@myapihq/cli 2.7.1 → 2.8.0

package/dist/commands/flag-reachability.test.js

@@ -0,0 +1,274 @@
+// Does the flag REACH the call, or does it only parse?
+//
+// This file exists because of a bug we shipped and a customer found.
+//
+// `container deploy --no-promote` was wired to the pre-built-image path and
+// not to the `--source` path. `deployContainerSource()` was called without the
+// options object, so on a source build the flag was accepted and silently
+// discarded. Both flags were declared in the command schema, so the
+// foreign-flag check stayed quiet too. A team deployed with it, the build took
+// 100% of traffic anyway, and they reported it.
+//
+// The tests we had at the time all passed. They tested `_parseSmoke` (a pure
+// parser) and `deployContainer` (the SDK function). Nothing tested the CLI
+// handler, so nothing noticed that one of its two branches never passed the
+// options along. The backend hit the identical shape the same day and put it
+// better than we can:
+//
+//   "Counting call sites proves the helper is CALLED, not that it is REACHED."
+//
+// Ours is: testing the parser proves the flag PARSES, not that it is SENT.
+//
+// So this file tests HANDLERS, with the SDK mocked, asserting what actually
+// arrives at the boundary. Every case below is a real field report. When you
+// add a flag that changes a request, add a case here — a unit test on its
+// parser is not cover.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const ORG = '11111111-1111-4111-8111-111111111111';
+// The SDK is mocked wholesale so we can see exactly what the handler passes.
+// Typed loosely on purpose: the later describes assign whole slot objects
+// (sdk.task = {...}) and TS would otherwise reject each one. The assertions
+// still check real shapes.
+const sdk = vi.hoisted(() => ({
+    container: {
+        deployContainer: vi.fn(),
+        deployContainerSource: vi.fn(),
+        getContainerLogs: vi.fn(),
+        listContainers: vi.fn(),
+        getContainer: vi.fn(),
+        listRevisions: vi.fn(),
+        promoteRevision: vi.fn(),
+        createContainer: vi.fn(),
+    },
+    crm: { searchContacts: vi.fn(), searchCompanies: vi.fn() },
+    fn: { listFunctions: vi.fn() },
+    // Top-level SDK exports the handlers reach for. Mocking the module
+    // wholesale drops anything not listed, and the failure reads as a missing
+    // export rather than a missing mock — so they are enumerated explicitly.
+    withFundsRetry: vi.fn(async (f) => f()),
+    MyApiError: class MyApiError extends Error {
+        code = '';
+        status = 0;
+    },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: ORG }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+let exitError;
+beforeEach(async () => {
+    exitError = null;
+    vi.clearAllMocks();
+    const output = await import('../output.js');
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        exitError = m;
+        throw new Error('__EXIT__');
+    }));
+    vi.spyOn(output, 'info').mockImplementation(() => { });
+    vi.spyOn(output, 'success').mockImplementation(() => { });
+    vi.spyOn(output, 'printTable').mockImplementation(() => { });
+    vi.spyOn(output, 'printJson').mockImplementation(() => { });
+    vi.spyOn(output, 'banner').mockImplementation(() => { });
+});
+afterEach(() => vi.restoreAllMocks());
+// Runs a handler and swallows the synthetic exit thrown by a mocked error().
+async function run(fn) {
+    try {
+        await fn();
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('container deploy — the flag must be refused on BOTH paths', () => {
+    // The original bug: this branch dropped the options entirely. Now the flags
+    // are refused platform-wide, and the refusal has to fire here too — a
+    // refusal wired to one branch is the same defect wearing a different hat.
+    it('refuses --no-promote on the --source path, and never calls the SDK', async () => {
+        const { deploy } = await import('./container.js');
+        await run(() => deploy('c1', '', { source: './app', 'no-promote': true, org: ORG }));
+        expect(exitError).toMatch(/not honoured yet/);
+        expect(sdk.container.deployContainerSource).not.toHaveBeenCalled();
+        expect(sdk.container.deployContainer).not.toHaveBeenCalled();
+    });
+    it('refuses --smoke on the --source path', async () => {
+        const { deploy } = await import('./container.js');
+        await run(() => deploy('c1', '', { source: './app', smoke: 'GET / contains x', org: ORG }));
+        expect(exitError).toMatch(/not honoured yet/);
+        expect(sdk.container.deployContainerSource).not.toHaveBeenCalled();
+    });
+    it('refuses --no-promote on the image path', async () => {
+        const { deploy } = await import('./container.js');
+        await run(() => deploy('c1', 'img:v1', { 'no-promote': true, org: ORG }));
+        expect(exitError).toMatch(/not honoured yet/);
+        expect(sdk.container.deployContainer).not.toHaveBeenCalled();
