@myapihq/cli 1.2.4 → 1.2.5

package/dist/commands/domain.js

@@ -50,6 +50,8 @@ export const SCHEMA = {
     yes: 'boolean',
     // Email-infra opt-in
     subdomain: 'string',
+    // Assign: opt out of binding the www Worker route alongside apex.
+    'no-www': 'boolean',
 };
 export async function check(domainArg, flags) {
     const config = requireConfig();
@@ -159,11 +161,20 @@ function summarizeDomain(d) {
 }
 export async function assign(domainArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi domain assign <domain> [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi domain assign <domain> [--no-www] [--org <id>]');
     if (!domainArg)
-        error('Missing required arguments.\nUsage: myapi domain assign <domain> [--org <id>]');
-    await sdkDomain.assignDomain(config.api_key, orgId, domainArg);
+        error('Missing required arguments.\nUsage: myapi domain assign <domain> [--no-www] [--org <id>]');
+    const includeWww = flags['no-www'] ? false : undefined; // omitted → backend default (true).
+    const res = await sdkDomain.assignDomain(config.api_key, orgId, domainArg, { includeWww });
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
     success(`Assigned ${domainArg} to org ${orgId}`);
+    info(`  Worker routes bound: ${res.routes_bound.join('  and  ')}`);
+    if (res.include_www)
+        info(`  www.${domainArg} 301-redirects to https://${domainArg}/ (canonical apex)`);
+    info(`  Funnel will be live on https://${domainArg} once DNS propagates.`);
 }
 export async function unassign(domainArg, flags) {
     const config = requireConfig();
@@ -510,12 +521,20 @@ Charged against the org's billing balance — confirm with "myapi billing balanc
 before running.
 
 Track expiry afterward with: myapi domain status <domain>`,
-    'assign': `myapi domain assign <domain> [--org <id>]
+    'assign': `myapi domain assign <domain> [--no-www] [--org <id>]
+
+Assigns a registered or imported domain to an org. Backend binds Worker
+routes for both <domain>/* and www.<domain>/* by default; www returns a 301
+redirect to the apex (canonical URL). Once assigned, your funnel is served
+at https://<domain> after DNS propagation completes.
 
-Assigns a registered domain to an org. Once assigned, your funnel is served at
-https://<domain> after DNS propagation completes.
+  --no-www   Skip the www route binding. The www form will not resolve at the
+             edge unless you create your own DNS + Worker setup for it.
 
-To transfer to a different org: unassign first, then assign to the new org.`,
+WARNING: This is also the reassign path. If you previously assigned <domain>
+to a different org, re-running assign moves it. Pre-flight with:
+  myapi domain list --filter all
+to confirm the current binding before reassigning.`,
     'unassign': 'myapi domain unassign <domain> [--org <id>]',
     'status': `myapi domain status <domain> [--org <id>] [--watch] [--json]
 

package/dist/commands/fn-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/fn-validation.test.js

