE","FR","GB","NL"],"has_careers_page":true,"has_decision_maker":true,"is_registered_entity":true,"min_source_count":3}'
 ```
 <!-- llm:end -->

package/dist/skills/my-auth-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Add authentication to apps you build on MyAPI — a managed OIDC identity provider for your app's END USERS (à la Kinde/Auth0). One auth tenant per org; register OIDC clients; sign users in with managed Google or the hosted login page; verify RS256 tokens against the tenant JWKS.
 triggers: [auth, authentication, login, sign-in, oidc, oauth, jwt, jwks, sso, google sign-in, user accounts, identity provider, kinde, auth0, clerk]
-checksum: sha256-b5eca82bb59647677fdb5796778329160572598ac6914887768fd33529cdfe84
+checksum: sha256-5eeacc463d7323f85a330639b7073f735ccc80bddfb8217c9c15c56989b8a99a
 ---
 
 # MyAuthAPI
@@ -114,4 +114,11 @@ myapi auth client list
   `http://localhost…` for local dev).
 - `402 INSUFFICIENT_FUNDS` = empty wallet → `myapi billing topup <amount>` (or keep it funded automatically: `myapi billing auto-recharge set`). `402 SPEND_CAP_EXCEEDED` = you hit your account spend ceiling → raise it with `myapi billing spend-cap`.
 
+## Anonymous accounts
+
+`myapi account setup --anonymous` skips registration and creates an account
+with no email — for throwaway or machine-owned orgs. It cannot receive
+password resets or magic links, so attach a real identity before anything
+depends on it. `myapi status` shows `Type: anonymous`.
+
 **End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (verify the id_token for identity; the access token is a bearer credential for `<issuer>/userinfo`).

package/dist/skills/my-company-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Company database backed by the Goldfox crawl. Filter companies by Goldfox confidence tier, country/TLD consistency, behavioral page signals (has_careers_page, has_investors_page, has_shop_page, has_c_level, has_decision_maker), legal-entity status, headcount, and source-URL count. Account-based targeting and B2B firmographics.
 triggers: [companies, accounts, firmographics, abm, search, filter, goldfox, careers signal, investors, c-level, shop, b2b targeting]
-checksum: sha256-67dd4b65a9b0cc7acf7c1e4262bc66d2b58ff11ed227a24299924e0b620712f0
+checksum: sha256-4754de8a66bf13e7e2f2a23acc407ccec147e142abf8adc670ae7962ca860a74
 ---
 
 # MyCompanyAPI
@@ -90,7 +90,7 @@ myapi company get auroracloud.com --include-people 5
 ```bash
 # Save filter as audience (companies)
 AID=$(myapi audience create "EU growth-stage SaaS" \
-  --source company \
+  --from company \
   --filter '{"country":["DE","FR","GB","NL"],"has_careers_page":true,"has_decision_maker":true,"min_source_count":3}' \
   --json | jq -r .id)
 
@@ -105,6 +105,6 @@ myapi audience members $AID --limit 50 --json > accounts.json
 - `seniority`, `email_type`, and `min_link_confidence` are people-only — passing them on company search is silently ignored.
 - `include_people` only works on company search/get; people-source already embeds company by default.
 - `keyword` is a substring match on the company's **domain** — use `--keyword stripe` to find domains containing "stripe".
-- For a persistent account list, use `my-audience-api` with `--source company`.
+- For a persistent account list, use `my-audience-api` with `--from company`.
 
 Run `myapi company --help` for full flag reference.

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-3864bbb98fab89ba9e937c38bed072e22f33663ec7cbc23a43f24192275bcffd
+checksum: sha256-47eda6baa9055dadbd3e9d04df9fc425f1a7e96a9cd80c971c4951b97f1e94ff
 ---
 
 # MyContainerAPI
@@ -16,7 +16,11 @@ A container runs a pre-built image on managed cloud infrastructure. Three types:
 The lifecycle is **create → deploy → (optionally) bind a custom domain**.
 
