@myapihq/cli 1.2.2 → 1.2.5

package/dist/sdk-function.test.js

@@ -0,0 +1,190 @@
+// SDK-level unit tests for the function module. Verifies request URL/body
+// shape, response parsing, and error envelopes against the Story 1 contract
+// shipped by myapi-hq/internal/routes/function/crud.go.
+//
+// Mocks global fetch — does NOT hit the network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { fn, MyApiError } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const FN_ID = '22222222-2222-4222-8222-222222222222';
+let fetchMock;
+function ok(data, status = 200) {
+    // Backend wraps everything in `{ success, data, meta }`. The SDK unwraps.
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status = 422) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('fn.createFunction', () => {
+    it('POSTs to /function/orgs/{org_id}/functions with the bearer auth + JSON body', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: ORG_ID, name: 'my-app-api', trigger_type: 'http', invocation_url: '', created_at: 't1', updated_at: 't1' },
+            scoped_api_key: 'myapi_live_scoped_xyz',
+            scoped_api_key_id: 'key_xyz',
+        }));
+        const result = await fn.createFunction(API_KEY, ORG_ID, { name: 'my-app-api', trigger_type: 'http' });
+        expect(fetchMock).toHaveBeenCalledOnce();
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        expect(init.headers['Content-Type']).toBe('application/json');
+        expect(JSON.parse(init.body)).toEqual({ name: 'my-app-api', trigger_type: 'http' });
+        expect(result.function.id).toBe(FN_ID);
+        expect(result.scoped_api_key).toBe('myapi_live_scoped_xyz');
+        expect(result.scoped_api_key_id).toBe('key_xyz');
+        // Invocation URL is empty in Story 1 — populated by Story 2.
+        expect(result.function.invocation_url).toBe('');
+    });
+    it('passes cron_schedule through when trigger_type=cron', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: ORG_ID, name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *', invocation_url: '', created_at: 't1', updated_at: 't1' },
+            scoped_api_key: 'myapi_live_scoped_xyz',
+            scoped_api_key_id: 'key_xyz',
+        }));
+        await fn.createFunction(API_KEY, ORG_ID, { name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *' });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *' });
+    });
+    it('encodes path params (defensive against : ? / # in org id)', async () => {
+        // UUIDs don't contain reserved chars in practice — but the SDK still
+        // encodes, so an alternate id with unsafe chars wouldn't break path
+        // routing.
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: 'org/with?weird#chars', name: 'x', trigger_type: 'http', invocation_url: '', created_at: 't', updated_at: 't' },
+            scoped_api_key: 'k', scoped_api_key_id: 'i',
+        }));
+        await fn.createFunction(API_KEY, 'org/with?weird#chars', { name: 'x' });
+        const [url] = fetchMock.mock.calls[0];
+        expect(url).toContain('/function/orgs/org%2Fwith%3Fweird%23chars/functions');
+    });
+    it('surfaces backend INVALID_NAME (422) as a typed MyApiError', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_NAME', 'name must match ^[a-z0-9][a-z0-9-]{0,49}$', 422));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'BAD NAME' }))
+            .rejects.toMatchObject({
+            name: 'MyApiError',
+            code: 'INVALID_NAME',
+            status: 422,
+        });
+    });
+    it('surfaces NAME_TAKEN (409) cleanly', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NAME_TAKEN', 'function name "x" is already used in this org', 409));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'NAME_TAKEN', status: 409 });
+    });
+    it('surfaces 401 (invalid api key)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('unauthorized', 'invalid api key', 401));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ status: 401 });
+    });
+    it('surfaces 403 SCOPE_FORBIDDEN when called with a slot_call-only key', async () => {
+        // 2026-05-15 enforcement: scoped api_keys with scopes=["slot_call"]
+        // can only call slot endpoints, not /hq/*, /admin/*, /internal/*.
+        // Note: /function/* IS a slot path, so SCOPE_FORBIDDEN shouldn't trigger
+        // here in practice — but the SDK must still surface it cleanly if it
+        // ever appears (e.g. for /hq/* mistakes).
+        fetchMock.mockResolvedValueOnce(fail('SCOPE_FORBIDDEN', 'this key cannot call /hq/* endpoints', 403));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'SCOPE_FORBIDDEN', status: 403 });
+    });
+    it('wraps non-JSON 5xx responses (HTML error pages) helpfully', async () => {
+        fetchMock.mockResolvedValueOnce(new Response('<html>502 Bad Gateway</html>', {
+            status: 502, headers: { 'content-type': 'text/html' },
+        }));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'invalid_json_response', status: 502 });
+    });
+});
+describe('fn.listFunctions', () => {
+    it('GETs /function/orgs/{org_id}/functions with bearer auth + no body', async () => {
+        fetchMock.mockResolvedValueOnce(ok([
+            { id: FN_ID, org_id: ORG_ID, name: 'a', trigger_type: 'http', invocation_url: '', created_at: 't', updated_at: 't' },
+        ]));
+        const fns = await fn.listFunctions(API_KEY, ORG_ID);
+        expect(fns).toHaveLength(1);
+        expect(fns[0].name).toBe('a');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions`);
+        expect(init.method).toBe('GET');
+        expect(init.body).toBeUndefined();
+    });
+    it('returns an empty array when org has no functions', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        expect(await fn.listFunctions(API_KEY, ORG_ID)).toEqual([]);
+    });
+});
+describe('fn.getFunction', () => {
+    it('GETs /function/orgs/{org_id}/functions/{id}', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: FN_ID, org_id: ORG_ID, name: 'a', trigger_type: 'http', invocation_url: '', created_at: 't', updated_at: 't' }));
+        const got = await fn.getFunction(API_KEY, ORG_ID, FN_ID);
+        expect(got.id).toBe(FN_ID);
+        const [url] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}`);
+    });
+    it('throws function_not_found on 404', async () => {
+        fetchMock.mockResolvedValueOnce(fail('function_not_found', 'not found', 404));
+        await expect(fn.getFunction(API_KEY, ORG_ID, FN_ID))
+            .rejects.toMatchObject({ code: 'function_not_found', status: 404 });
+    });
+});
+describe('fn.deleteFunction', () => {
+    it('DELETEs /function/orgs/{org_id}/functions/{id}', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        await fn.deleteFunction(API_KEY, ORG_ID, FN_ID);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}`);
+        expect(init.method).toBe('DELETE');
+    });
+});
+describe('fn.EXPOSES', () => {
+    it('matches the Story 1 contract — exactly 4 endpoints', () => {
+        expect(fn.EXPOSES).toEqual([
+            'POST /function/orgs/{org_id}/functions',
+            'GET /function/orgs/{org_id}/functions',
+            'GET /function/orgs/{org_id}/functions/{id}',
+            'DELETE /function/orgs/{org_id}/functions/{id}',
+        ]);
+    });
+    it('does NOT yet expose /logs or /env (Story 4/5 pending)', () => {
+        const flat = fn.EXPOSES.join(' ');
+        expect(flat).not.toContain('/logs');
+        expect(flat).not.toContain('/env');
+    });
+});
+// MyApiError is the universal error shape callers can `instanceof`-check or
+// switch on `.code`. Validate it surfaces the right fields from typed
+// (object) errors and raw-string errors alike.
+describe('MyApiError surfacing', () => {
+    it('preserves the body object on object-shaped errors (for CF_API_ERROR etc.)', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(JSON.stringify({
+            success: false,
+            error: { code: 'CF_API_ERROR', message: 'cf failed', cf_message: 'Forbidden zone', cf_status: 403 },
+            meta: {},
+        }), { status: 500, headers: { 'content-type': 'application/json' } }));
+        try {
+            await fn.createFunction(API_KEY, ORG_ID, { name: 'x' });
+            expect.fail('Should have thrown');
+        }
+        catch (e) {
+            expect(e).toBeInstanceOf(MyApiError);
+            const err = e;
+            expect(err.code).toBe('CF_API_ERROR');
+            expect(err.body?.cf_message).toBe('Forbidden zone');
+            expect(err.body?.cf_status).toBe(403);
+        }
+    });
+});

