@myapihq/cli 2.7.1 → 2.8.0

package/dist/skills/my-container-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Run containers on demand — long-running services, background workers, and scheduled jobs. The heavier-duty sibling of edge functions, for native deps and long execution.
 triggers: [container, cloud run, dynamic app, custom domain app, service, worker, scheduled job, deploy container, docker image]
-checksum: sha256-3864bbb98fab89ba9e937c38bed072e22f33663ec7cbc23a43f24192275bcffd
+checksum: sha256-47eda6baa9055dadbd3e9d04df9fc425f1a7e96a9cd80c971c4951b97f1e94ff
 ---
 
 # MyContainerAPI
@@ -16,7 +16,11 @@ A container runs a pre-built image on managed cloud infrastructure. Three types:
 The lifecycle is **create → deploy → (optionally) bind a custom domain**.
 
 - `create` registers the container and issues a **scoped API key**, returned once. The running container receives it as the `MYAPI_KEY` env var, so your code calls other MyAPI slots with no token handling. Deploy rotates this key.
-- `deploy` ships a pre-built image reference to the runtime and makes the container live at a generated URL.
+- `deploy` takes **either** a pre-built image reference **or** a source
+  directory. `--source ./dir` tars the directory, builds it server-side
+  (typically ~4 minutes) and deploys the result — **no Docker on your machine,
+  no registry account, no image to push**. If you can write a Dockerfile you
+  can deploy; you do not need to be able to run one.
 - `domain` puts the container on a **custom domain** — how you serve a dynamic app at `app.yourbrand.com`.
 
 ### Deploying safely — NOT YET POSSIBLE ON THIS PLATFORM
@@ -74,10 +78,16 @@ Get it right:
 myapi container create --name api --type service --port 8080
 # → prints a scoped API key ONCE — save it if your code needs it
 
-# 2. Deploy. This takes 100% of traffic immediately — there is no staging
-#    step, so verify on a non-production container FIRST.
+# 2a. Deploy from source — MyAPI builds it. No local Docker required.
+#     Takes ~4 minutes; the CLI polls until it is live.
+myapi container deploy <id> --source ./my-app
+
+# 2b. Or ship an image you already built and pushed.
 myapi container deploy <id> registry.example.com/my-app:v1
 
+# Either way this takes 100% of traffic immediately — there is no staging
+# step, so verify on a non-production container FIRST.
+
 # 3. Check what you actually shipped. Assert on content: a build whose
 #    frontend never bundled still binds its port and returns 200.
 curl -s https://<your-domain>/ | grep -q 'assets/' || echo "BROKEN BUILD"
@@ -114,6 +124,13 @@ way that looks like an application bug.
   `create` and cannot be changed by `deploy`.** Passing them to `deploy` does
   nothing. Recreate the container to change them.
 
+### Keeping a service warm
+
+`--min-instances 1` at create stops a `service` scaling to zero, which removes
+cold starts at the cost of running continuously. Leave it at the default `0`
+unless latency on the first request actually matters — a scaled-to-zero
+service costs nothing while idle.
+
 ## Notes
 
 - The scoped API key is shown **once** at create, and again (rotated) on every deploy. Save it if your code needs it.
@@ -122,6 +139,10 @@ way that looks like an application bug.
   the same stream and share the `--tail` budget, so raise `--tail` with it.
 - Custom domains need a deployed container **and** a MyAPI-registered parent domain — see `my-domain-api`.
 - Containers are for dynamic apps and native deps. For static sites use `my-funnel-api`; for edge functions use `my-function-api`.
+- **`--source` does not honour `.dockerignore`.** It tars the directory as-is,
+  so a `node_modules` can push the context past the limit and fail as
+  `invalid_json_response`. Build the tarball yourself and pass
+  `--source ctx.tar.gz`, or keep the directory clean.
 
