@myapihq/cli 1.2.2 → 1.2.5

package/dist/commands/domain.d.ts

@@ -11,6 +11,8 @@ export declare function list(flags: Flags): Promise<void>;
 export declare function assign(domainArg: string, flags: Flags): Promise<void>;
 export declare function unassign(domainArg: string, flags: Flags): Promise<void>;
 export declare function status(domainArg: string, flags: Flags): Promise<void>;
+export declare function emailSetup(domainArg: string, flags: Flags): Promise<void>;
+export declare function retryProvisioning(domainArg: string, flags: Flags): Promise<void>;
 export declare function settings(domainArg: string, flags: Flags): Promise<void>;
 export declare function updateSettings(domainArg: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/domain.js

@@ -14,6 +14,8 @@ export const EXPOSES = [
     'GET /domain/orgs/{org_id}/{domain}/settings',
     'POST /domain/orgs/{org_id}/{domain}/settings',
     'GET /domain/orgs/{org_id}/{domain}/status',
+    'POST /domain/orgs/{org_id}/{domain}/email-infra',
+    'POST /domain/orgs/{org_id}/{domain}/retry-provisioning',
 ];
 export const SCHEMA = {
     org: 'string',
@@ -46,6 +48,10 @@ export const SCHEMA = {
     priority: 'number',
     proxied: 'boolean',
     yes: 'boolean',
+    // Email-infra opt-in
+    subdomain: 'string',
+    // Assign: opt out of binding the www Worker route alongside apex.
+    'no-www': 'boolean',
 };
 export async function check(domainArg, flags) {
     const config = requireConfig();
@@ -155,11 +161,20 @@ function summarizeDomain(d) {
 }
 export async function assign(domainArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi domain assign <domain> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi domain assign <domain> [--no-www] [--org <id>]');
     if (!domainArg)
-        error('Missing required arguments.\nUsage: myapi domain assign <domain> [--org <id>]');
-    await sdkDomain.assignDomain(config.api_key, orgId, domainArg);
+        error('Missing required arguments.\nUsage: myapi domain assign <domain> [--no-www] [--org <id>]');
+    const includeWww = flags['no-www'] ? false : undefined; // omitted → backend default (true).
+    const res = await sdkDomain.assignDomain(config.api_key, orgId, domainArg, { includeWww });
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Assigned ${domainArg} to org ${orgId}`);
+    info(`  Worker routes bound: ${res.routes_bound.join('  and  ')}`);
+    if (res.include_www)
+        info(`  www.${domainArg} 301-redirects to https://${domainArg}/ (canonical apex)`);
+    info(`  Funnel will be live on https://${domainArg} once DNS propagates.`);
 }
 export async function unassign(domainArg, flags) {
     const config = requireConfig();
@@ -169,8 +184,10 @@ export async function unassign(domainArg, flags) {
     await sdkDomain.unassignDomain(config.api_key, orgId, domainArg);
     success(`Unassigned ${domainArg} from org ${orgId}`);
 }
-// Terminal states — stop polling under --watch.
-const TERMINAL_STATUSES = new Set(['active', 'failed', 'error', 'expired']);
+// Terminal states — stop polling under --watch. `infra_error` is included
+// because watching past it is pointless — the user has to act (retry or
+// contact support); a re-watch after retry is the natural next step.
+const TERMINAL_STATUSES = new Set(['active', 'failed', 'error', 'expired', 'infra_error']);
 export async function status(domainArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi domain status <domain> [--org <id>] [--watch]');
@@ -212,13 +229,63 @@ function renderStatus(res) {
     info(`Status:  ${res.status}`);
     if (res.expires_at)
         info(`Expires: ${formatDate(res.expires_at)}`);
+    if (res.dns_active !== undefined)
+        info(`DNS:     ${res.dns_active ? 'active' : 'pending'}`);
+    if (res.email_infra) {
+        const where = res.email_subdomain ? ` on ${res.email_subdomain}` : '';
+        info(`Email:   ${res.email_infra}${where}`);
+    }
     if (res.status === 'pending_ns_change') {
         info('Waiting for you to change nameservers at your current registrar. Each poll re-checks Cloudflare.');
     }
+    if (res.status === 'infra_error' && res.error_detail) {
+        info(`  Failed step:  ${res.error_detail.failed_step}`);
+        info(`  Message:      ${res.error_detail.message}`);
+        if (res.error_detail.attempt_count !== undefined) {
+            const last = res.error_detail.last_attempt_at ? `; last try ${res.error_detail.last_attempt_at}` : '';
+            info(`  Attempts:     ${res.error_detail.attempt_count}${last}`);
+        }
+        if (res.error_detail.retryable) {
+            info(`  → myapi domain retry-provisioning ${res.domain}`);
+        }
+        else {
+            info('  Not retryable — contact support.');
+        }
+    }
     if (res.status === 'active') {
         info('Note: if recently activated, the SSL certificate may still be provisioning — allow a few minutes before the site is reachable over HTTPS.');
     }
 }
+// ── Email infra opt-in + retry-provisioning ──────────────────────────────────
+export async function emailSetup(domainArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain email-setup <domain> [--subdomain <label>] [--org <id>]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain email-setup <domain> [--subdomain <label>] [--org <id>]');
+    const subdomain = typeof flags.subdomain === 'string' ? flags.subdomain : undefined;
+    const res = await sdkDomain.setupEmailInfra(config.api_key, orgId, domain, subdomain);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Email infra provisioning on ${res.email_subdomain} (state: ${res.email_infra})`);
+    if (res.next_step)
+        info(res.next_step);
+    info(`Track with: myapi domain status ${domain} --watch`);
+}
+export async function retryProvisioning(domainArg, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi domain retry-provisioning <domain> [--org <id>]');
+    const domain = requireDomain(domainArg, flags, config, 'myapi domain retry-provisioning <domain> [--org <id>]');
+    const res = await sdkDomain.retryProvisioning(config.api_key, orgId, domain);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Retry triggered for ${res.domain}`);
+    if (res.next_step)
+        info(res.next_step);
+    info(`Track with: myapi domain status ${domain} --watch`);
+}
 export async function settings(domainArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi domain settings <domain> [--org <id>]');
@@ -454,12 +521,20 @@ Charged against the org's billing balance — confirm with "myapi billing balanc
 before running.
 