+    });
+    // The refusal must not become a blanket block on deploying at all.
+    it('still deploys normally when neither flag is passed', async () => {
+        sdk.container.deployContainer.mockResolvedValue({
+            container_id: 'c1', revision_id: 'r1', url: 'https://x', status: 'active', scoped_api_key: 'k',
+        });
+        const { deploy } = await import('./container.js');
+        await run(() => deploy('c1', 'img:v1', { org: ORG }));
+        expect(exitError).toBeNull();
+        expect(sdk.container.deployContainer).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 'img:v1');
+    });
+});
+describe('crm pagination — --offset must reach the SDK', () => {
+    // Reported by a customer as returning page one forever. The API ignored it
+    // at the time; once fixed, the CLI had to actually send it, and only a
+    // handler-level test proves that.
+    beforeEach(() => {
+        sdk.crm.searchContacts.mockResolvedValue({ contacts: [], total: 0, has_more: false });
+        sdk.crm.searchCompanies.mockResolvedValue({ companies: [], total: 0, has_more: false });
+    });
+    it('passes --offset through on contacts list', async () => {
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('contacts', ['list'], { offset: 25, limit: 10, org: ORG }));
+        expect(sdk.crm.searchContacts).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ offset: 25, limit: 10 }));
+    });
+    it('passes --offset through on contacts search, alongside filters', async () => {
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('contacts', ['search'], { offset: 5, origin: 'webhook', org: ORG }));
+        expect(sdk.crm.searchContacts).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ offset: 5 }));
+    });
+    it('passes --offset through on companies', async () => {
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('companies', ['list'], { offset: 7, org: ORG }));
+        expect(sdk.crm.searchCompanies).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ offset: 7 }));
+    });
+    // The deprecated spelling must still reach the request, or the alias is a
+    // promise we are not keeping.
+    it('still honours the deprecated --source spelling for provenance', async () => {
+        const { run: crmRun } = await import('./crm/index.js');
+        await run(() => crmRun('contacts', ['search'], { source: 'goldfox', org: ORG }));
+        expect(sdk.crm.searchContacts).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: ['goldfox'] }));
+    });
+});
+describe('container logs — --scope must reach the SDK', () => {
+    it('sends scope=all when asked', async () => {
+        sdk.container.getContainerLogs.mockResolvedValue([]);
+        const { logs } = await import('./container.js');
+        await run(() => logs('c1', { scope: 'all', tail: 500, org: ORG }));
+        expect(sdk.container.getContainerLogs).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', 500, 'all');
+    });
+    it('sends no scope by default, rather than the string "container"', async () => {
+        sdk.container.getContainerLogs.mockResolvedValue([]);
+        const { logs } = await import('./container.js');
+        await run(() => logs('c1', { org: ORG }));
+        expect(sdk.container.getContainerLogs).toHaveBeenCalledWith('hq_live_test', ORG, 'c1', undefined, undefined);
+    });
+    it('refuses an invalid scope instead of passing it on', async () => {
+        const { logs } = await import('./container.js');
+        await run(() => logs('c1', { scope: 'everything', org: ORG }));
+        expect(exitError).toMatch(/Invalid --scope/);
+        expect(sdk.container.getContainerLogs).not.toHaveBeenCalled();
+    });
+});
+describe('container create — --health-check is validated before the call', () => {
+    it('refuses /healthz client-side and never calls the SDK', async () => {
+        const { create } = await import('./container.js');
+        await run(() => create('probe', { 'health-check': '/healthz', org: ORG }));
+        expect(exitError).toMatch(/intercepts \/healthz/);
+        expect(sdk.container.createContainer).not.toHaveBeenCalled();
+    });
+    it('refuses a path that is not a path', async () => {
+        const { create } = await import('./container.js');
+        await run(() => create('probe', { 'health-check': 'livez', org: ORG }));
+        expect(exitError).toMatch(/must be a path/);
+        expect(sdk.container.createContainer).not.toHaveBeenCalled();
+    });
+});
+// ── Wider coverage ──────────────────────────────────────────────────────────
+//
+// The cases above are the ones a customer found. These are the same class of
+// risk elsewhere: a flag that changes WHAT GETS WRITTEN, where losing it in
+// transit produces a wrong record rather than an error.
+//
+// Coverage is partial and worth stating: this file exercises 8 commands of the
+// 32 that take flags. It covers the ones where a dropped flag is silent and