 Run `myapi container --help` for the full flag reference.
 

package/dist/skills/my-crm-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   The canonical store of engaged contacts + companies for an org. Auto-ingests from inbound webhooks via a configurable dot-path. Fixed lifecycle_stage enum (cold | warm | qualified | customer | churned). Append-only event timeline with reserved kinds. Soft delete + restore. Promote-from-Goldfox closes the discovery → engagement loop.
 triggers: [crm, contact, company, lead, engagement, pipeline, lifecycle, qualified, customer, webhook ingest, promote]
-checksum: sha256-50cbdd28ed2a901b7a75f1a6c1df1c225d256a8d281ad86cf1e3b42511edc2fe
+checksum: sha256-dfadb20670d9d978503549d330c2c9717fbe6d13ac35b53d9e1a8874d2136fde
 ---
 
 # MyCRMAPI
@@ -38,7 +38,7 @@ Move stage with `myapi crm contacts update <id> --stage qualified`. Every stage
 goldfox | email | pixel | webhook | manual
 ```
 
-Set automatically from how the contact entered. Filter with `--source manual` (added by hand) vs `--source goldfox` (from outreach).
+Set automatically from how the contact entered. Filter with `--origin manual` (added by hand) vs `--origin goldfox` (from outreach).
 
 ### Event timeline — reserved kinds
 
@@ -75,7 +75,7 @@ A contact promoted from Goldfox carries a `goldfox_person_id`. In v2 the GET res
 
 ### Search filter — re-engagement semantics
 
-`--max-last-engagement-days N` returns contacts last engaged *more than* N days ago, and intentionally **includes contacts with no engagement at all** (promoted-but-never-emailed Goldfox leads) — the natural targets of a re-engagement campaign. To separate "never tried" from "tried and went cold," layer `--source goldfox` or post-filter the JSON.
+`--max-last-engagement-days N` returns contacts last engaged *more than* N days ago, and intentionally **includes contacts with no engagement at all** (promoted-but-never-emailed Goldfox leads) — the natural targets of a re-engagement campaign. To separate "never tried" from "tried and went cold," layer `--origin goldfox` or post-filter the JSON.
 
 ### Failure modes
 
@@ -92,7 +92,7 @@ A contact promoted from Goldfox carries a `goldfox_person_id`. In v2 the GET res
 | Command | What it does |
 |---|---|
 | `myapi crm contacts list [--limit N] [--offset N]` | List all contacts (newest engagement first) |
-| `myapi crm contacts search [--stage ...] [--source ...] [--email ...] [--min/max-last-engagement-days N]` | Filter contacts |
+| `myapi crm contacts search [--stage ...] [--origin ...] [--email ...] [--min/max-last-engagement-days N]` | Filter contacts |
 | `myapi crm contacts create <email> [--first-name ...] [--last-name ...] [--stage ...] [--custom-json ...]` | Manually create (source='manual') |
 | `myapi crm contacts get <id>` | Fetch one contact (with embedded Goldfox enrichment when available) |
 | `myapi crm contacts update <id> [--stage ...] [...]` | Patch fields. Stage change emits `stage_changed` event |
@@ -138,7 +138,7 @@ myapi crm contacts update <id> --stage customer
 myapi crm contacts events <id>
 
 # What landed in CRM from this Stripe webhook?
-myapi crm contacts search --source webhook --json \
+myapi crm contacts search --origin webhook --json \
   | jq '.contacts[] | {email, last_engagement_at}'
 ```
 
@@ -151,7 +151,7 @@ URL=$(echo "$WH" | jq -r .url)
 echo "Point Stripe at: $URL"
 