package/dist/sdk-funnel-name.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-funnel-name.test.js

@@ -0,0 +1,48 @@
+// 2026-05-15: POST /funnel/orgs/{org_id}/funnels now accepts optional
+// `name` (defaults server-side to the org's preview_subdomain). SDK
+// createFunnel was extended to forward { name } through.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { funnel } from '@myapihq/sdk';
+const API_KEY = 'myapi_test';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+let fetchMock;
+function ok(data) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn().mockResolvedValue(ok({
+        funnel: { id: 'f1', org_id: ORG_ID, name: 'my-app', created_at: 't', updated_at: 't' },
+        subdomain_url: 'https://my-app.makeautonomous.com',
+    }));
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => { vi.restoreAllMocks(); });
+describe('funnel.createFunnel — name (additive 2026-05-15)', () => {
+    it('omits name from body when not provided (back-compat — server picks preview_subdomain)', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID);
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({});
+    });
+    it('omits name when opts is provided but has no name', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID, {});
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({});
+    });
+    it('includes name when provided', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID, { name: 'my-app' });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ name: 'my-app' });
+    });
+    it('hits the right path and method', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID, { name: 'x' });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/funnel/orgs/${ORG_ID}/funnels`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+    });
+    it('returns the funnel with name populated', async () => {
+        const result = await funnel.createFunnel(API_KEY, ORG_ID, { name: 'my-app' });
+        expect(result.funnel.name).toBe('my-app');
+        expect(result.subdomain_url).toBe('https://my-app.makeautonomous.com');
+    });
+});

package/dist/sdk-webhook.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-webhook.test.js