 - `create` registers the container and issues a **scoped API key**, returned once. The running container receives it as the `MYAPI_KEY` env var, so your code calls other MyAPI slots with no token handling. Deploy rotates this key.
-- `deploy` ships a pre-built image reference to the runtime and makes the container live at a generated URL.
+- `deploy` takes **either** a pre-built image reference **or** a source
+  directory. `--source ./dir` tars the directory, builds it server-side
+  (typically ~4 minutes) and deploys the result — **no Docker on your machine,
+  no registry account, no image to push**. If you can write a Dockerfile you
+  can deploy; you do not need to be able to run one.
 - `domain` puts the container on a **custom domain** — how you serve a dynamic app at `app.yourbrand.com`.
 
 ### Deploying safely — NOT YET POSSIBLE ON THIS PLATFORM
@@ -74,10 +78,16 @@ Get it right:
 myapi container create --name api --type service --port 8080
 # → prints a scoped API key ONCE — save it if your code needs it
 
-# 2. Deploy. This takes 100% of traffic immediately — there is no staging
-#    step, so verify on a non-production container FIRST.
+# 2a. Deploy from source — MyAPI builds it. No local Docker required.
+#     Takes ~4 minutes; the CLI polls until it is live.
+myapi container deploy <id> --source ./my-app
+
+# 2b. Or ship an image you already built and pushed.
 myapi container deploy <id> registry.example.com/my-app:v1
 
+# Either way this takes 100% of traffic immediately — there is no staging
+# step, so verify on a non-production container FIRST.
+
 # 3. Check what you actually shipped. Assert on content: a build whose
 #    frontend never bundled still binds its port and returns 200.
 curl -s https://<your-domain>/ | grep -q 'assets/' || echo "BROKEN BUILD"
@@ -114,6 +124,13 @@ way that looks like an application bug.
   `create` and cannot be changed by `deploy`.** Passing them to `deploy` does
   nothing. Recreate the container to change them.
 
+### Keeping a service warm
+
+`--min-instances 1` at create stops a `service` scaling to zero, which removes
+cold starts at the cost of running continuously. Leave it at the default `0`
+unless latency on the first request actually matters — a scaled-to-zero
+service costs nothing while idle.
+
 ## Notes
 
 - The scoped API key is shown **once** at create, and again (rotated) on every deploy. Save it if your code needs it.
@@ -122,6 +139,10 @@ way that looks like an application bug.
   the same stream and share the `--tail` budget, so raise `--tail` with it.
 - Custom domains need a deployed container **and** a MyAPI-registered parent domain — see `my-domain-api`.
 - Containers are for dynamic apps and native deps. For static sites use `my-funnel-api`; for edge functions use `my-function-api`.
+- **`--source` does not honour `.dockerignore`.** It tars the directory as-is,
+  so a `node_modules` can push the context past the limit and fail as
+  `invalid_json_response`. Build the tarball yourself and pass
+  `--source ctx.tar.gz`, or keep the directory clean.
 
 Run `myapi container --help` for the full flag reference.
 

package/dist/skills/my-crm-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-50cbdd28ed2a901b7a75f1a6c1df1c225d256a8d281ad86cf1e3b42511edc2fe
+checksum: sha256-dfadb20670d9d978503549d330c2c9717fbe6d13ac35b53d9e1a8874d2136fde
 ---
 