 # Later, after Stripe fires...
-myapi crm contacts search --source webhook --email "$STRIPE_CUSTOMER_EMAIL"
+myapi crm contacts search --origin webhook --email "$STRIPE_CUSTOMER_EMAIL"
 myapi crm contacts events <id> --kind webhook_received
 ```
 <!-- llm:end -->

package/dist/skills/my-database-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Per-org KV store with named namespaces, JSON values up to 256 KB, prefix-scan listing, and compare-and-swap via etag. The substrate for any stateful agent-built app on MyAPI — user tables, session stores, idempotency keys, per-user lookup maps.
 triggers: [database, kv, key value, namespace, store, state, etag, cas, session, idempotency]
-checksum: sha256-f098cb574a1773135b09cbe79bb75eb33e34b1dc90737aa80da2452bb53e972e
+checksum: sha256-924071245c33bf3e43f085fbd756af003e19c990f4522f658de33f42504452d7
 ---
 
 # MyDatabaseAPI
@@ -104,6 +104,27 @@ myapi database get "by-email:$EMAIL" --ns users --json | jq -r .value
 - **Eventual `key_count`.** The `keys` field on a namespace is approximate; don't use it for strict pagination math.
 - **Free in v1.** Metered later if usage shows a need. Cost discipline still applies — store data, not blobs.
 
+
+## Calling this from deployed code (HTTP)
+
+The CLI is not what runs in production — a deployed function or container calls
+the HTTP API directly. That surface was previously only discoverable by
+grepping the CLI bundle, which cost one team an hour per slot.
+
+```
+base    https://api.myapihq.com
+path    /database/orgs/{org_id}/namespaces/{ns}/keys/{key}
+auth    Authorization: Bearer <api key>
+        (inside a function: env.__MYAPI_KEY · inside a container: env.MYAPI_KEY)
+body    writes take {"value": <json>} — the value is WRAPPED
+reply   { "success": true, "data": …, "error": null, "meta": {…} }
+        Unwrap `data`. On failure `success` is false and `error` is
+        { code, message }.
+```
+
+**The org id goes in the PATH, not a header.** There is no `X-Org-Id`.
+**Base URLs differ per slot** — do not assume one host for everything.
+
 Run `myapi database --help` for inline reference.
 
 **End-to-end example:** `examples/authenticated-app/` walks the full seam — hosted login → token verification → per-user KV record → deployed container — including the parts that cost real users hours (KV writes must be wrapped as `{"value": …}`).

package/dist/skills/my-domain-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Register new domains and manage edge settings. Required before a funnel can go live on a custom URL.
 triggers: [domain, register domain, dns, custom domain, edge, cdn, security level, browser check, renew, namecheap]
-checksum: sha256-8f96d19c11c3591af71e9d73b2cea6d83f40abbfa1c58c5674dbe15db02efa3c
+checksum: sha256-6a686b453528c69dcc791db409c04a514422951abf333c8feed7c614311815cb
 ---
 
 # MyDomainAPI
@@ -116,4 +116,21 @@ Set `essentially_off` + `browser-check=off` to allow AI crawlers and training bo
 - All commands default to `--org` from your saved config (set with `myapi config set-org <id>`).
 - `402 INSUFFICIENT_FUNDS` = empty wallet → `myapi billing topup <amount>` (or keep it funded automatically: `myapi billing auto-recharge set`). `402 SPEND_CAP_EXCEEDED` = you hit your account spend ceiling → raise it with `myapi billing spend-cap`.
 
+## DNS record flags
+
+```bash
+myapi domain records create <domain> --type A --name @ --content 1.2.3.4 --ttl 300
+myapi domain records create <domain> --type MX --name @ --content mx.x.com --priority 10
+myapi domain records create <domain> --type CNAME --name app --content x.com --proxied
+```
+
+- `--ttl <n>` — seconds; default `1` meaning "automatic". Explicit range 60–86400.
+- `--priority <n>` — MX only, and required for it (typical `10`).
+- `--proxied` — route through the edge proxy (A/AAAA/CNAME only). Off means
+  the record resolves straight to your origin, exposing its address.
+- `myapi domain assign <domain> --no-www` skips the `www` → apex redirect.
+- `--force` on assign re-points a domain already bound elsewhere. It is the
+  reassign path, so pass `--org` explicitly and check `domain list --filter all`
+  first.
+
 Run `myapi domain --help` or `myapi domain <subcommand> --help` for full flag reference.

package/dist/skills/my-email-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Send transactional and bulk email from your own domain. Create mailboxes, send/receive messages, generate AI templates, and manage warmup.
 triggers: [email, mailbox, send email, transactional email, template, warmup, inbox, outbox, ses, sender reputation]
-checksum: sha256-fa1eb6ee9e24935266643ceeecf7a748747b23377a0bfe256f76b71b62bd6349
+checksum: sha256-aa22381613affcff041a8d51d2acb2ba657fecefc97f4feba45958bcc11b2e06
 ---
 
 # MyEmailAPI
@@ -66,4 +66,39 @@ myapi email warmup stats --address hello@yourdomain.com
 - Sending is opt-in per mailbox. Newly-created mailboxes can receive but not send until `activate-sending` runs.
 - Templates are org-scoped. Set a default org once: `myapi config set-org <id>`.
 
+
+## Which name mail actually lives on
+
+Two things that read as contradictory and are not:
+
+- **Mailbox addresses are on the APEX** — `contact@yourdomain.com`, never
+  `contact@mail.yourdomain.com`. `mail.<domain>` is the *sending identity* that
+  `myapi domain email-setup` provisions, not a mailbox namespace. Creating a
+  mailbox on the subdomain fails with `DOMAIN_NOT_OWNED`.
+- **Registration and assign put `MX`, `SPF` and `DMARC` on the apex** whether or
+  not you run `email-setup`. So "apex is never touched" — which describes
+  `email-setup` specifically — is not true of the domain as a whole. If you plan
+  to run Google Workspace or another provider on the apex, check the existing
+  records first with `myapi domain records <domain>`.
+
+## Calling this from deployed code (HTTP)
+
+The CLI is not what runs in production — a deployed function or container calls
+the HTTP API directly. That surface was previously only discoverable by
+grepping the CLI bundle, which cost one team an hour per slot.
+
+```
+base    https://api.myemailapi.com   ← not the gateway
+path    /email/mailboxes   ·   /email/orgs/{org_id}/messages/send
+auth    Authorization: Bearer <api key>
+        (inside a function: env.__MYAPI_KEY · inside a container: env.MYAPI_KEY)
+body    application/json
+reply   { "success": true, "data": …, "error": null, "meta": {…} }
+        Unwrap `data`. On failure `success` is false and `error` is
+        { code, message }.
+```
+
+**The org id goes in the PATH, not a header.** There is no `X-Org-Id`.
+**Base URLs differ per slot** — do not assume one host for everything.
+
 Run `myapi email --help` or `myapi email <namespace> --help` for full flag reference.

package/dist/skills/my-function-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Deploy JavaScript functions to the MyAPI edge runtime. Register a function, upload a single-file JS bundle, get a live HTTP invocation URL or run it on a cron schedule. Each function gets a scoped capability key for cross-slot calls.
 triggers: [function, deploy function, edge function, serverless, cloudflare worker, cron, scoped api key, capability key, invocation url, bundle]
-checksum: sha256-08524ea08e91dcb6c8b68b64a7b4034d24a98a18968acd4ba80e45dbd6f85d09
+checksum: sha256-a29b3c96645c59317c0896c9a886d9904bdb2ebde9eb8582d0cb7071d0b9ac2c
 ---
 
 # MyFunctionAPI
@@ -78,9 +78,36 @@ myapi fn get fn_abc123
 myapi fn delete fn_abc123
 ```
 