+// consequential. `list`/`get` verbs are omitted deliberately — a dropped
+// filter there is visible in the output, which is a different and much
+// cheaper failure.
+describe('task create — flags that change the stored record', () => {
+    beforeEach(() => { sdk.task = { createTask: vi.fn().mockResolvedValue({ id: 't1' }), listTasks: vi.fn().mockResolvedValue([]) }; });
+    it('sends --dedup-key, which is what makes creation idempotent', async () => {
+        const { create } = await import('./task.js');
+        await run(() => create('do a thing', { 'dedup-key': 'evt-123', org: ORG }));
+        expect(sdk.task.createTask).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ dedupKey: 'evt-123' }));
+    });
+    it('sends --origin, and still honours the deprecated --source', async () => {
+        const { create } = await import('./task.js');
+        await run(() => create('x', { origin: 'agent', org: ORG }));
+        expect(sdk.task.createTask).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: 'agent' }));
+        vi.clearAllMocks();
+        await run(() => create('x', { source: 'legacy', org: ORG }));
+        expect(sdk.task.createTask).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: 'legacy' }));
+    });
+});
+describe('webhook create — the CRM ingest path must survive', () => {
+    beforeEach(() => { sdk.webhook = { createEndpoint: vi.fn().mockResolvedValue({ id: 'w1', url: 'u' }) }; });
+    // Losing this silently means submissions stop becoming contacts, with no
+    // error anywhere — the endpoint keeps accepting deliveries.
+    it('sends --crm-email-path', async () => {
+        const { create } = await import('./webhook.js');
+        await run(() => create('stripe', { 'crm-email-path': 'data.object.customer_email', org: ORG }));
+        const [, , , opts] = sdk.webhook.createEndpoint.mock.calls[0];
+        expect(opts).toMatchObject({ crm_email_path: 'data.object.customer_email' });
+    });
+    it('sends --forward-url', async () => {
+        const { create } = await import('./webhook.js');
+        await run(() => create('gh', { 'forward-url': 'https://example.com/hook', org: ORG }));
+        const [, , , opts] = sdk.webhook.createEndpoint.mock.calls[0];
+        expect(opts).toMatchObject({ forward_url: 'https://example.com/hook' });
+    });
+});
+describe('audience create — --from selects the dataset', () => {
+    beforeEach(() => { sdk.audience = { createAudience: vi.fn().mockResolvedValue({ id: 'a1', member_count: 0 }) }; });
+    // Picking the wrong dataset builds an audience of the wrong KIND of record.
+    // Nothing errors; the list is simply of companies when you wanted people.
+    it('sends --from', async () => {
+        const { run: audRun } = await import('./audience.js');
+        await run(() => audRun('create', ['my-list'], { from: 'company', filter: '{}', org: ORG }));
+        expect(sdk.audience.createAudience).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: 'company' }));
+    });
+    it('still honours the deprecated --source spelling', async () => {
+        const { run: audRun } = await import('./audience.js');
+        await run(() => audRun('create', ['my-list'], { source: 'people', filter: '{}', org: ORG }));
+        expect(sdk.audience.createAudience).toHaveBeenCalledWith('hq_live_test', ORG, expect.objectContaining({ source: 'people' }));
+    });
+});
+describe('git commit — authorship must not silently default', () => {
+    beforeEach(() => {
+        sdk.git = {
+            commit: vi.fn().mockResolvedValue({ sha: 'abc1234' }),
+            // The handler resolves the branch tip before committing; without this it
+            // refuses rather than guessing a base, which is the right behaviour and
+            // has to be satisfied to reach the call we are testing.
+            listRefs: vi.fn().mockResolvedValue({ branches: [{ name: 'main', sha: 'base123' }] }),
+        };
+    });
+    // Without these every agent-written commit is attributed to the key's
+    // account — wrong quietly rather than loudly.
+    it('sends --author-name and --author-email', async () => {
+        const { commit } = await import('./git.js');
+        await run(() => commit('repo', {
+            branch: 'main', message: 'm',
+            changes: '[{"path":"a.txt","content":"hi"}]',
+            'author-name': 'Ada', 'author-email': 'ada@example.com', org: ORG,
+        }));
+        expect(sdk.git.commit).toHaveBeenCalled();
+        const payload = sdk.git.commit.mock.calls[0][3];
+        expect(payload.author).toMatchObject({ name: 'Ada', email: 'ada@example.com' });
+    });
+    it('omits author entirely when neither flag is given', async () => {
+        const { commit } = await import('./git.js');
+        await run(() => commit('repo', {
+            branch: 'main', message: 'm', changes: '[{"path":"a.txt","content":"hi"}]', org: ORG,
+        }));
+        expect(sdk.git.commit.mock.calls[0][3].author).toBeUndefined();
+    });
+});