 # MyCRMAPI
@@ -38,7 +38,7 @@ Move stage with `myapi crm contacts update <id> --stage qualified`. Every stage
 goldfox | email | pixel | webhook | manual
 ```
 
-Set automatically from how the contact entered. Filter with `--source manual` (added by hand) vs `--source goldfox` (from outreach).
+Set automatically from how the contact entered. Filter with `--origin manual` (added by hand) vs `--origin goldfox` (from outreach).
 
 ### Event timeline — reserved kinds
 
@@ -75,7 +75,7 @@ A contact promoted from Goldfox carries a `goldfox_person_id`. In v2 the GET res
 
 ### Search filter — re-engagement semantics
 
-`--max-last-engagement-days N` returns contacts last engaged *more than* N days ago, and intentionally **includes contacts with no engagement at all** (promoted-but-never-emailed Goldfox leads) — the natural targets of a re-engagement campaign. To separate "never tried" from "tried and went cold," layer `--source goldfox` or post-filter the JSON.
+`--max-last-engagement-days N` returns contacts last engaged *more than* N days ago, and intentionally **includes contacts with no engagement at all** (promoted-but-never-emailed Goldfox leads) — the natural targets of a re-engagement campaign. To separate "never tried" from "tried and went cold," layer `--origin goldfox` or post-filter the JSON.
 
 ### Failure modes
 
@@ -92,7 +92,7 @@ A contact promoted from Goldfox carries a `goldfox_person_id`. In v2 the GET res
 | Command | What it does |
 |---|---|
 | `myapi crm contacts list [--limit N] [--offset N]` | List all contacts (newest engagement first) |
-| `myapi crm contacts search [--stage ...] [--source ...] [--email ...] [--min/max-last-engagement-days N]` | Filter contacts |
+| `myapi crm contacts search [--stage ...] [--origin ...] [--email ...] [--min/max-last-engagement-days N]` | Filter contacts |
 | `myapi crm contacts create <email> [--first-name ...] [--last-name ...] [--stage ...] [--custom-json ...]` | Manually create (source='manual') |
 | `myapi crm contacts get <id>` | Fetch one contact (with embedded Goldfox enrichment when available) |
 | `myapi crm contacts update <id> [--stage ...] [...]` | Patch fields. Stage change emits `stage_changed` event |
@@ -138,7 +138,7 @@ myapi crm contacts update <id> --stage customer
 myapi crm contacts events <id>
 
 # What landed in CRM from this Stripe webhook?
-myapi crm contacts search --source webhook --json \
+myapi crm contacts search --origin webhook --json \
   | jq '.contacts[] | {email, last_engagement_at}'
 ```
 
@@ -151,7 +151,7 @@ URL=$(echo "$WH" | jq -r .url)
 echo "Point Stripe at: $URL"
 