+### The scoped API key is already in your function — as `__MYAPI_KEY`
+
+**Two leading underscores, and it is injected for you.** Verified by probing a
+deployed function: `Object.keys(env)` returns exactly `["__MYAPI_KEY"]`, and
+`MYAPI_KEY` (no underscores) is NOT present.
+
+```js
+export default {
+  async fetch(request, env) {
+    const r = await fetch('https://api.myapihq.com/database/orgs/<org>/namespaces/app/keys/x', {
+      headers: { Authorization: `Bearer ${env.__MYAPI_KEY}` },
+    });
+    return new Response(await r.text());
+  },
+};
+```
+
+**Do not capture the key printed at `fn create` and set it yourself.** Every
+`fn deploy` rotates it, so a manually-set copy goes stale on the next deploy
+and the function starts returning 502 with nothing in the deploy output to
+explain it. The injected `__MYAPI_KEY` is always current.
+
+Note the name differs from containers, which receive `MYAPI_KEY` without the
+underscores. Both verified 2026-07-28.
+
 ### Using the scoped API key
 
 ```bash
+# You do NOT need this — env.__MYAPI_KEY is injected and always current.
+# Shown only for calling the function's slots from OUTSIDE the function.
 # Save the API key returned at create/deploy time
 SCOPED_KEY="hq_live_..."
 
@@ -100,5 +127,12 @@ curl -H "Authorization: Bearer $SCOPED_KEY" \
 - The bundle is a **single JavaScript file** (≤4MB). Bundle your dependencies before deploy (esbuild/rollup/etc.).
 - `--cron` is set at create time; the trigger type is fixed for the function's lifetime.
 - Deploy rotates the scoped API key on every call — re-capture the printed value if other systems use it.
+- `myapi fn env <id> --set KEY=VALUE,OTHER=VALUE` sets several secrets in one call instead of one command each.
+
+**`--scope` is create-only, so treat it as permanent.** There is no
+`fn scope --add`. Adding a slot later means delete + recreate, which mints a
+**new function id and a new invocation URL**, breaking every reference already
+handed out — docs, front-end config, webhooks, anything given to a third
+party. Decide the full slot list before you publish the URL.
 
 Run `myapi fn --help` or `myapi fn <subcommand> --help` for full flag reference.

package/dist/skills/my-funnel-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Create and publish websites (funnels) to the edge. Push raw HTML to any slug and it goes live instantly on your org's domain or preview subdomain.
 triggers: [funnel, landing page, website, page, publish, push, slug, html, edge, preview subdomain, makeautonomous]
-checksum: sha256-3b463d6ac52fba7d44f89195b5704b02903ffdd9a677655f9c1bff0f13b25ab4
+checksum: sha256-849afbb7c2c60ea88c3476d50bf51289b77cedc819a0c2b69787075ff9c23b4b
 ---
 
 # MyFunnelAPI
@@ -33,7 +33,7 @@ Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and e
 | `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`). **Overwrites** an existing page — refused without `--force`. `--json` prints `{slug, subdomain_url, overwritten, org_id, funnel_id}` |
 | `myapi funnel publish <dir>` | Upload a whole directory as the funnel's site (`--env dev\|prod`, default prod; `--api-fn <id>`; `--json`). Prod refuses to replace a live site without `--force` |
 | `myapi funnel pages [funnel_id]` | List the pages currently published to a funnel |
-| `myapi funnel form [funnel_id]` | Emit canonical form HTML (and register a binding with `--capture-to`) |
+| `myapi funnel form [funnel_id]` | Emit canonical form HTML (`--capture-to`, `--cta`, `--success`, `--honeypot`) |
 | `myapi funnel verify [slug]` | Verify a published page is reachable + check links/webhooks |
 <!-- generated:end -->
 
@@ -83,7 +83,10 @@ Zero-config form (the happy path most agents want) — still pin the org + funne
 