@@ -0,0 +1,86 @@
+// 2026-05-15 additive changes for my-webhook-api:
+//   - POST /webhook/orgs/{org_id}/endpoints body now accepts forward_url.
+//   - PATCH /webhook/orgs/{org_id}/endpoints/{id} is a new endpoint.
+//
+// Both surfaced through the SDK (createEndpoint+forward_url, updateEndpoint).
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { webhook } from '@myapihq/sdk';
+const API_KEY = 'myapi_test';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const ENDPOINT_ID = '22222222-2222-4222-8222-222222222222';
+let fetchMock;
+function ok(data) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn().mockResolvedValue(ok({
+        id: ENDPOINT_ID, org_id: ORG_ID, name: 'x', slug: 'abc', url: 'https://webhook/in/abc',
+    }));
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('webhook.createEndpoint — forward_url (additive 2026-05-15)', () => {
+    it('omits forward_url by default (back-compat)', async () => {
+        await webhook.createEndpoint(API_KEY, ORG_ID, 'my-hook');
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ name: 'my-hook' });
+        expect(body).not.toHaveProperty('forward_url');
+    });
+    it('includes forward_url when passed', async () => {
+        await webhook.createEndpoint(API_KEY, ORG_ID, 'my-hook', {
+            forward_url: 'https://example.com/forward',
+        });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body.forward_url).toBe('https://example.com/forward');
+    });
+    it('allows explicit empty string for forward_url (clears it)', async () => {
+        await webhook.createEndpoint(API_KEY, ORG_ID, 'my-hook', { forward_url: '' });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toHaveProperty('forward_url', '');
+    });
+    it('combines forward_url with other options', async () => {
+        await webhook.createEndpoint(API_KEY, ORG_ID, 'my-hook', {
+            description: 'Stripe events',
+            crm_email_path: 'data.object.customer_email',
+            forward_url: 'https://example.com/forward',
+        });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({
+            name: 'my-hook',
+            description: 'Stripe events',
+            crm_email_path: 'data.object.customer_email',
+            forward_url: 'https://example.com/forward',
+        });
+    });
+});
+describe('webhook.updateEndpoint — PATCH (new 2026-05-15)', () => {
+    it('PATCHes /webhook/orgs/{org_id}/endpoints/{id}', async () => {
+        await webhook.updateEndpoint(API_KEY, ORG_ID, ENDPOINT_ID, { name: 'renamed' });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/webhook/orgs/${ORG_ID}/endpoints/${ENDPOINT_ID}`);
+        expect(init.method).toBe('PATCH');
+        expect(JSON.parse(init.body)).toEqual({ name: 'renamed' });
+    });
+    it('sends only the fields that were provided', async () => {
+        await webhook.updateEndpoint(API_KEY, ORG_ID, ENDPOINT_ID, {
+            forward_url: 'https://other.example.com/fwd',
+        });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({
+            forward_url: 'https://other.example.com/fwd',
+        });
+    });
+    it('preserves empty-string sentinel (explicit clear)', async () => {
+        await webhook.updateEndpoint(API_KEY, ORG_ID, ENDPOINT_ID, { forward_url: '' });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ forward_url: '' });
+    });
+});
+describe('webhook.EXPOSES — current contract', () => {
+    it('includes PATCH for endpoints (2026-05-15)', () => {
+        expect(webhook.EXPOSES).toContain('PATCH /webhook/orgs/{org_id}/endpoints/{endpoint_id}');
+    });
+});

package/dist/skills/my-domain-api/SKILL.md

@@ -59,6 +59,8 @@ Resolution at register time (highest wins): `--registrant-json` → per-field fl
 | `myapi domain records create <domain> --type T --name n --content c` | Create a record (priority required for MX) |
 | `myapi domain records update <domain> <id> [--content c] [...]` | Update a record (type cannot change) |
 | `myapi domain records delete <domain> <id> --yes` | Delete a record |
+| `myapi domain email-setup <domain> [--subdomain <label>]` | Opt in to MyAPI-managed email on a subdomain (default: `mail.<domain>`). Apex is never touched |
+| `myapi domain retry-provisioning <domain>` | Re-run provisioning when status=infra_error and error_detail.retryable=true |
 <!-- generated:end -->
 
 ## Examples
@@ -91,6 +93,14 @@ myapi domain records list example.com --type TXT
 myapi domain records delete example.com <bad-id> --yes
 myapi domain records create example.com --type TXT --name @ \
   --content 'v=spf1 include:_spf.google.com ~all'
+
+# Opt in to MyAPI email on a subdomain (apex Google Workspace stays untouched)
+myapi domain email-setup example.com                # → mail.example.com
+myapi domain email-setup example.com --subdomain=notifications
+
+# Recover from infra_error
+myapi domain status example.com                     # CLI prints the retry hint
+myapi domain retry-provisioning example.com
 ```
 
 Security levels: `essentially_off` · `low` · `medium` · `high` · `under_attack`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.2.2",
+  "version": "1.2.5",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -27,7 +27,7 @@
     "lint:changelog": "node ../../scripts/lint-changelog.js"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.2.2",
+    "@myapihq/sdk": "^1.2.5",
     "omelette": "^0.4.17"
   },
   "devDependencies": {