 # Later, after Stripe fires...
-myapi crm contacts search --source webhook --email "$STRIPE_CUSTOMER_EMAIL"
+myapi crm contacts search --origin webhook --email "$STRIPE_CUSTOMER_EMAIL"
 myapi crm contacts events <id> --kind webhook_received
 ```
 <!-- llm:end -->

package/dist/skills/my-database-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Per-org KV store with named namespaces, JSON values up to 256 KB, prefix-scan listing, and compare-and-swap via etag. The substrate for any stateful agent-built app on MyAPI — user tables, session stores, idempotency keys, per-user lookup maps.
 triggers: [database, kv, key value, namespace, store, state, etag, cas, session, idempotency]
-checksum: sha256-f098cb574a1773135b09cbe79bb75eb33e34b1dc90737aa80da2452bb53e972e
+checksum: sha256-924071245c33bf3e43f085fbd756af003e19c990f4522f658de33f42504452d7
 ---
 
 # MyDatabaseAPI
@@ -104,6 +104,27 @@ myapi database get "by-email:$EMAIL" --ns users --json | jq -r .value
 - **Eventual `key_count`.** The `keys` field on a namespace is approximate; don't use it for strict pagination math.
 - **Free in v1.** Metered later if usage shows a need. Cost discipline still applies — store data, not blobs.
 
+
+## Calling this from deployed code (HTTP)
+
+The CLI is not what runs in production — a deployed function or container calls
+the HTTP API directly. That surface was previously only discoverable by
+grepping the CLI bundle, which cost one team an hour per slot.
+
+```
+base    https://api.myapihq.com
+path    /database/orgs/{org_id}/namespaces/{ns}/keys/{key}
+auth    Authorization: Bearer <api key>
+        (inside a function: env.__MYAPI_KEY · inside a container: env.MYAPI_KEY)
+body    writes take {"value": <json>} — the value is WRAPPED
+reply   { "success": true, "data": …, "error": null, "meta": {…} }
+        Unwrap `data`. On failure `success` is false and `error` is
+        { code, message }.
+```
+
+**The org id goes in the PATH, not a header.** There is no `X-Org-Id`.
+**Base URLs differ per slot** — do not assume one host for everything.
+
 Run `myapi database --help` for inline reference.
 
 **End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (KV writes must be wrapped as `{"value": …}`).

package/dist/skills/my-domain-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Register new domains and manage edge settings. Required before a funnel can go live on a custom URL.
 triggers: [domain, register domain, dns, custom domain, edge, cdn, security level, browser check, renew, namecheap]
-checksum: sha256-8f96d19c11c3591af71e9d73b2cea6d83f40abbfa1c58c5674dbe15db02efa3c
+checksum: sha256-6a686b453528c69dcc791db409c04a514422951abf333c8feed7c614311815cb
 ---
 
 # MyDomainAPI
@@ -116,4 +116,21 @@ Set `essentially_off` + `browser-check=off` to allow AI crawlers and training bo
 - All commands default to `--org` from your saved config (set with `myapi config set-org <id>`).
 - `402 INSUFFICIENT_FUNDS` = empty wallet → `myapi billing topup <amount>` (or keep it funded automatically: `myapi billing auto-recharge set`). `402 SPEND_CAP_EXCEEDED` = you hit your account spend ceiling → raise it with `myapi billing spend-cap`.
 
+## DNS record flags
+
+```bash
+myapi domain records create <domain> --type A --name @ --content 1.2.3.4 --ttl 300
+myapi domain records create <domain> --type MX --name @ --content mx.x.com --priority 10
+myapi domain records create <domain> --type CNAME --name app --content x.com --proxied
+```
+
+- `--ttl <n>` — seconds; default `1` meaning "automatic". Explicit range 60–86400.
+- `--priority <n>` — MX only, and required for it (typical `10`).
+- `--proxied` — route through the edge proxy (A/AAAA/CNAME only). Off means
+  the record resolves straight to your origin, exposing its address.
+- `myapi domain assign <domain> --no-www` skips the `www` → apex redirect.
+- `--force` on assign re-points a domain already bound elsewhere. It is the
+  reassign path, so pass `--org` explicitly and check `domain list --filter all`
+  first.
+
 Run `myapi domain --help` or `myapi domain <subcommand> --help` for full flag reference.

package/dist/skills/my-email-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Send transactional and bulk email from your own domain. Create mailboxes, send/receive messages, generate AI templates, and manage warmup.
 triggers: [email, mailbox, send email, transactional email, template, warmup, inbox, outbox, ses, sender reputation]
-checksum: sha256-fa1eb6ee9e24935266643ceeecf7a748747b23377a0bfe256f76b71b62bd6349
+checksum: sha256-aa22381613affcff041a8d51d2acb2ba657fecefc97f4feba45958bcc11b2e06
 ---
 
 # MyEmailAPI
@@ -66,4 +66,39 @@ myapi email warmup stats --address hello@yourdomain.com
 - Sending is opt-in per mailbox. Newly-created mailboxes can receive but not send until `activate-sending` runs.
 - Templates are org-scoped. Set a default org once: `myapi config set-org <id>`.
 
+
+## Which name mail actually lives on
+
+Two things that read as contradictory and are not:
+
+- **Mailbox addresses are on the APEX** — `contact@yourdomain.com`, never
+  `contact@mail.yourdomain.com`. `mail.<domain>` is the *sending identity* that
+  `myapi domain email-setup` provisions, not a mailbox namespace. Creating a
+  mailbox on the subdomain fails with `DOMAIN_NOT_OWNED`.
+- **Registration and assign put `MX`, `SPF` and `DMARC` on the apex** whether or
+  not you run `email-setup`. So "apex is never touched" — which describes
+  `email-setup` specifically — is not true of the domain as a whole. If you plan
+  to run Google Workspace or another provider on the apex, check the existing
+  records first with `myapi domain records <domain>`.
+
+## Calling this from deployed code (HTTP)
+
+The CLI is not what runs in production — a deployed function or container calls
+the HTTP API directly. That surface was previously only discoverable by
+grepping the CLI bundle, which cost one team an hour per slot.
+
+```
+base    https://api.myemailapi.com   ← not the gateway
+path    /email/mailboxes   ·   /email/orgs/{org_id}/messages/send
+auth    Authorization: Bearer <api key>
+        (inside a function: env.__MYAPI_KEY · inside a container: env.MYAPI_KEY)
+body    application/json
+reply   { "success": true, "data": …, "error": null, "meta": {…} }
+        Unwrap `data`. On failure `success` is false and `error` is
+        { code, message }.
+```
+
+**The org id goes in the PATH, not a header.** There is no `X-Org-Id`.
+**Base URLs differ per slot** — do not assume one host for everything.
+
 Run `myapi email --help` or `myapi email <namespace> --help` for full flag reference.

package/dist/skills/my-function-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Deploy JavaScript functions to the MyAPI edge runtime. Register a function, upload a single-file JS bundle, get a live HTTP invocation URL or run it on a cron schedule. Each function gets a scoped capability key for cross-slot calls.
 triggers: [function, deploy function, edge function, serverless, cloudflare worker, cron, scoped api key, capability key, invocation url, bundle]
-checksum: sha256-08524ea08e91dcb6c8b68b64a7b4034d24a98a18968acd4ba80e45dbd6f85d09
+checksum: sha256-1ef76e07c9fb4f295b491224261b5719314f15d3645c32e6e7b443a7fdaf95c6
 ---
 
 # MyFunctionAPI
@@ -78,9 +78,36 @@ myapi fn get fn_abc123
 myapi fn delete fn_abc123
 ```
 