 ```bash
 myapi funnel create --name acme-demo --org <org_id>
-myapi funnel form --slug join --fields email:required,name --funnel <funnel_id> > snippet.html
+myapi funnel form --slug join --fields email:required,name --funnel <funnel_id> \
+  --cta "Join" --success "Thanks — check your inbox." --honeypot company_url > snippet.html
+# --honeypot names a hidden field: bots fill it, humans never do, so a
+# submission carrying it is dropped.
 # paste snippet.html into your page (or pipe through funnel push):
 cat page-with-snippet.html | myapi funnel push / --funnel <funnel_id>
 # Submissions land in the funnel's auto-provisioned webhook → CRM upsert on `email` → any bound workflow fires.

package/dist/skills/my-git-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Hosted git repositories over HTTP. Create repos, read history (log/show/tree/blob/diff), and write atomically (commit/branch/tag/merge) — no clone needed. Real `git clone`/`push` also work over HTTPS with your API key as the password.
 triggers: [git, repo, repository, clone, push, commit, branch, tag, merge, diff, version control, source control, vcs]
-checksum: sha256-921cedea836edac33fefabfb46102e241d2618529db2e307cc73f4d910e7fee3
+checksum: sha256-417bafc3e56707f637937f98341d6200c8a9bb6ad5d0b13f84f7b6810e0340f5
 ---
 
 # MyGitAPI
@@ -119,4 +119,10 @@ surface never leaks which repos exist).
 - **Limits.** A push body is capped at 100 MiB; per-repo size limits apply (a push past the cap is reported as a receive-pack failure).
 - **Auth field.** git may put the API key in the username or password slot — both work. Embedding it in the URL (`https://x:$KEY@…`) avoids the interactive prompt but writes the API key into `.git/config`; use a credential helper for anything persistent.
 
+## Commit authorship
+
+`myapi git commit … --author-name "<n>" --author-email "<e>"` sets the commit
+author. Without them the commit is attributed to the API key's account, which
+makes every agent-written commit look like the same person.
+
 Run `myapi git --help` for the full flag reference.

package/dist/skills/my-llm-api/SKILL.md

@@ -7,7 +7,7 @@ description: >
   (classify / extract / summarize / draft) that hide the model behind a
   task. Pricing in cents per 1M tokens; charged from your MyAPI balance.
 triggers: [llm, completion, chat, embed, embedding, inference, classify, extract, summarize, draft, qwen]
-checksum: sha256-6c399da099802637c68eda61ba85a23286ff3dca8f50c391e80ab442777c17c4
+checksum: sha256-2a9070e118134aea98a1be986d29f9c4e3a969aa960e7dfc87137bbc490ac04e
 ---
 