 Track expiry afterward with: myapi domain status <domain>`,
-    'assign': `myapi domain assign <domain> [--org <id>]
+    'assign': `myapi domain assign <domain> [--no-www] [--org <id>]
 
-Assigns a registered domain to an org. Once assigned, your funnel is served at
-https://<domain> after DNS propagation completes.
+Assigns a registered or imported domain to an org. Backend binds Worker
+routes for both <domain>/* and www.<domain>/* by default; www returns a 301
+redirect to the apex (canonical URL). Once assigned, your funnel is served
+at https://<domain> after DNS propagation completes.
 
-To transfer to a different org: unassign first, then assign to the new org.`,
+  --no-www   Skip the www route binding. The www form will not resolve at the
+             edge unless you create your own DNS + Worker setup for it.
+
+WARNING: This is also the reassign path. If you previously assigned <domain>
+to a different org, re-running assign moves it. Pre-flight with:
+  myapi domain list --filter all
+to confirm the current binding before reassigning.`,
     'unassign': 'myapi domain unassign <domain> [--org <id>]',
     'status': `myapi domain status <domain> [--org <id>] [--watch] [--json]
 
@@ -472,6 +547,24 @@ To transfer to a different org: unassign first, then assign to the new org.`,
 Gets current edge/CDN settings (security level, browser check, cache).
 Use "myapi domain update-settings" to change them.`,
     'records': RECORDS_HELP,
+    'email-setup': `myapi domain email-setup <domain> [--subdomain <label>] [--org <id>]
+
+Opts in to MyAPI-managed outbound email on a subdomain of the domain.
+The apex is never touched — this is safe to run on a domain whose apex
+email is served by Google Workspace / Microsoft 365 / your existing provider.
+
+Defaults the subdomain to "mail" (i.e. mail.<domain>). Pass --subdomain to
+override (e.g. --subdomain=notifications for notifications.<domain>).
+
+Backend provisions an SES identity on <subdomain>.<domain> and writes
+DKIM / SPF / DMARC records to the CF zone. Track readiness via:
+  myapi domain status <domain> --watch`,
+    'retry-provisioning': `myapi domain retry-provisioning <domain> [--org <id>]
+
+Re-runs domain provisioning when status=infra_error and error_detail.retryable=true.
+The CLI surfaces the retry hint automatically when status renders infra_error.
+
+After triggering retry, poll: myapi domain status <domain> --watch`,
     'update-settings': `myapi domain update-settings <domain> [--security=<level>] [--browser-check=on|off] [--purge-cache] [--org <id>]
 