+### The scoped API key is already in your function — as `__MYAPI_KEY`
+
+**Two leading underscores, and it is injected for you.** Verified by probing a
+deployed function: `Object.keys(env)` returns exactly `["__MYAPI_KEY"]`, and
+`MYAPI_KEY` (no underscores) is NOT present.
+
+```js
+export default {
+  async fetch(request, env) {
+    const r = await fetch('https://api.myapihq.com/database/orgs/<org>/namespaces/app/keys/x', {
+      headers: { Authorization: `Bearer ${env.__MYAPI_KEY}` },
+    });
+    return new Response(await r.text());
+  },
+};
+```
+
+**Do not capture the key printed at `fn create` and set it yourself.** Every
+`fn deploy` rotates it, so a manually-set copy goes stale on the next deploy
+and the function starts returning 502 with nothing in the deploy output to
+explain it. The injected `__MYAPI_KEY` is always current.
+
+Note the name differs from containers, which receive `MYAPI_KEY` without the
+underscores. Both verified 2026-07-28.
+
 ### Using the scoped API key
 
 ```bash
+# You do NOT need this — env.__MYAPI_KEY is injected and always current.
+# Shown only for calling the function's slots from OUTSIDE the function.
 # Save the API key returned at create/deploy time
 SCOPED_KEY="hq_live_..."
 
@@ -100,5 +127,6 @@ curl -H "Authorization: Bearer $SCOPED_KEY" \
 - The bundle is a **single JavaScript file** (≤4MB). Bundle your dependencies before deploy (esbuild/rollup/etc.).
 - `--cron` is set at create time; the trigger type is fixed for the function's lifetime.
 - Deploy rotates the scoped API key on every call — re-capture the printed value if other systems use it.
+- `myapi fn env <id> --set KEY=VALUE,OTHER=VALUE` sets several secrets in one call instead of one command each.
 
 Run `myapi fn --help` or `myapi fn <subcommand> --help` for full flag reference.

package/dist/skills/my-funnel-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Create and publish websites (funnels) to the edge. Push raw HTML to any slug and it goes live instantly on your org's domain or preview subdomain.
 triggers: [funnel, landing page, website, page, publish, push, slug, html, edge, preview subdomain, makeautonomous]
-checksum: sha256-3b463d6ac52fba7d44f89195b5704b02903ffdd9a677655f9c1bff0f13b25ab4
+checksum: sha256-849afbb7c2c60ea88c3476d50bf51289b77cedc819a0c2b69787075ff9c23b4b
 ---
 
 # MyFunnelAPI
@@ -33,7 +33,7 @@ Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and e
 | `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`). **Overwrites** an existing page — refused without `--force`. `--json` prints `{slug, subdomain_url, overwritten, org_id, funnel_id}` |
 | `myapi funnel publish <dir>` | Upload a whole directory as the funnel's site (`--env dev\|prod`, default prod; `--api-fn <id>`; `--json`). Prod refuses to replace a live site without `--force` |
 | `myapi funnel pages [funnel_id]` | List the pages currently published to a funnel |
-| `myapi funnel form [funnel_id]` | Emit canonical form HTML (and register a binding with `--capture-to`) |
+| `myapi funnel form [funnel_id]` | Emit canonical form HTML (`--capture-to`, `--cta`, `--success`, `--honeypot`) |
 | `myapi funnel verify [slug]` | Verify a published page is reachable + check links/webhooks |
 <!-- generated:end -->
 
@@ -83,7 +83,10 @@ Zero-config form (the happy path most agents want) — still pin the org + funne
 