@@ -0,0 +1,60 @@
+// Unit tests for fn.ts CLI's pure name validator. Mirrors the regex +
+// reserved set in myapi-hq/internal/routes/function/crud.go so client-side
+// rejection matches server-side rejection.
+import { describe, it, expect } from 'vitest';
+import { _validateName, NAME_RE, RESERVED_NAMES } from './fn.js';
+describe('_validateName — pure helper', () => {
+    describe('valid names', () => {
+        it.each([
+            'a', // single char ok
+            'a1', // letters + digits
+            'my-app', // hyphen ok
+            'my-app-api',
+            '0', // digit-leading
+            '0app',
+            'abcdefghijabcdefghijabcdefghijabcdefghijabcdefghij', // 50 chars (max)
+            'fn-2026-05-15',
+        ])('accepts %s', (name) => {
+            expect(_validateName(name)).toBeNull();
+        });
+    });
+    describe('regex rejections', () => {
+        it.each([
+            ['empty string', ''],
+            ['UPPERCASE', 'BAD'],
+            ['mixed case', 'badName'],
+            ['underscore', 'my_app'],
+            ['leading hyphen', '-app'],
+            ['trailing hyphen ok but disallowed length too long', 'a'.repeat(51)],
+            ['spaces', 'my app'],
+            ['period', 'my.app'],
+            ['unicode', 'mōji'],
+            ['slash', 'a/b'],
+        ])('rejects %s (%s)', (_label, name) => {
+            expect(_validateName(name)).toMatch(/Invalid --name/);
+        });
+    });
+    describe('reserved names', () => {
+        it.each([...RESERVED_NAMES])('rejects reserved name %s', (name) => {
+            const err = _validateName(name);
+            expect(err).toMatch(/is reserved/);
+        });
+        it('regex check runs before reserved check (a value matching neither passes)', () => {
+            // 'ADMIN' fails the regex (uppercase) — not the reserved check.
+            expect(_validateName('ADMIN')).toMatch(/Invalid --name/);
+        });
+    });
+    describe('NAME_RE alignment with backend', () => {
+        it('matches the backend regex exactly: ^[a-z0-9][a-z0-9-]{0,49}$', () => {
+            // String equality on the source so any future drift surfaces here.
+            expect(NAME_RE.source).toBe('^[a-z0-9][a-z0-9-]{0,49}$');
+        });
+    });
+    describe('RESERVED_NAMES alignment with backend', () => {
+        it('matches the backend reservedNames map', () => {
+            // Sorted for stable comparison against the backend's list in
+            // myapi-hq/internal/routes/function/crud.go:21-28.
+            expect([...RESERVED_NAMES].sort()).toEqual(['admin', 'api', 'default', 'system', 'www']);
+        });
+    });
+});

package/dist/commands/fn.d.ts

@@ -0,0 +1,13 @@
+import type { FlagSchema } from '../flags.js';
+import { type Flags } from '../helpers.js';
+import type { Exposes } from '../exposes.js';
+export declare const EXPOSES: Exposes;
+export declare const SCHEMA: FlagSchema;
+export declare const NAME_RE: RegExp;
+export declare const RESERVED_NAMES: Set<string>;
+export declare function _validateName(name: string): string | null;
+export declare function create(flags: Flags): Promise<void>;
+export declare function list(flags: Flags): Promise<void>;
+export declare function get(id: string, flags: Flags): Promise<void>;
+export declare function del(id: string, flags: Flags): Promise<void>;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/fn.js