 # MyLLMAPI
@@ -21,9 +21,9 @@ Pricing is cents per 1M tokens at the actual upstream rate, debited from your My
 
 ## Capabilities
 <!-- llm:start -->
-Use this for workflow tasks — summarize a doc, classify an inbound email, extract structured data, draft a reply. The reply goes to stdout; a one-line usage footer (tokens + cost + finish reason) goes to stderr, so `myapi llm complete ... | jq` and similar pipelines work as expected.
+For workflow tasks — summarize, classify, extract, draft. The reply goes to stdout and the usage footer (tokens, cost, finish reason) to stderr, so `myapi llm complete ... | jq` works.
 
-**Don't use this as your own model.** If you're an agent reading this, you already have a more capable model than what's exposed here. Reach for the LLM verbs when you're scripting a recurring step where a small/cheap model is the right tool — not for one-shot reasoning you can just do yourself.
+**Don't use this as your own model.** If you are an agent reading this, you already have a more capable model. Reach for the LLM verbs when scripting a recurring step where a small, cheap model is the right tool — not for one-shot reasoning you can do yourself.
 
 Reach for raw `complete` when shape matters (you build the `messages` array and set `max_tokens`/`temperature`/`stop`); reach for a verb when you want a *result* and don't care which model produced it.
 
@@ -88,7 +88,7 @@ The model/provider is **never** named in the verb response — the verb is the c
 
 ### OpenAI-compatible drop-in
 
-`POST /llm/orgs/{org_id}/chat/completions` (and `/v1/chat/completions` alias) accepts the OpenAI request shape and returns the OpenAI response shape — **no envelope**. Same catalog and pricing as raw `complete`. Use it when existing OpenAI SDK / LangChain / any `base_url`-configurable tooling should point at MyAPI without rewriting.
+`POST /llm/orgs/{org_id}/chat/completions` (alias `/v1/chat/completions`) takes and returns the OpenAI shape — **no envelope**. Same catalog and pricing as `complete`. Use it when an existing OpenAI SDK or LangChain integration should point at MyAPI unchanged.
 
 ```python
 from openai import OpenAI
@@ -160,3 +160,16 @@ INTENT=$(printf '%s' "$BODY" | myapi llm classify - \
 - **Self-hosted raw, server-picked verbs.** Raw runs on MyAPI's TPU; verbs route wherever the server picks.
 - **Cost + latency.** `usage.cost_cents` is authoritative — no markup. Varies by tier: 200–600 ms to first token, 1–3 s end-to-end.
 - **Live catalog, no streaming, no BYOK.** Don't hard-code ids — `models` is truth (CLI auto-picks if `--model` omitted). Full reply only.
+
+## `--facts` vs `--directives` on draft
+
+`--facts '<json>'` is referent data, quoted as reference and never as
+instructions (recipient, dates, amounts). `--directives '<json>'` is writer
+controls only: tone, max_words, format, style. They are trusted differently.
+
+```bash
+myapi llm draft --kind email --prompt "the invoice is due" \
+  --facts '{"to":"Ada"}' --directives '{"tone":"warm"}'
+```
+
+`--context` is the old name for `--facts`; accepted, deprecated upstream.

package/dist/skills/my-people-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Contact database backed by the Goldfox crawl. Filter people by Goldfox confidence tier, seniority, email type, country, link confidence, plus rich behavioral company signals (has_c_level, has_careers_page, has_decision_maker, etc.). The targeting layer for outbound campaigns.
 triggers: [people, contacts, leads, prospects, search, filter, goldfox, decision-makers, c-level, b2b targeting, corporate email]
-checksum: sha256-a4b594a30cc06d2f40fe26c594c1cb6962d91c4dbcc0625210d45a3faa27336e
+checksum: sha256-1eb93087638966eee65fb7a88fe37baaa27a01dd5d97c1ef17387b1a36300c0e
 ---
 
 # MyPeopleAPI
@@ -88,7 +88,7 @@ myapi people get p_MTdlc2llY2xlLmZy.0
 ```bash
 # Build the target audience (saved filter)
 AID=$(myapi audience create "EU decision makers w/ careers signal" \
-  --source people \
+  --from people \
   --filter '{"seniority":["c_level","vp_director"],"country":["DE","FR","GB"],"email_type":["corporate"],"has_careers_page":true}' \
   --json | jq -r .id)
 