 ```bash
 myapi funnel create --name acme-demo --org <org_id>
-myapi funnel form --slug join --fields email:required,name --funnel <funnel_id> > snippet.html
+myapi funnel form --slug join --fields email:required,name --funnel <funnel_id> \
+  --cta "Join" --success "Thanks — check your inbox." --honeypot company_url > snippet.html
+# --honeypot names a hidden field: bots fill it, humans never do, so a
+# submission carrying it is dropped.
 # paste snippet.html into your page (or pipe through funnel push):
 cat page-with-snippet.html | myapi funnel push / --funnel <funnel_id>
 # Submissions land in the funnel's auto-provisioned webhook → CRM upsert on `email` → any bound workflow fires.

package/dist/skills/my-git-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Hosted git repositories over HTTP. Create repos, read history (log/show/tree/blob/diff), and write atomically (commit/branch/tag/merge) — no clone needed. Real `git clone`/`push` also work over HTTPS with your API key as the password.
 triggers: [git, repo, repository, clone, push, commit, branch, tag, merge, diff, version control, source control, vcs]
-checksum: sha256-921cedea836edac33fefabfb46102e241d2618529db2e307cc73f4d910e7fee3
+checksum: sha256-417bafc3e56707f637937f98341d6200c8a9bb6ad5d0b13f84f7b6810e0340f5
 ---
 
 # MyGitAPI
@@ -119,4 +119,10 @@ surface never leaks which repos exist).
 - **Limits.** A push body is capped at 100 MiB; per-repo size limits apply (a push past the cap is reported as a receive-pack failure).
 - **Auth field.** git may put the API key in the username or password slot — both work. Embedding it in the URL (`https://x:$KEY@…`) avoids the interactive prompt but writes the API key into `.git/config`; use a credential helper for anything persistent.
 
+## Commit authorship
+
+`myapi git commit … --author-name "<n>" --author-email "<e>"` sets the commit
+author. Without them the commit is attributed to the API key's account, which
+makes every agent-written commit look like the same person.
+
 Run `myapi git --help` for the full flag reference.

package/dist/skills/my-people-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Contact database backed by the Goldfox crawl. Filter people by Goldfox confidence tier, seniority, email type, country, link confidence, plus rich behavioral company signals (has_c_level, has_careers_page, has_decision_maker, etc.). The targeting layer for outbound campaigns.
 triggers: [people, contacts, leads, prospects, search, filter, goldfox, decision-makers, c-level, b2b targeting, corporate email]
-checksum: sha256-a4b594a30cc06d2f40fe26c594c1cb6962d91c4dbcc0625210d45a3faa27336e
+checksum: sha256-1eb93087638966eee65fb7a88fe37baaa27a01dd5d97c1ef17387b1a36300c0e
 ---
 
