@myapihq/cli 1.2.4 → 1.2.5

package/dist/commands/workflow-validation.test.js

@@ -0,0 +1,137 @@
+// Unit tests for workflow.ts CLI's pure step validator. The 2026-05-15
+// additive contract change adds `http_request` (alias `http`) to the
+// supported step types; this test file pins the new validation rules and
+// regression-tests the prior shapes.
+import { describe, it, expect } from 'vitest';
+import { _validateSteps } from './workflow.js';
+const VALID_EMAIL = { type: 'send_email', from: 'a@x.com', to: 'b@x.com', subject: 'hi', html: '<p>x</p>' };
+const VALID_SLACK = { type: 'slack_message', webhook_url: 'https://hooks.slack.com/services/T1/B1/abc', text: 'hi' };
+const VALID_HTTP = { type: 'http_request', url: 'https://example.com/hook' };
+describe('_validateSteps — input shape', () => {
+    it('rejects non-array', () => {
+        expect(_validateSteps('not an array')).toMatch(/must be a JSON array/);
+        expect(_validateSteps({})).toMatch(/must be a JSON array/);
+        expect(_validateSteps(null)).toMatch(/must be a JSON array/);
+    });
+    it('rejects empty array', () => {
+        expect(_validateSteps([])).toMatch(/cannot be an empty array/);
+    });
+    it('rejects steps that are not objects', () => {
+        expect(_validateSteps(['string'])).toMatch(/must be a JSON object/);
+        expect(_validateSteps([null])).toMatch(/must be a JSON object/);
+    });
+    it('rejects unknown step types', () => {
+        expect(_validateSteps([{ type: 'pigeon' }])).toMatch(/unknown type "pigeon"/);
+    });
+    it('rejects steps missing the type field', () => {
+        expect(_validateSteps([{ from: 'x' }])).toMatch(/missing required field "type"/);
+    });
+});
+describe('_validateSteps — send_email / email', () => {
+    it('accepts valid send_email with html body', () => {
+        expect(_validateSteps([VALID_EMAIL])).toBeNull();
+    });
+    it('accepts the `email` alias', () => {
+        expect(_validateSteps([{ ...VALID_EMAIL, type: 'email' }])).toBeNull();
+    });
+    it('rejects send_email missing required fields', () => {
+        expect(_validateSteps([{ type: 'send_email', from: 'a@x.com' }]))
+            .toMatch(/missing required field "to"/);
+    });
+    it('rejects send_email with no body form', () => {
+        expect(_validateSteps([{ type: 'send_email', from: 'a@x.com', to: 'b@x.com', subject: 's' }]))
+            .toMatch(/must include exactly one of "body", "html", or "template_id"/);
+    });
+    it('rejects send_email with multiple body forms', () => {
+        expect(_validateSteps([{ ...VALID_EMAIL, body: 'plain', html: '<p>x</p>' }]))
+            .toMatch(/can only use one of/);
+    });
+    it('rejects template_vars without template_id', () => {
+        expect(_validateSteps([{ ...VALID_EMAIL, template_vars: { name: 'x' } }]))
+            .toMatch(/"template_vars" only makes sense with "template_id"/);
+    });
+});
+describe('_validateSteps — slack_message / slack', () => {
+    it('accepts valid slack_message', () => {
+        expect(_validateSteps([VALID_SLACK])).toBeNull();
+    });
+    it('accepts the `slack` alias', () => {
+        expect(_validateSteps([{ ...VALID_SLACK, type: 'slack' }])).toBeNull();
+    });
+    it('rejects slack with non-Slack webhook URL', () => {
+        expect(_validateSteps([{ ...VALID_SLACK, webhook_url: 'https://example.com/hook' }]))
+            .toMatch(/must look like https:\/\/hooks\.slack\.com/);
+    });
+    it('rejects slack missing text', () => {
+        expect(_validateSteps([{ type: 'slack_message', webhook_url: VALID_SLACK.webhook_url }]))
+            .toMatch(/missing required field "text"/);
+    });
+});
+describe('_validateSteps — http_request / http (2026-05-15)', () => {
+    it('accepts the canonical type name', () => {
+        expect(_validateSteps([VALID_HTTP])).toBeNull();
+    });