package/dist/commands/fn.js

@@ -54,7 +54,10 @@ function summarizeFn(f) {
         id: f.id,
         name: f.name,
         trigger: f.trigger_type === 'cron' ? `cron ${f.cron_schedule ?? '?'}` : 'http',
-        url: f.invocation_url || '(not deployed)',
+        // A cron function is never reachable over HTTP — its URL 404s. Printing
+        // one contradicted the docs more loudly than the docs denied it, and a
+        // user wrote a `fetch` handler for manual runs that could never fire.
+        url: f.trigger_type === 'cron' ? '— (cron: not HTTP-invocable)' : (f.invocation_url || '(not deployed)'),
         updated_at: f.updated_at,
     };
 }
@@ -128,7 +131,9 @@ export async function get(id, flags) {
     info(`ID:              ${fn.id}`);
     info(`Name:            ${fn.name}`);
     info(`Trigger:         ${fn.trigger_type}${fn.cron_schedule ? ` (${fn.cron_schedule})` : ''}`);
-    info(`Invocation URL:  ${fn.invocation_url || '(not deployed)'}`);
+    info(fn.trigger_type === 'cron'
+        ? 'Invocation URL:  — (cron functions are not reachable over HTTP)'
+        : `Invocation URL:  ${fn.invocation_url || '(not deployed)'}`);
     info(`Created:         ${fn.created_at}`);
     info(`Updated:         ${fn.updated_at}`);
 }

package/dist/commands/llm.d.ts

@@ -3,4 +3,5 @@ import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+export declare function _parseJsonObjectFlag(raw: unknown, flagName: string): Record<string, unknown> | undefined;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/llm.js