@@ -100,7 +100,7 @@ myapi audience members $AID --limit 100 --json > targets.json
 ## Notes
 
 - The dataset is the Goldfox crawl — multi-million-row corporate contact data with provenance signals. Filter quality matters: defaults to `confidence=high` gives 96.4% of rows by count, but it's the curated tier; widening with `confidence=low` brings UGC rows that need spot-checking.
-- `seniority`, `email_type`, and `min_link_confidence` are people-only — silently ignored on `my-company-api` and on audiences with `--source company`.
+- `seniority`, `email_type`, and `min_link_confidence` are people-only — silently ignored on `my-company-api` and on audiences with `--from company`.
 - `keyword` matches the row's **domain**, not name/title. Use `--keyword acme` to find people whose domain contains "acme".
 - For a persistent target list, use `my-audience-api` (snapshot the filter; re-evaluate on `audience refresh`).
 

package/dist/skills/my-pixel-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Tracking pixel + identity resolution for MyAPI funnels and email. Capture visits and events, resolve known users to anonymous sessions, stream interaction events for analytics. Pairs with mycrmapi for auto-ingest of pixel_visit events on known contacts.
 triggers: [pixel, analytics, tracking, visit, event, identity, session, attribution, geo, open pixel]
-checksum: sha256-1e8284fbf546ad1bdff32790f56f8c524a19e0b80b92cc6d612ce15295632c9f
+checksum: sha256-562f081ef28c0dae01045a4135f9d073d69c50899145e75c6c97fe75b974cb15
 ---
 
 # MyPixelAPI
@@ -83,6 +83,17 @@ myapi pixel audience
 - **No write API for synthetic events** — the pixel records what the embedded JS/email-pixel observes. To inject custom timeline entries, use `myapi crm contacts/{id}/events` instead (when reserved-kind allows; today event writes are platform-only).
 - **`my-crm-api` is the durable record.** Pixel data ages out at ~90 days; CRM events are permanent. If a behavioral signal matters for long-term targeting, promote it into the CRM.
 
+## Linking a known identity
+
+`myapi pixel identify <pixel_id>` attaches a known identity to an anonymous
+visitor:
+
+- `--email <addr>` — the address to link.
+- `--external-id <id>` — your own user id, for joining back to your database.
+
+Pass either or both. After this, `pixel identity <pixel_id>` resolves the
+graph across the visitor's sessions.
+
 Run `myapi pixel --help` for inline reference.
 
 ## Status

package/dist/skills/my-storage-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Edge-hosted asset storage. Upload a local file of any content type directly, or have the server fetch from a public URL. Each asset gets a stable public CDN URL.
 triggers: [storage, upload, ingest, asset, cdn, image hosting, file upload, get-url, download, public url]
-checksum: sha256-b55e3f0aa592330cadfdc2b87e730333300bfffb08866b3bc59cb0ce15d2f953
+checksum: sha256-9172b0d8590a3102ce35b94ef48015ec36c624ab9bcc37fe0f7efa15bc54cf62
 ---
 
 # MyStorageAPI
@@ -89,8 +89,37 @@ Both produce identical asset records — `list` doesn't distinguish.
 
 ## Notes
 
-- Assets are public by default — don't store sensitive files.
+- **Assets are public, permanently, with no auth.** Anyone with the URL can
+  fetch it; there is no private mode, no signed URL, and no revocation. The id
+  being long and random is **not** access control — treat the URL as public the
+  moment it exists.
+- **For personal or regulated data, encrypt before upload.** Storage only ever
+  sees ciphertext. A team shipping Swiss lease documents (names, dates of
+  birth, permit type, IBAN) used AES-256-GCM envelope encryption with a
+  per-document data key wrapped under a master key held in function secrets.
+  That is the pattern to copy until private assets exist.
 - Delete is immediate and unrecoverable — run `myapi storage list` first to confirm the asset, pass `--org` explicitly, and pass `--yes` in non-interactive runs.
 - The URL is permanent until you `myapi storage delete <id>` — embed it freely.
 