 # MyPeopleAPI
@@ -88,7 +88,7 @@ myapi people get p_MTdlc2llY2xlLmZy.0
 ```bash
 # Build the target audience (saved filter)
 AID=$(myapi audience create "EU decision makers w/ careers signal" \
-  --source people \
+  --from people \
   --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"],"has_careers_page":true}' \
   --json | jq -r .id)
 
@@ -100,7 +100,7 @@ myapi audience members $AID --limit 100 --json > targets.json
 ## Notes
 
 - The dataset is the Goldfox crawl — multi-million-row corporate contact data with provenance signals. Filter quality matters: defaults to `confidence=high` gives 96.4% of rows by count, but it's the curated tier; widening with `confidence=low` brings UGC rows that need spot-checking.
-- `seniority`, `email_type`, and `min_link_confidence` are people-only — silently ignored on `my-company-api` and on audiences with `--source company`.
+- `seniority`, `email_type`, and `min_link_confidence` are people-only — silently ignored on `my-company-api` and on audiences with `--from company`.
 - `keyword` matches the row's **domain**, not name/title. Use `--keyword acme` to find people whose domain contains "acme".
 - For a persistent target list, use `my-audience-api` (snapshot the filter; re-evaluate on `audience refresh`).
 

package/dist/skills/my-pixel-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Tracking pixel + identity resolution for MyAPI funnels and email. Capture visits and events, resolve known users to anonymous sessions, stream interaction events for analytics. Pairs with mycrmapi for auto-ingest of pixel_visit events on known contacts.
 triggers: [pixel, analytics, tracking, visit, event, identity, session, attribution, geo, open pixel]
-checksum: sha256-1e8284fbf546ad1bdff32790f56f8c524a19e0b80b92cc6d612ce15295632c9f
+checksum: sha256-562f081ef28c0dae01045a4135f9d073d69c50899145e75c6c97fe75b974cb15
 ---
 
 # MyPixelAPI
@@ -83,6 +83,17 @@ myapi pixel audience
 - **No write API for synthetic events** — the pixel records what the embedded JS/email-pixel observes. To inject custom timeline entries, use `myapi crm contacts/{id}/events` instead (when reserved-kind allows; today event writes are platform-only).
 - **`my-crm-api` is the durable record.** Pixel data ages out at ~90 days; CRM events are permanent. If a behavioral signal matters for long-term targeting, promote it into the CRM.
 
+## Linking a known identity
+
+`myapi pixel identify <pixel_id>` attaches a known identity to an anonymous
+visitor:
+
+- `--email <addr>` — the address to link.
+- `--external-id <id>` — your own user id, for joining back to your database.
+
+Pass either or both. After this, `pixel identity <pixel_id>` resolves the
+graph across the visitor's sessions.
+
 Run `myapi pixel --help` for inline reference.
 
 ## Status

package/dist/skills/my-storage-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Edge-hosted asset storage. Upload a local file of any content type directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
 triggers: [storage, upload, ingest, asset, cdn, image hosting, file upload, get-url, download, public url]
-checksum: sha256-b55e3f0aa592330cadfdc2b87e730333300bfffb08866b3bc59cb0ce15d2f953
+checksum: sha256-9172b0d8590a3102ce35b94ef48015ec36c624ab9bcc37fe0f7efa15bc54cf62
 ---
 
 # MyStorageAPI
@@ -89,8 +89,37 @@ Both produce identical asset records — `list` doesn't distinguish.
 
 ## Notes
 
-- Assets are public by default — don't store sensitive files.
+- **Assets are public, permanently, with no auth.** Anyone with the URL can
+  fetch it; there is no private mode, no signed URL, and no revocation. The id
+  being long and random is **not** access control — treat the URL as public the
+  moment it exists.
+- **For personal or regulated data, encrypt before upload.** Storage only ever
+  sees ciphertext. A team shipping Swiss lease documents (names, dates of
+  birth, permit type, IBAN) used AES-256-GCM envelope encryption with a
+  per-document data key wrapped under a master key held in function secrets.
+  That is the pattern to copy until private assets exist.
 - Delete is immediate and unrecoverable — run `myapi storage list` first to confirm the asset, pass `--org` explicitly, and pass `--yes` in non-interactive runs.