@@ -24,6 +24,9 @@ export const SCHEMA = {
     schema: 'string',
     style: 'string',
     kind: 'string',
+    facts: 'string',
+    directives: 'string',
+    // Deprecated alias for --facts; undocumented, removable next minor.
     context: 'string',
     prompt: 'string',
     tier: 'string',
@@ -103,21 +106,33 @@ function parseSchemaFlag(flags) {
         return null;
     }
 }
-function parseContextFlag(flags) {
-    if (typeof flags.context !== 'string' || !flags.context)
+// --facts is referent data quoted into the prompt as reference; --directives
+// are writer controls (tone, max_words, format). The platform split them
+// because they are trusted differently, and `--context` predated the split.
+export function _parseJsonObjectFlag(raw, flagName) {
+    if (typeof raw !== 'string' || !raw)
         return undefined;
     try {
-        const parsed = JSON.parse(flags.context);
-        if (typeof parsed === 'object' && parsed !== null)
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
             return parsed;
-        error('--context must be a JSON object');
+        }
+        error(`${flagName} must be a JSON object`);
         return undefined;
     }
     catch {
-        error('--context must be valid JSON');
+        error(`${flagName} must be valid JSON`);
         return undefined;
     }
 }
+function parseContextFlag(flags) {
+    // --facts wins; --context is the old spelling and still works.
+    return _parseJsonObjectFlag(flags.facts, '--facts')
+        ?? _parseJsonObjectFlag(flags.context, '--context');
+}
+function parseDirectivesFlag(flags) {
+    return _parseJsonObjectFlag(flags.directives, '--directives');
+}
 function tierFromFlag(flags) {
     if (typeof flags.tier !== 'string' || !flags.tier)
         return undefined;
@@ -269,7 +284,7 @@ async function summarize(inputArg, flags) {
 }
 async function draft(inputArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi llm draft --kind <what> [--prompt "<instructions>"] [--context <json>] ["<source text>"] [--tier <t>] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi llm draft --kind <what> [--prompt "<instructions>"] [--facts <json>] ["<source text>"] [--tier <t>] [--org <id>]');
     if (typeof flags.kind !== 'string' || !flags.kind) {
         error('Missing required flag: --kind <email|message|reply|...>');
         return;
@@ -281,12 +296,13 @@ async function draft(inputArg, flags) {
     const promptText = typeof flags.prompt === 'string' ? flags.prompt : '';
     const ctx = parseContextFlag(flags);
     if (!input.trim() && !promptText.trim() && (!ctx || Object.keys(ctx).length === 0)) {
-        error('draft needs at least one of: <source text> (arg or --file), --prompt, or --context.');
+        error('draft needs at least one of: <source text> (arg or --file), --prompt, or --facts.');
     }
     const res = await retryFunds(() => sdkLlm.draft(config.api_key, orgId, {
         input: input || undefined,
         kind,
-        context: ctx,
+        facts: ctx,
+        directives: parseDirectivesFlag(flags),
         prompt: promptText || undefined,
         tier: tierFromFlag(flags),
     }));

package/dist/commands/task.js

@@ -15,6 +15,12 @@ export const EXPOSES = [
     'POST /task/orgs/{org_id}/tasks/{id}/fail',
     'POST /task/orgs/{org_id}/tasks/{id}/resolve',
 ];
+// --source meant five different things across the CLI. Here it is --origin;
+// the old name still works and is undocumented. See crm/pagination.ts.
+function taskOrigin(flags) {
+    const v = flags.origin !== undefined ? flags.origin : flags.source;
+    return typeof v === 'string' ? v : undefined;
+}
 export const SCHEMA = {
     body: 'string',
     importance: 'string',
@@ -24,6 +30,8 @@ export const SCHEMA = {
     'depends-on': 'string',
     'dedup-key': 'string',
     'resolve-on': 'string',
+    origin: 'string',
+    // Deprecated alias for --origin; undocumented, removable next minor.
     source: 'string',
     status: 'string',
     limit: 'number',
@@ -106,7 +114,7 @@ export async function create(description, flags) {
         dependsOn: _splitList(flags['depends-on']),
         dedupKey: typeof flags['dedup-key'] === 'string' ? flags['dedup-key'] : undefined,
         resolveOn,
-        source: typeof flags.source === 'string' ? flags.source : undefined,
+        source: taskOrigin(flags),
     });
     if (flags.json) {
         printJson(t);
@@ -125,7 +133,7 @@ export async function list(flags) {
         tag: typeof flags.tag === 'string' ? flags.tag : undefined,
         importance: typeof flags.importance === 'string' ? flags.importance : undefined,
         assignee: typeof flags.assignee === 'string' ? flags.assignee : undefined,
-        source: typeof flags.source === 'string' ? flags.source : undefined,
+        source: taskOrigin(flags),
         limit: typeof flags.limit === 'number' ? flags.limit : undefined,
     });
     if (flags.json) {
@@ -235,8 +243,8 @@ export async function cancel(id, flags) {
 }
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
-    'create': 'myapi task create "<description>" [--body <md|@file>] [--importance <i>] [--due <rfc3339>] [--assignee <email>] [--tag <t,t>] [--depends-on <id,id>] [--dedup-key <k>] [--resolve-on <event[:field=value]>] [--source <s>] [--org <id>]',
-    'list': 'myapi task list [--status <s>] [--tag <t>] [--importance <i>] [--assignee <email>] [--source <s>] [--limit <n>] [--org <id>] [--json]',
+    'create': 'myapi task create "<description>" [--body <md|@file>] [--importance <i>] [--due <rfc3339>] [--assignee <email>] [--tag <t,t>] [--depends-on <id,id>] [--dedup-key <k>] [--resolve-on <event[:field=value]>] [--origin <s>] [--org <id>]',
+    'list': 'myapi task list [--status <s>] [--tag <t>] [--importance <i>] [--assignee <email>] [--origin <s>] [--limit <n>] [--org <id>] [--json]',
     'get': 'myapi task get <id> [--body] [--org <id>] [--json]\n\n--body additionally fetches the Markdown body tier (a separate read).',
     'claim': 'myapi task claim <id> [--lease <seconds>] [--worker <name>] [--org <id>]',
     'extend': 'myapi task extend <id> [--lease <seconds>] [--org <id>]',