   --security=<level>       essentially_off | low | medium | high | under_attack  (default: medium)
@@ -497,6 +590,8 @@ Subcommands:
   settings         Get edge/CDN settings
   update-settings  Update edge/CDN settings
   records          Manage DNS records in the zone (list / get / create / update / delete)
+  email-setup      Opt in to MyAPI-managed email on a subdomain (default: mail.<domain>)
+  retry-provisioning  Re-run provisioning when status=infra_error and the failure is retryable
 
 Tip: Set defaults with "myapi config set-org <id>" / "set-domain <domain>" to skip flags on every command.`);
         return;
@@ -521,6 +616,8 @@ Tip: Set defaults with "myapi config set-org <id>" / "set-domain <domain>" to sk
         case 'settings': return settings(args[0], flags);
         case 'update-settings': return updateSettings(args[0], flags);
         case 'records': return recordsRun(args[0], args.slice(1), flags);
+        case 'email-setup': return emailSetup(args[0], flags);
+        case 'retry-provisioning': return retryProvisioning(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi domain --help" for a list of valid subcommands.`);
     }
 }

package/dist/commands/fn-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/fn-validation.test.js

@@ -0,0 +1,60 @@
+// Unit tests for fn.ts CLI's pure name validator. Mirrors the regex +
+// reserved set in myapi-hq/internal/routes/function/crud.go so client-side
+// rejection matches server-side rejection.
+import { describe, it, expect } from 'vitest';
+import { _validateName, NAME_RE, RESERVED_NAMES } from './fn.js';
+describe('_validateName — pure helper', () => {
+    describe('valid names', () => {
+        it.each([
+            'a', // single char ok
+            'a1', // letters + digits
+            'my-app', // hyphen ok
+            'my-app-api',
+            '0', // digit-leading
+            '0app',
+            'abcdefghijabcdefghijabcdefghijabcdefghijabcdefghij', // 50 chars (max)
+            'fn-2026-05-15',
+        ])('accepts %s', (name) => {
+            expect(_validateName(name)).toBeNull();
+        });
+    });
+    describe('regex rejections', () => {
+        it.each([
+            ['empty string', ''],
+            ['UPPERCASE', 'BAD'],
+            ['mixed case', 'badName'],
+            ['underscore', 'my_app'],
+            ['leading hyphen', '-app'],
+            ['trailing hyphen ok but disallowed length too long', 'a'.repeat(51)],
+            ['spaces', 'my app'],
+            ['period', 'my.app'],
+            ['unicode', 'mōji'],
+            ['slash', 'a/b'],
+        ])('rejects %s (%s)', (_label, name) => {
+            expect(_validateName(name)).toMatch(/Invalid --name/);
+        });
+    });
+    describe('reserved names', () => {
+        it.each([...RESERVED_NAMES])('rejects reserved name %s', (name) => {
+            const err = _validateName(name);
+            expect(err).toMatch(/is reserved/);
+        });
+        it('regex check runs before reserved check (a value matching neither passes)', () => {
+            // 'ADMIN' fails the regex (uppercase) — not the reserved check.
+            expect(_validateName('ADMIN')).toMatch(/Invalid --name/);
+        });
+    });
+    describe('NAME_RE alignment with backend', () => {
+        it('matches the backend regex exactly: ^[a-z0-9][a-z0-9-]{0,49}$', () => {
+            // String equality on the source so any future drift surfaces here.
+            expect(NAME_RE.source).toBe('^[a-z0-9][a-z0-9-]{0,49}$');
+        });
+    });
+    describe('RESERVED_NAMES alignment with backend', () => {
+        it('matches the backend reservedNames map', () => {
+            // Sorted for stable comparison against the backend's list in
+            // myapi-hq/internal/routes/function/crud.go:21-28.
+            expect([...RESERVED_NAMES].sort()).toEqual(['admin', 'api', 'default', 'system', 'www']);
+        });
+    });
+});

package/dist/commands/fn.d.ts

@@ -0,0 +1,13 @@
+import type { FlagSchema } from '../flags.js';
+import { type Flags } from '../helpers.js';
+import type { Exposes } from '../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare const SCHEMA: FlagSchema;
+export declare const NAME_RE: RegExp;
+export declare const RESERVED_NAMES: Set<string>;
+export declare function _validateName(name: string): string | null;
+export declare function create(flags: Flags): Promise<void>;
+export declare function list(flags: Flags): Promise<void>;
+export declare function get(id: string, flags: Flags): Promise<void>;
+export declare function del(id: string, flags: Flags): Promise<void>;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/fn.js