@@ -0,0 +1,180 @@
+import { fn as sdkFn } from '@myapihq/sdk';
+import { requireConfig } from '../config.js';
+import { success, error, printTable, info, printJson, banner } from '../output.js';
+import { requireOrg } from '../helpers.js';
+export const EXPOSES = [
+    'POST /function/orgs/{org_id}/functions',
+    'GET /function/orgs/{org_id}/functions',
+    'GET /function/orgs/{org_id}/functions/{id}',
+    'DELETE /function/orgs/{org_id}/functions/{id}',
+];
+export const SCHEMA = {
+    cron: 'string',
+};
+// Backend: Story 1. The function CRUD persists metadata + issues a scoped
+// API key, but does NOT yet upload a JS bundle to Cloudflare Workers (Story
+// 2). So this CLI surface is intentionally narrow — `create` registers a
+// function, not "deploy" — keeping verb honesty until bundle upload ships.
+// Mirrors validateName in myapi-hq/internal/routes/function/crud.go. We
+// pre-validate client-side so typos fail before the network call; backend
+// runs the same regex as defence in depth.
+//
+// Exported (alongside _validateNameOrThrow) so the unit test suite can hit
+// the regex and reserved list directly without spawning a subprocess.
+export const NAME_RE = /^[a-z0-9][a-z0-9-]{0,49}$/;
+export const RESERVED_NAMES = new Set(['www', 'api', 'admin', 'system', 'default']);
+// Returns an error message string on failure, or null on success. Pure —
+// no I/O, no process.exit. The caller in this file wraps it in `error()`
+// (which terminates); tests use the pure form.
+export function _validateName(name) {
+    if (!NAME_RE.test(name)) {
+        return `Invalid --name "${name}". Lowercase letters, digits, hyphens; 1-50 chars; starts with a letter or digit.`;
+    }
+    if (RESERVED_NAMES.has(name)) {
+        return `Name "${name}" is reserved. Pick a different one.`;
+    }
+    return null;
+}
+function validateName(name) {
+    const err = _validateName(name);
+    if (err)
+        error(err);
+}
+function summarizeFn(f) {
+    return {
+        id: f.id,
+        name: f.name,
+        trigger: f.trigger_type === 'cron' ? `cron ${f.cron_schedule ?? '?'}` : 'http',
+        url: f.invocation_url || '(pending Story 2)',
+        updated_at: f.updated_at,
+    };
+}
+export async function create(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn create --name <name> [--cron <expr>] [--org <id>]');
+    const name = flags.name;
+    if (!name) {
+        error('Missing --name.\nUsage: myapi fn create --name <name> [--cron <expr>] [--org <id>]\n\n→ Name is a kebab-case slug, 1-50 chars (e.g. "my-app-api").');
+    }
+    validateName(name);
+    const cron = flags.cron;
+    const payload = {
+        name,
+        trigger_type: cron ? 'cron' : 'http',
+    };
+    if (cron)
+        payload.cron_schedule = cron;
+    const result = await sdkFn.createFunction(config.api_key, orgId, payload);
+    success(`Function created: ${result.function.id}`);
+    info(`Name:            ${result.function.name}`);
+    info(`Trigger:         ${result.function.trigger_type}${result.function.cron_schedule ? ` (${result.function.cron_schedule})` : ''}`);
+    // The scoped key is returned ONCE — surface it prominently. It's used by
+    // the function runtime shim (Story 2) to call other slot endpoints
+    // without a baked-in auth token.
+    info('');
+    info(`Scoped API key (returned once — save it if you need it):`);
+    info(`  ${result.scoped_api_key}`);
+    info(`  (id: ${result.scoped_api_key_id}; scopes: slot_call; rejected at /hq/*, /admin/*, /internal/*)`);
+    // Story 2 hasn't landed yet — be explicit about what "create" produces today.
+    if (!result.function.invocation_url) {
+        info('');
+        banner('Note: bundle upload (Story 2) is not yet shipped — this function has no executable code. The metadata record + scoped key are persisted; the invocation URL will appear once Story 2 lands.');
+    }
+}
+export async function list(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn list [--org <id>]');
+    const fns = await sdkFn.listFunctions(config.api_key, orgId);
+    if (flags.json) {
+        printJson(fns);
+        return;
+    }
+    printTable(fns.map(summarizeFn), {
+        flags,
+        empty: 'No functions yet. Create one with: myapi fn create --name <name>',
+    });
+}
+export async function get(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn get <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi fn get <id>');
+    const fn = await sdkFn.getFunction(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(fn);
+        return;
+    }
+    info(`ID:              ${fn.id}`);
+    info(`Name:            ${fn.name}`);
+    info(`Trigger:         ${fn.trigger_type}${fn.cron_schedule ? ` (${fn.cron_schedule})` : ''}`);
+    info(`Invocation URL:  ${fn.invocation_url || '(pending Story 2)'}`);
+    info(`Created:         ${fn.created_at}`);
+    info(`Updated:         ${fn.updated_at}`);
+}
+export async function del(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn delete <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi fn delete <id>');
+    await sdkFn.deleteFunction(config.api_key, orgId, id);
+    success(`Deleted function ${id}`);
+}
+// ── Dispatcher ───────────────────────────────────────────────────────────────
+const SUBCOMMAND_USAGE = {
+    'create': `myapi fn create --name <name> [--cron <expr>] [--org <id>]
+
+Backend Story 1: persists a function record + issues a scoped API key.
+Bundle upload (Story 2) is NOT yet shipped — this command does not deploy
+JavaScript code today. When Story 2 lands, the CLI surface will grow to
+accept --bundle <file.js>.
+
+Triggers:
+  (default)         HTTP — function will receive a public invocation URL in Story 2.
+  --cron <expr>     Cron — function will run on the schedule (e.g. "0 8 * * *").
+
+Examples:
+  myapi fn create --name my-app-api
+  myapi fn create --name daily-report --cron "0 8 * * *"
+
+The response returns the scoped API key ONCE. Save it if you need to call
+other MyAPI slots from a script with the function's permissions (scopes=slot_call;
+rejected at /hq/*, /admin/*, /internal/*).`,
+    'list': 'myapi fn list [--org <id>] [--json]',
+    'get': 'myapi fn get <id> [--org <id>] [--json]',
+    'delete': 'myapi fn delete <id> [--org <id>]',
+};
+export async function run(subcommand, args, flags) {
+    if (!subcommand || (flags.help && !subcommand)) {
+        info(`Usage: myapi fn <subcommand>
+
+Create and manage functions on the MyAPI edge runtime.
+
+Backend status: Story 1 shipped (metadata + scoped API key). Story 2 (CF
+Workers upload, invocation URL, /logs, /env) lands soon. CLI verbs grow
+once Story 2 ships; today only "create" / "list" / "get" / "delete" work.
+
+Subcommands:
+  create               Register a function and get its scoped API key (returned once)
+  list                 List functions in your org
+  get <id>             Inspect a function
+  delete <id>          Soft-delete and revoke its scoped API key
+
+All commands accept --org <id> (or set default: myapi config set-org <id>).`);
+        return;
+    }
+    if (flags.help) {
+        const usage = SUBCOMMAND_USAGE[subcommand];
+        if (usage)
+            info(`Usage: ${usage}`);
+        else
+            info(`Unknown subcommand: ${subcommand}. Run "myapi fn --help" for the list.`);
+        return;
+    }
+    switch (subcommand) {
+        case 'create': return create(flags);
+        case 'list': return list(flags);
+        case 'get': return get(args[0], flags);
+        case 'delete': return del(args[0], flags);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi fn --help" for a list of valid subcommands.`);
+    }
+}