package/dist/completion.js

@@ -29,7 +29,7 @@ export const COMMANDS = [
     'account', 'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
     'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image',
     'doctor', 'install-skills', 'keys', 'llm', 'login', 'org', 'payments', 'people', 'pixel',
-    'queue', 'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
+    'feedback', 'queue', 'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
     'workflow',
 ];
 // command → subcommands, for `myapi <command> <TAB>`. Mirrors each
@@ -61,6 +61,7 @@ export const SUBCOMMANDS = {
     payments: ['connect', 'status', 'charge', 'list', 'get', 'refund'],
     container: ['create', 'deploy', 'list', 'get', 'logs', 'domain', 'delete'],
     git: ['create', 'list', 'get', 'delete', 'refs', 'log', 'show', 'tree', 'blob', 'diff', 'commit', 'create-branch', 'delete-branch', 'tag', 'merge', 'repack'],
+    feedback: ['create', 'list', 'resolve', 'widget'],
     queue: ['create', 'list', 'get', 'delete', 'enqueue', 'jobs', 'job'],
     task: ['create', 'list', 'get', 'claim', 'extend', 'resolve', 'fail', 'cancel'],
     completion: ['install', 'uninstall'],

package/dist/exposes.test.js

@@ -42,6 +42,7 @@ const COMMAND_MODULES = [
     './commands/payments.js',
     './commands/container.js',
     './commands/git.js',
+    './commands/feedback.js',
     './commands/queue.js',
     './commands/task.js',
     './commands/doctor.js',

package/dist/index.js

@@ -41,6 +41,7 @@ import * as paymentsCmd from './commands/payments.js';
 import * as containerCmd from './commands/container.js';
 import * as gitCmd from './commands/git.js';
 import * as queueCmd from './commands/queue.js';
+import * as feedbackCmd from './commands/feedback.js';
 import * as taskCmd from './commands/task.js';
 import * as doctorCmd from './commands/doctor.js';
 import * as loginCmd from './commands/login.js';
@@ -85,6 +86,7 @@ const COMMAND_SCHEMAS = {
     people: peopleCmd.SCHEMA,
     pixel: pixelCmd.SCHEMA,
     queue: queueCmd.SCHEMA,
+    feedback: feedbackCmd.SCHEMA,
     status: statusCmd.SCHEMA,
     storage: storageCmd.SCHEMA,
     task: taskCmd.SCHEMA,
@@ -134,6 +136,7 @@ const COMBINED_SCHEMA = {
     ...containerCmd.SCHEMA,
     ...gitCmd.SCHEMA,
     ...queueCmd.SCHEMA,
+    ...feedbackCmd.SCHEMA,
     ...taskCmd.SCHEMA,
     ...doctorCmd.SCHEMA,
     ...loginCmd.SCHEMA,
@@ -258,6 +261,9 @@ async function main() {
             case 'queue':
                 await queueCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'feedback':
+                await feedbackCmd.run(subcommand, restArgs, flags);
+                break;
             case 'task':
                 await taskCmd.run(subcommand, restArgs, flags);
                 break;
@@ -463,6 +469,7 @@ Commands:
   doctor          Org-wide consistency check — funnels, webhooks, domains, containers
   domain          Manage domain configurations
   email           Manage mailboxes, send/read email, templates, and campaigns
+  feedback        Collect feedback from the people using what you built
   fn              Create and deploy functions on the edge runtime
   funnel          Manage websites (publish pages, custom domains, funnels)
   git             Hosted git repositories — repos, commits, branches, history