@@ -0,0 +1,180 @@
+import { fn as sdkFn } from '@myapihq/sdk';
+import { requireConfig } from '../config.js';
+import { success, error, printTable, info, printJson, banner } from '../output.js';
+import { requireOrg } from '../helpers.js';
+export const EXPOSES = [
+    'POST /function/orgs/{org_id}/functions',
+    'GET /function/orgs/{org_id}/functions',
+    'GET /function/orgs/{org_id}/functions/{id}',
+    'DELETE /function/orgs/{org_id}/functions/{id}',
+];
+export const SCHEMA = {
+    cron: 'string',
+};
+// Backend: Story 1. The function CRUD persists metadata + issues a scoped
+// API key, but does NOT yet upload a JS bundle to Cloudflare Workers (Story
+// 2). So this CLI surface is intentionally narrow — `create` registers a
+// function, not "deploy" — keeping verb honesty until bundle upload ships.
+// Mirrors validateName in myapi-hq/internal/routes/function/crud.go. We
+// pre-validate client-side so typos fail before the network call; backend
+// runs the same regex as defence in depth.
+//
+// Exported (alongside _validateNameOrThrow) so the unit test suite can hit
+// the regex and reserved list directly without spawning a subprocess.
+export const NAME_RE = /^[a-z0-9][a-z0-9-]{0,49}$/;
+export const RESERVED_NAMES = new Set(['www', 'api', 'admin', 'system', 'default']);
+// Returns an error message string on failure, or null on success. Pure —
+// no I/O, no process.exit. The caller in this file wraps it in `error()`
+// (which terminates); tests use the pure form.
+export function _validateName(name) {
+    if (!NAME_RE.test(name)) {
+        return `Invalid --name "${name}". Lowercase letters, digits, hyphens; 1-50 chars; starts with a letter or digit.`;
+    }
+    if (RESERVED_NAMES.has(name)) {
+        return `Name "${name}" is reserved. Pick a different one.`;
+    }
+    return null;
+}
+function validateName(name) {
+    const err = _validateName(name);
+    if (err)
+        error(err);
+}
+function summarizeFn(f) {
+    return {
+        id: f.id,
+        name: f.name,
+        trigger: f.trigger_type === 'cron' ? `cron ${f.cron_schedule ?? '?'}` : 'http',
+        url: f.invocation_url || '(pending Story 2)',
+        updated_at: f.updated_at,
+    };
+}
+export async function create(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn create --name <name> [--cron <expr>] [--org <id>]');
+    const name = flags.name;
+    if (!name) {
+        error('Missing --name.\nUsage: myapi fn create --name <name> [--cron <expr>] [--org <id>]\n\n→ Name is a kebab-case slug, 1-50 chars (e.g. "my-app-api").');
+    }
+    validateName(name);
+    const cron = flags.cron;
+    const payload = {
+        name,
+        trigger_type: cron ? 'cron' : 'http',
+    };
+    if (cron)
+        payload.cron_schedule = cron;
+    const result = await sdkFn.createFunction(config.api_key, orgId, payload);
+    success(`Function created: ${result.function.id}`);
+    info(`Name:            ${result.function.name}`);
+    info(`Trigger:         ${result.function.trigger_type}${result.function.cron_schedule ? ` (${result.function.cron_schedule})` : ''}`);
+    // The scoped key is returned ONCE — surface it prominently. It's used by
+    // the function runtime shim (Story 2) to call other slot endpoints
+    // without a baked-in auth token.
+    info('');
+    info(`Scoped API key (returned once — save it if you need it):`);
+    info(`  ${result.scoped_api_key}`);
+    info(`  (id: ${result.scoped_api_key_id}; scopes: slot_call; rejected at /hq/*, /admin/*, /internal/*)`);
+    // Story 2 hasn't landed yet — be explicit about what "create" produces today.
+    if (!result.function.invocation_url) {
+        info('');
+        banner('Note: bundle upload (Story 2) is not yet shipped — this function has no executable code. The metadata record + scoped key are persisted; the invocation URL will appear once Story 2 lands.');