package/dist/commands/funnel.js

@@ -14,10 +14,18 @@ export const EXPOSES = [
     'GET /hq/orgs/{org_id}',
 ];
 export const SCHEMA = {
-    org: 'string',
     funnel: 'string',
     slug: 'string',
 };
+// Backend (2026-05-15): POST /funnels accepts an optional `name` (defaults
+// to the org's preview_subdomain for back-compat). Mirror the backend's
+// validation client-side so typos fail before the network call.
+const FUNNEL_NAME_RE = /^[a-z0-9][a-z0-9-]{0,49}$/;
+function validateFunnelName(name) {
+    if (!FUNNEL_NAME_RE.test(name)) {
+        error(`Invalid --name "${name}". Lowercase letters, digits, hyphens; 1-50 chars; starts with a letter or digit.`);
+    }
+}
 export async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi funnel list [--org <id>]');
@@ -39,9 +47,14 @@ export async function list(flags) {
 }
 export async function create(flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi funnel create [--org <id>]');
-    const result = await sdkFunnel.createFunnel(config.api_key, orgId);
+    const orgId = requireOrg(flags, config, 'myapi funnel create [--name <name>] [--org <id>]');
+    const name = flags.name;
+    if (name)
+        validateFunnelName(name);
+    const result = await sdkFunnel.createFunnel(config.api_key, orgId, name ? { name } : undefined);
     success(`Funnel created! ID: ${result.funnel.id}`);
+    if (result.funnel.name)
+        info(`Name:    ${result.funnel.name}`);
     if (result.domain_url)
         info(`Live: ${result.domain_url}`);
     else if (result.subdomain_url)
@@ -183,7 +196,7 @@ export async function verify(slug, flags) {
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     'list': 'myapi funnel list [--org <id>] [--json]',
-    'create': 'myapi funnel create [--org <id>]',
+    'create': 'myapi funnel create [--name <name>] [--org <id>]',
     'get': 'myapi funnel get <id> [--org <id>] [--json]',
     'delete': 'myapi funnel delete <id> [--org <id>]',
     'pages': 'myapi funnel pages [funnel_id] [--funnel <id>] [--org <id>] [--json]',
@@ -219,7 +232,7 @@ export async function run(subcommand, args, flags) {
 