package/dist/skills/my-api-hq/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Auth, organizations, and billing hub. Start here to get an api_key and org_id — every other service depends on both.
 triggers: [api key, account, organization, org, billing, balance, topup, credits, setup, defaults, brand, sync brand, doctor, health check, is my org healthy]
-checksum: sha256-80bee1daf601eb33abc5d66b7f8053b20abec1c9c0ec07f26e86e26a2d3bdb78
+checksum: sha256-fab324491446026e1600ac531bfbb164c10d46a617e528e6886be74b7dbdb4b1
 ---
 
 # MyApiHQ
@@ -98,4 +98,28 @@ Each org gets a free preview subdomain (`*.makeautonomous.com`) usable before re
 - API keys have format `hq_live_...` and are sent as `Authorization: Bearer <key>`.
 - `org sync-brand` is async (scrapes the site, polls the job).
 
+## Minting a least-privilege API key
+
+A key's authority is inline and always a subset of the key that mints it, so
+you can hand work a key that cannot exceed its job:
+
+```bash
+myapi keys create --name ci --grant funnel:write,storage:read
+myapi keys create --name readonly --grant '*:read'          # read anything, write nothing
+myapi keys create --name billing-fn --org <id> --grant email --spend-cap 25
+```
+
+- `--grant <list>` — `slot:read` / `slot:write`; a bare slot means write, `*`
+  means all. **Omitting `--grant` mints an unrestricted key.**
+- `--org <id>` — lock it to one org. Omit for account-wide.
+- `--spend-cap <usd>` — hard ceiling; `0` means the key cannot spend at all.
+- `keys revoke-all --kind function|manual|account` narrows the kill switch.
+
+## Org profile fields
+
+`myapi org create <name>` also takes `--tagline`, `--description`,
+`--business-sector` and `--logo-url`. They populate the org's public profile
+and the funnel created alongside it, so setting them at create avoids editing
+two places later.
+
 Run `myapi --help` or `myapi <command> --help` for full flag reference.

package/dist/skills/my-audience-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Saved audiences = named Goldfox-filter snapshots over the people or company database. Build a target list once, name it, reuse it across campaigns, refresh to re-evaluate against current data. The persistence layer on top of my-people-api + my-company-api.
 triggers: [audience, segment, target list, saved filter, goldfox, lead list, abm list, refresh, members, prospect database]
-checksum: sha256-5d9a2731d587c476eff2955241001fecb8481bbc5e567f06b8e9e76a079eda92
+checksum: sha256-a2c7142e880932ac2aa53cdb29b8632ce2c4d5ef33c3f8b6df705f7e987ab6af
 ---
 
 # MyAudienceAPI
@@ -70,7 +70,7 @@ Allowed values:
 <!-- generated:start -->
 | Command | What it does |
 |---|---|
-| `myapi audience create <name> --source <people\|company> --filter '<json>' [--description <text>]` | Save a Goldfox filter as a named audience; returns id + initial member_count |
+| `myapi audience create <name> --from <people\|company> --filter '<json>' [--description <text>]` | Save a Goldfox filter as a named audience; returns id + initial member_count |
 | `myapi audience list` | List all audiences in the org |
 | `myapi audience get <id>` | Single audience (name, filter, member_count, timestamps) |
 | `myapi audience update <id> [--name <x>] [--description <y>] [--filter '<json>']` | Patch name/description/filter; member_count re-evaluates if filter changes |
@@ -84,7 +84,7 @@ Allowed values:
 ```bash
 # 1. Create the audience
 AID=$(myapi audience create "EU decision makers w/ corporate emails" \
-  --source people \
+  --from people \
   --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"]}' \
   --json | jq -r .id)
 
@@ -108,7 +108,7 @@ myapi audience delete $AID
 ```bash
 # Build with quality controls — definitive links + registered companies + careers signal
 AID=$(myapi audience create "EU growth-stage decision makers" \
-  --source people \
+  --from people \
   --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"],"min_link_confidence":0.9,"has_careers_page":true,"is_registered_entity":true}' \
   --json | jq -r .id)
 