+
+## Calling this from deployed code (HTTP)
+
+The CLI is not what runs in production — a deployed function or container calls
+the HTTP API directly. That surface was previously only discoverable by
+grepping the CLI bundle, which cost one team an hour per slot.
+
+```
+base    https://api.mystorageapi.com   ← not the gateway
+path    /storage/orgs/{org_id}/assets/upload   (multipart, field: file)
+auth    Authorization: Bearer <api key>
+        (inside a function: env.__MYAPI_KEY · inside a container: env.MYAPI_KEY)
+body    multipart/form-data
+reply   { "success": true, "data": …, "error": null, "meta": {…} }
+        Unwrap `data`. On failure `success` is false and `error` is
+        { code, message }.
+```
+
+**The org id goes in the PATH, not a header.** There is no `X-Org-Id`.
+**Base URLs differ per slot** — do not assume one host for everything.
+
 Run `myapi storage --help` for full flag reference.

package/dist/skills/my-task-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Agent-task queue — file units of work, rank them, claim under a lease, then resolve, fail, or cancel. The agent-loop hot path.
 triggers: [task, task queue, agent loop, work queue, claim task, resolve task, lease, backlog, to-do, assignee]
-checksum: sha256-ead9513eafbdd4d384a3cb297facf934f786f7067028c75cc08ef2ba1ac61cf7
+checksum: sha256-ceb6cdfffe465d8b0cd232eaa16868c1b8c8b10288f1cf9b4174fdd48a8d2c18
 ---
 
 # MyTaskAPI
@@ -71,4 +71,12 @@ myapi task create "Ship once payment clears" \
 - `resolve` unblocks dependents; `fail` cascades to dependents that can never proceed.
 - `resolve_on` matches platform events. Today few event kinds are emitted in production — verify the kind exists before relying on it.
 
+## Idempotency and provenance
+
+- `--dedup-key <k>` — creating a task with a key that already exists returns
+  the existing task instead of a duplicate. Use it whenever a task is created
+  from a retryable event, which for an agent is nearly always.
+- `--origin <s>` — records what created the task, and filters `task list`.
+  (Formerly `--source`, which still works and is undocumented.)
+
 Run `myapi task --help` for the full flag reference.

package/dist/skills/my-webhook-api/SKILL.md

@@ -4,7 +4,7 @@ version: 1.0.0
 description: >
   Inbound webhook endpoints for non-funnel sources — Stripe, GitHub, custom services. Funnel forms use the my-funnel-api proxy.
 triggers: [webhook, inbound, receiver, stripe events, github webhook, slack notification, delivery, payload, event ingest]
-checksum: sha256-82666c883230a775b07c8e1ec6243e812e58f246dd9a7cf1659aee77b877ee73
+checksum: sha256-17b358d780333cabe76cb01df3be3c3f11db10a2b068449bcf9e10e2ed89393d
 ---
 
 # MyWebhookAPI
@@ -97,4 +97,15 @@ The form sends `{name, email, message}` → webhook stores it → workflow runs
 - Failed workflow runs don't affect the delivery record — the inbound POST is always saved.
 - Inbound responses: `200` on success, `4xx` if the endpoint is missing or body isn't valid JSON.
 
+## Auto-ingest and forwarding
+
+- `--crm-email-path <dot-path>` — where to find the email in an incoming
+  payload, so submissions become CRM contacts automatically. Default `email`
+  (top level). Stripe: `data.object.customer_email`. GitHub: `sender.email`.
+  An empty string disables ingest for that endpoint.
+- `--forward-url <url>` — POST a copy of every delivery onward. The forward
+  status is recorded on the delivery, so a failing forward is visible in
+  `webhook deliveries` rather than silent.
+- `--description <text>` — free text, shown in `webhook list`.
+
 Run `myapi webhook --help` for full flag reference.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.7.1",
+  "version": "2.8.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -37,11 +37,16 @@
     "lint:request-fields": "node scripts/lint-request-fields.js",
     "audit:doctor": "npm run build && node scripts/audit-doctor.js",
     "lint:docs": "node scripts/lint-docs.js",
+    "lint:skill-coverage": "node scripts/lint-skill-coverage.js",
+    "bench:discoverability": "node scripts/bench-discoverability.js",
+    "lint:claims": "node scripts/verify-claims.js --lint",
+    "verify:claims": "npm run build && node scripts/verify-claims.js",
+    "audit:fields": "npm run build && node scripts/audit-field-honoured.js",
     "lint:skills": "node scripts/copy-skills.js && node scripts/lint-skills.js",
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.7.1"
+    "@myapihq/sdk": "^2.8.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",