 Subcommands:
   list       List funnels
-  create     Create a funnel
+  create     Create a funnel (optional --name; backend defaults to org's preview_subdomain)
   get <id>   Get funnel details
   delete     Delete a funnel
   push       Push a raw HTML page from stdin to a slug

package/dist/commands/webhook-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/webhook-validation.test.js

@@ -0,0 +1,35 @@
+// Unit tests for the webhook CLI's forward_url validator (2026-05-15).
+import { describe, it, expect } from 'vitest';
+import { _validateForwardUrl } from './webhook.js';
+describe('_validateForwardUrl', () => {
+    describe('accepts', () => {
+        it.each([
+            ['', 'empty string (means "unset")'],
+            ['https://example.com/forward', 'standard https'],
+            ['http://example.com/forward', 'http (non-TLS)'],
+            ['https://api.stripe.com', 'no path'],
+            ['https://example.com:8443/path?q=v#h', 'port, query, fragment'],
+        ])('accepts %s (%s)', (url) => {
+            expect(_validateForwardUrl(url)).toBeNull();
+        });
+    });
+    describe('rejects non-http(s) protocols', () => {
+        it.each([
+            ['ftp://example.com', 'ftp'],
+            ['javascript:alert(1)', 'javascript: scheme'],
+            ['file:///etc/passwd', 'file:'],
+            ['data:text/plain,foo', 'data:'],
+        ])('rejects %s (%s)', (url) => {
+            expect(_validateForwardUrl(url)).toMatch(/http:\/\/ or https:\/\//);
+        });
+    });
+    describe('rejects malformed URLs', () => {
+        it.each([
+            'not a url',
+            'http//missing-colon.example.com',
+            'just-some-text',
+        ])('rejects %s', (url) => {
+            expect(_validateForwardUrl(url)).toMatch(/not a valid URL/);
+        });
+    });
+});

package/dist/commands/webhook.d.ts

@@ -5,6 +5,8 @@ export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
 export declare function list(flags: Flags): Promise<void>;
 export declare function create(nameArg: string | undefined, flags: Flags): Promise<void>;
+export declare function update(id: string, flags: Flags): Promise<void>;
+export declare function _validateForwardUrl(url: string): string | null;
 export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function delivery(id: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/webhook.js