 - The URL is permanent until you `myapi storage delete <id>` — embed it freely.
 
+
+## Calling this from deployed code (HTTP)
+
+The CLI is not what runs in production — a deployed function or container calls
+the HTTP API directly. That surface was previously only discoverable by
+grepping the CLI bundle, which cost one team an hour per slot.
+
+```
+base    https://api.mystorageapi.com   ← not the gateway
+path    /storage/orgs/{org_id}/assets/upload   (multipart, field: file)
+auth    Authorization: Bearer <api key>
+        (inside a function: env.__MYAPI_KEY · inside a container: env.MYAPI_KEY)
+body    multipart/form-data
+reply   { "success": true, "data": …, "error": null, "meta": {…} }
+        Unwrap `data`. On failure `success` is false and `error` is
+        { code, message }.
+```
+
+**The org id goes in the PATH, not a header.** There is no `X-Org-Id`.
+**Base URLs differ per slot** — do not assume one host for everything.
+
 Run `myapi storage --help` for full flag reference.

package/dist/skills/my-task-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Agent-task queue — file units of work, rank them, claim under a lease, then resolve, fail, or cancel. The agent-loop hot path.
 triggers: [task, task queue, agent loop, work queue, claim task, resolve task, lease, backlog, to-do, assignee]
-checksum: sha256-ead9513eafbdd4d384a3cb297facf934f786f7067028c75cc08ef2ba1ac61cf7
+checksum: sha256-ceb6cdfffe465d8b0cd232eaa16868c1b8c8b10288f1cf9b4174fdd48a8d2c18
 ---
 
 # MyTaskAPI
@@ -71,4 +71,12 @@ myapi task create "Ship once payment clears" \
 - `resolve` unblocks dependents; `fail` cascades to dependents that can never proceed.
 - `resolve_on` matches platform events. Today few event kinds are emitted in production — verify the kind exists before relying on it.
 
+## Idempotency and provenance
+
+- `--dedup-key <k>` — creating a task with a key that already exists returns
+  the existing task instead of a duplicate. Use it whenever a task is created
+  from a retryable event, which for an agent is nearly always.
+- `--origin <s>` — records what created the task, and filters `task list`.
+  (Formerly `--source`, which still works and is undocumented.)
+
 Run `myapi task --help` for the full flag reference.

package/dist/skills/my-webhook-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Inbound webhook endpoints for non-funnel sources — Stripe, GitHub, custom services. Funnel forms use the my-funnel-api proxy.
 triggers: [webhook, inbound, receiver, stripe events, github webhook, slack notification, delivery, payload, event ingest]
-checksum: sha256-82666c883230a775b07c8e1ec6243e812e58f246dd9a7cf1659aee77b877ee73
+checksum: sha256-17b358d780333cabe76cb01df3be3c3f11db10a2b068449bcf9e10e2ed89393d
 ---
 
 # MyWebhookAPI
@@ -97,4 +97,15 @@ The form sends `{name, email, message}` → webhook stores it → workflow runs
 - Failed workflow runs don't affect the delivery record — the inbound POST is always saved.
 - Inbound responses: `200` on success, `4xx` if the endpoint is missing or body isn't valid JSON.
 
+## Auto-ingest and forwarding
+
+- `--crm-email-path <dot-path>` — where to find the email in an incoming
+  payload, so submissions become CRM contacts automatically. Default `email`
+  (top level). Stripe: `data.object.customer_email`. GitHub: `sender.email`.
+  An empty string disables ingest for that endpoint.
+- `--forward-url <url>` — POST a copy of every delivery onward. The forward
+  status is recorded on the delivery, so a failing forward is visible in
+  `webhook deliveries` rather than silent.
+- `--description <text>` — free text, shown in `webhook list`.
+
 Run `myapi webhook --help` for full flag reference.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.7.1",
+  "version": "2.7.2",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -37,11 +37,12 @@
     "lint:request-fields": "node scripts/lint-request-fields.js",
     "audit:doctor": "npm run build && node scripts/audit-doctor.js",
     "lint:docs": "node scripts/lint-docs.js",
+    "lint:skill-coverage": "node scripts/lint-skill-coverage.js",
     "lint:skills": "node scripts/copy-skills.js && node scripts/lint-skills.js",
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.7.1"
+    "@myapihq/sdk": "^2.7.2"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",