+    }
+}
+export async function list(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn list [--org <id>]');
+    const fns = await sdkFn.listFunctions(config.api_key, orgId);
+    if (flags.json) {
+        printJson(fns);
+        return;
+    }
+    printTable(fns.map(summarizeFn), {
+        flags,
+        empty: 'No functions yet. Create one with: myapi fn create --name <name>',
+    });
+}
+export async function get(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn get <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi fn get <id>');
+    const fn = await sdkFn.getFunction(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(fn);
+        return;
+    }
+    info(`ID:              ${fn.id}`);
+    info(`Name:            ${fn.name}`);
+    info(`Trigger:         ${fn.trigger_type}${fn.cron_schedule ? ` (${fn.cron_schedule})` : ''}`);
+    info(`Invocation URL:  ${fn.invocation_url || '(pending Story 2)'}`);
+    info(`Created:         ${fn.created_at}`);
+    info(`Updated:         ${fn.updated_at}`);
+}
+export async function del(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn delete <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi fn delete <id>');
+    await sdkFn.deleteFunction(config.api_key, orgId, id);
+    success(`Deleted function ${id}`);
+}
+// ── Dispatcher ───────────────────────────────────────────────────────────────
+const SUBCOMMAND_USAGE = {
+    'create': `myapi fn create --name <name> [--cron <expr>] [--org <id>]
+
+Backend Story 1: persists a function record + issues a scoped API key.
+Bundle upload (Story 2) is NOT yet shipped — this command does not deploy
+JavaScript code today. When Story 2 lands, the CLI surface will grow to
+accept --bundle <file.js>.
+
+Triggers:
+  (default)         HTTP — function will receive a public invocation URL in Story 2.
+  --cron <expr>     Cron — function will run on the schedule (e.g. "0 8 * * *").
+
+Examples:
+  myapi fn create --name my-app-api
+  myapi fn create --name daily-report --cron "0 8 * * *"
+
+The response returns the scoped API key ONCE. Save it if you need to call
+other MyAPI slots from a script with the function's permissions (scopes=slot_call;
+rejected at /hq/*, /admin/*, /internal/*).`,
+    'list': 'myapi fn list [--org <id>] [--json]',
+    'get': 'myapi fn get <id> [--org <id>] [--json]',
+    'delete': 'myapi fn delete <id> [--org <id>]',
+};
+export async function run(subcommand, args, flags) {
+    if (!subcommand || (flags.help && !subcommand)) {
+        info(`Usage: myapi fn <subcommand>
+
+Create and manage functions on the MyAPI edge runtime.
+
+Backend status: Story 1 shipped (metadata + scoped API key). Story 2 (CF
+Workers upload, invocation URL, /logs, /env) lands soon. CLI verbs grow
+once Story 2 ships; today only "create" / "list" / "get" / "delete" work.
+
+Subcommands:
+  create               Register a function and get its scoped API key (returned once)
+  list                 List functions in your org
+  get <id>             Inspect a function
+  delete <id>          Soft-delete and revoke its scoped API key
+
+All commands accept --org <id> (or set default: myapi config set-org <id>).`);
+        return;
+    }
+    if (flags.help) {
+        const usage = SUBCOMMAND_USAGE[subcommand];
+        if (usage)
+            info(`Usage: ${usage}`);
+        else
+            info(`Unknown subcommand: ${subcommand}. Run "myapi fn --help" for the list.`);
+        return;
+    }
+    switch (subcommand) {
+        case 'create': return create(flags);
+        case 'list': return list(flags);
+        case 'get': return get(args[0], flags);
+        case 'delete': return del(args[0], flags);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi fn --help" for a list of valid subcommands.`);
+    }
+}