@@ -5,6 +5,7 @@ import { requireOrg } from '../helpers.js';
 export const EXPOSES = [
     'POST /webhook/orgs/{org_id}/endpoints',
     'GET /webhook/orgs/{org_id}/endpoints',
+    'PATCH /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
     'DELETE /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
     'GET /webhook/orgs/{org_id}/deliveries/{delivery_id}',
 ];
@@ -13,6 +14,8 @@ export const SCHEMA = {
     name: 'string',
     description: 'string',
     'crm-email-path': 'string',
+    // 2026-05-15: backend's POST/PATCH endpoints accept forward_url.
+    'forward-url': 'string',
 };
 export async function list(flags) {
     const config = requireConfig();
@@ -29,21 +32,78 @@ export async function list(flags) {
 }
 export async function create(nameArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi webhook create <name> [--description <desc>] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi webhook create <name> [--description <desc>] [--crm-email-path <path>] [--forward-url <url>] [--org <id>]');
     const name = nameArg || flags.name;
     if (!name)
-        error('Missing required arguments.\nUsage: myapi webhook create <name> [--description <desc>] [--crm-email-path <path>] [--org <id>]\n   or: myapi webhook create --name <name> [...]');
+        error('Missing required arguments.\nUsage: myapi webhook create <name> [--description <desc>] [--crm-email-path <path>] [--forward-url <url>] [--org <id>]\n   or: myapi webhook create --name <name> [...]');
     const opts = {};
     if (typeof flags.description === 'string')
         opts.description = flags.description;
     if (typeof flags['crm-email-path'] === 'string')
         opts.crm_email_path = flags['crm-email-path'];
+    if (typeof flags['forward-url'] === 'string') {
+        validateForwardUrl(flags['forward-url']);
+        opts.forward_url = flags['forward-url'];
+    }
     const res = await sdkWebhook.createEndpoint(config.api_key, orgId, name, opts);
     if (flags.json) {
         printJson(res);
         return;
     }
     success(`Webhook created! ID: ${res.id}\nInbound URL: ${res.url}`);
+    if (opts.forward_url)
+        info(`Forwarding to: ${opts.forward_url}`);
+}
+export async function update(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi webhook update <id> [--name <name>] [--description <desc>] [--crm-email-path <path>] [--forward-url <url>] [--org <id>]');
+    if (!id)
+        error('Missing required arguments.\nUsage: myapi webhook update <id> [--name <name>] [--description <desc>] [--crm-email-path <path>] [--forward-url <url>]');
+    const payload = {};
+    if (typeof flags.name === 'string')
+        payload.name = flags.name;
+    if (typeof flags.description === 'string')
+        payload.description = flags.description;
+    // crm-email-path & forward-url accept "" (empty string) to explicitly
+    // disable. Don't coerce to undefined — that would mean "leave as-is".
+    if (typeof flags['crm-email-path'] === 'string')
+        payload.crm_email_path = flags['crm-email-path'];
+    if (typeof flags['forward-url'] === 'string') {
+        const fu = flags['forward-url'];
+        if (fu !== '')
+            validateForwardUrl(fu);
+        payload.forward_url = fu;
+    }
+    if (Object.keys(payload).length === 0) {
+        error('Nothing to update. Provide at least one of --name, --description, --crm-email-path, --forward-url.');
+    }
+    const res = await sdkWebhook.updateEndpoint(config.api_key, orgId, id, payload);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Webhook ${res.id} updated`);
+}
+// Exported for unit tests. Returns null on success, error message on failure.
+// Matches the backend's documented "Use http:// or https://" constraint.
+export function _validateForwardUrl(url) {
+    if (url === '')
+        return null; // empty = unset; valid
+    try {
+        const u = new URL(url);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+            return `--forward-url must use http:// or https:// (got ${u.protocol})`;
+        }
+        return null;
+    }
+    catch {
+        return `--forward-url is not a valid URL: "${url}"`;
+    }
+}
+function validateForwardUrl(url) {
+    const err = _validateForwardUrl(url);
+    if (err)
+        error(err);
 }
 export async function del(id, flags) {
     const config = requireConfig();
@@ -74,6 +134,14 @@ CRM auto-ingest (optional):
                                 Default 'email' (top-level). For Stripe:
                                 'data.object.customer_email'. For GitHub:
                                 'sender.email'. Empty string disables ingest.`,
+    'update': `myapi webhook update <id> [--name <name>] [--description <desc>] [--crm-email-path <path>] [--forward-url <url>] [--org <id>]
+
+All fields optional — only the ones you pass get changed. Pass an empty
+string to --crm-email-path or --forward-url to explicitly clear that
+field (e.g., --forward-url "" disables forwarding without deleting the
+endpoint).
+
+Slug is immutable; create a new endpoint if you need a different slug.`,
     'delete': 'myapi webhook delete <id> [--org <id>]',
     'delivery': 'myapi webhook delivery <delivery_id> [--org <id>]',
 };
@@ -84,6 +152,7 @@ export async function run(subcommand, args, flags) {
 Subcommands:
   list       List all inbound webhook endpoints
   create     Create a new endpoint to receive data (returns an inbound URL)
+  update     Patch endpoint name / description / crm-email-path / forward-url
   delete     Delete a webhook endpoint
   delivery   Inspect a specific webhook delivery (payload, received_at)
 
@@ -118,6 +187,7 @@ See the my-webhook-api skill for the full HTML + JS recipe.`);
     switch (subcommand) {
         case 'list': return list(flags);
         case 'create': return create(args[0], flags);
+        case 'update': return update(args[0], flags);
         case 'delete': return del(args[0], flags);
         case 'delivery': return delivery(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi webhook --help" for a list of valid subcommands.`);

package/dist/commands/workflow-validation.test.d.ts

@@ -0,0 +1 @@
+export {};