@@ -123,7 +123,7 @@ myapi audience refresh $AID
 
 ```bash
 myapi audience create "EU growth-stage SaaS accounts" \
-  --source company \
+  --from company \
   --filter '{"country":["DE","FR","GB","NL"],"has_careers_page":true,"has_decision_maker":true,"is_registered_entity":true,"min_source_count":3}'
 ```
 <!-- llm:end -->

package/dist/skills/my-auth-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Add authentication to apps you build on MyAPI — a managed OIDC identity provider for your app's END USERS (à la Kinde/Auth0). One auth tenant per org; register OIDC clients; sign users in with managed Google or the hosted login page; verify RS256 tokens against the tenant JWKS.
 triggers: [auth, authentication, login, sign-in, oidc, oauth, jwt, jwks, sso, google sign-in, user accounts, identity provider, kinde, auth0, clerk]
-checksum: sha256-b5eca82bb59647677fdb5796778329160572598ac6914887768fd33529cdfe84
+checksum: sha256-5eeacc463d7323f85a330639b7073f735ccc80bddfb8217c9c15c56989b8a99a
 ---
 
 # MyAuthAPI
@@ -114,4 +114,11 @@ myapi auth client list
   `http://localhost…` for local dev).
 - `402 INSUFFICIENT_FUNDS` = empty wallet → `myapi billing topup <amount>` (or keep it funded automatically: `myapi billing auto-recharge set`). `402 SPEND_CAP_EXCEEDED` = you hit your account spend ceiling → raise it with `myapi billing spend-cap`.
 
+## Anonymous accounts
+
+`myapi account setup --anonymous` skips registration and creates an account
+with no email — for throwaway or machine-owned orgs. It cannot receive
+password resets or magic links, so attach a real identity before anything
+depends on it. `myapi status` shows `Type: anonymous`.
+
 **End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (verify the id_token for identity; the access token is a bearer credential for `<issuer>/userinfo`).

package/dist/skills/my-company-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Company database backed by the Goldfox crawl. Filter companies by Goldfox confidence tier, country/TLD consistency, behavioral page signals (has_careers_page, has_investors_page, has_shop_page, has_c_level, has_decision_maker), legal-entity status, headcount, and source-URL count. Account-based targeting and B2B firmographics.
 triggers: [companies, accounts, firmographics, abm, search, filter, goldfox, careers signal, investors, c-level, shop, b2b targeting]
-checksum: sha256-67dd4b65a9b0cc7acf7c1e4262bc66d2b58ff11ed227a24299924e0b620712f0
+checksum: sha256-4754de8a66bf13e7e2f2a23acc407ccec147e142abf8adc670ae7962ca860a74
 ---
 
 # MyCompanyAPI
@@ -90,7 +90,7 @@ myapi company get auroracloud.com --include-people 5
 ```bash
 # Save filter as audience (companies)
 AID=$(myapi audience create "EU growth-stage SaaS" \
-  --source company \
+  --from company \
   --filter '{"country":["DE","FR","GB","NL"],"has_careers_page":true,"has_decision_maker":true,"min_source_count":3}' \
   --json | jq -r .id)
 
@@ -105,6 +105,6 @@ myapi audience members $AID --limit 50 --json > accounts.json
 - `seniority`, `email_type`, and `min_link_confidence` are people-only — passing them on company search is silently ignored.
 - `include_people` only works on company search/get; people-source already embeds company by default.
 - `keyword` is a substring match on the company's **domain** — use `--keyword stripe` to find domains containing "stripe".
-- For a persistent account list, use `my-audience-api` with `--source company`.
+- For a persistent account list, use `my-audience-api` with `--from company`.
 
 Run `myapi company --help` for full flag reference.