package/dist/commands/funnel.js

@@ -14,10 +14,18 @@ export const EXPOSES = [
     'GET /hq/orgs/{org_id}',
 ];
 export const SCHEMA = {
-    org: 'string',
     funnel: 'string',
     slug: 'string',
 };
+// Backend (2026-05-15): POST /funnels accepts an optional `name` (defaults
+// to the org's preview_subdomain for back-compat). Mirror the backend's
+// validation client-side so typos fail before the network call.
+const FUNNEL_NAME_RE = /^[a-z0-9][a-z0-9-]{0,49}$/;
+function validateFunnelName(name) {
+    if (!FUNNEL_NAME_RE.test(name)) {
+        error(`Invalid --name "${name}". Lowercase letters, digits, hyphens; 1-50 chars; starts with a letter or digit.`);
+    }
+}
 export async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi funnel list [--org <id>]');
@@ -39,9 +47,14 @@ export async function list(flags) {
 }
 export async function create(flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi funnel create [--org <id>]');
-    const result = await sdkFunnel.createFunnel(config.api_key, orgId);
+    const orgId = requireOrg(flags, config, 'myapi funnel create [--name <name>] [--org <id>]');
+    const name = flags.name;
+    if (name)
+        validateFunnelName(name);
+    const result = await sdkFunnel.createFunnel(config.api_key, orgId, name ? { name } : undefined);
     success(`Funnel created! ID: ${result.funnel.id}`);
+    if (result.funnel.name)
+        info(`Name:    ${result.funnel.name}`);
     if (result.domain_url)
         info(`Live: ${result.domain_url}`);
     else if (result.subdomain_url)
@@ -183,7 +196,7 @@ export async function verify(slug, flags) {
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     'list': 'myapi funnel list [--org <id>] [--json]',
-    'create': 'myapi funnel create [--org <id>]',
+    'create': 'myapi funnel create [--name <name>] [--org <id>]',
     'get': 'myapi funnel get <id> [--org <id>] [--json]',
     'delete': 'myapi funnel delete <id> [--org <id>]',
     'pages': 'myapi funnel pages [funnel_id] [--funnel <id>] [--org <id>] [--json]',
@@ -219,7 +232,7 @@ export async function run(subcommand, args, flags) {
 
 Subcommands:
   list       List funnels
-  create     Create a funnel
+  create     Create a funnel (optional --name; backend defaults to org's preview_subdomain)
   get <id>   Get funnel details
   delete     Delete a funnel
   push       Push a raw HTML page from stdin to a slug

package/dist/commands/webhook-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/webhook-validation.test.js

@@ -0,0 +1,35 @@
+// Unit tests for the webhook CLI's forward_url validator (2026-05-15).
+import { describe, it, expect } from 'vitest';
+import { _validateForwardUrl } from './webhook.js';
+describe('_validateForwardUrl', () => {
+    describe('accepts', () => {
+        it.each([
+            ['', 'empty string (means "unset")'],
+            ['https://example.com/forward', 'standard https'],
+            ['http://example.com/forward', 'http (non-TLS)'],
+            ['https://api.stripe.com', 'no path'],
+            ['https://example.com:8443/path?q=v#h', 'port, query, fragment'],
+        ])('accepts %s (%s)', (url) => {
+            expect(_validateForwardUrl(url)).toBeNull();
+        });
+    });
+    describe('rejects non-http(s) protocols', () => {
+        it.each([
+            ['ftp://example.com', 'ftp'],
+            ['javascript:alert(1)', 'javascript: scheme'],
+            ['file:///etc/passwd', 'file:'],
+            ['data:text/plain,foo', 'data:'],
+        ])('rejects %s (%s)', (url) => {
+            expect(_validateForwardUrl(url)).toMatch(/http:\/\/ or https:\/\//);
+        });
+    });
+    describe('rejects malformed URLs', () => {
+        it.each([
+            'not a url',
+            'http//missing-colon.example.com',
+            'just-some-text',
+        ])('rejects %s', (url) => {
+            expect(_validateForwardUrl(url)).toMatch(/not a valid URL/);
+        });
+    });
+});

package/dist/commands/webhook.d.ts

@@ -5,6 +5,8 @@ export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
 export declare function list(flags: Flags): Promise<void>;
 export declare function create(nameArg: string | undefined, flags: Flags): Promise<void>;
+export declare function update(id: string, flags: Flags): Promise<void>;
+export declare function _validateForwardUrl(url: string): string | null;
 export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function delivery(id: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;