+    it('accepts the `http` alias', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, type: 'http' }])).toBeNull();
+    });
+    it('accepts all supported HTTP methods', () => {
+        for (const m of ['GET', 'POST', 'PATCH', 'PUT', 'DELETE']) {
+            expect(_validateSteps([{ ...VALID_HTTP, method: m }])).toBeNull();
+        }
+    });
+    it('accepts a body string with templating', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, body: '{"email":"{{ payload.email }}"}' }])).toBeNull();
+    });
+    it('accepts a headers map of strings', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, headers: { 'X-Token': 'abc', 'X-Other': 'def' } }])).toBeNull();
+    });
+    it('rejects when url is missing', () => {
+        expect(_validateSteps([{ type: 'http_request' }]))
+            .toMatch(/missing required field "url"/);
+    });
+    it('rejects when url is not a string', () => {
+        expect(_validateSteps([{ type: 'http_request', url: 12345 }]))
+            .toMatch(/missing required field "url"/);
+    });
+    it('rejects non-http(s) URLs', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, url: 'ftp://example.com' }]))
+            .toMatch(/must start with http:\/\/ or https:\/\//);
+        expect(_validateSteps([{ ...VALID_HTTP, url: 'javascript:alert(1)' }]))
+            .toMatch(/must start with http:\/\/ or https:\/\//);
+    });
+    it('rejects unknown HTTP methods', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, method: 'TRACE' }]))
+            .toMatch(/"method" must be one of/);
+    });
+    it('rejects body as a non-string (object)', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, body: { not: 'a string' } }]))
+            .toMatch(/"body" must be a string/);
+    });
+    it('rejects headers as a non-object', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, headers: 'X-Token: abc' }]))
+            .toMatch(/"headers" must be a JSON object/);
+    });
+    it('rejects headers as an array', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, headers: ['X-Token: abc'] }]))
+            .toMatch(/"headers" must be a JSON object/);
+    });
+    it('rejects header value that is not a string', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, headers: { 'X-Token': 42 } }]))
+            .toMatch(/"headers" value for "X-Token" must be a string/);
+    });
+});
+describe('_validateSteps — mixed-type pipelines', () => {
+    it('accepts an http_request after a send_email (pipeline shape)', () => {
+        expect(_validateSteps([
+            VALID_EMAIL,
+            { ...VALID_HTTP, body: '{"sent_to":"{{ payload.email }}"}' },
+        ])).toBeNull();
+    });
+    it('reports the failing step index in the error message', () => {
+        expect(_validateSteps([
+            VALID_EMAIL,
+            VALID_SLACK,
+            { type: 'http_request' }, // missing url at index 2
+        ])).toMatch(/^step 2 \(http_request\):/);
+    });
+});

package/dist/commands/workflow.d.ts

@@ -3,6 +3,7 @@ import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+export declare function _validateSteps(steps: unknown): string | null;
 export declare function list(flags: Flags): Promise<void>;
 export declare function get(id: string, flags: Flags): Promise<void>;
 export declare function create(nameArg: string | undefined, flags: Flags): Promise<void>;

package/dist/commands/workflow.js

@@ -23,59 +23,100 @@ export const SCHEMA = {
 // Mirrors the backend's SupportedStepTypes list. Both alias and underscore
 // forms are accepted by the workflow runner. Keep this in sync if the
 // backend grows new step types.
-const SUPPORTED_STEP_TYPES = ['send_email', 'email', 'slack_message', 'slack'];
+//
+// 2026-05-15: backend added `http_request` (alias `http`). See
+// myapi-hq/internal/routes/workflow/execute.go.
+const SUPPORTED_STEP_TYPES = ['send_email', 'email', 'slack_message', 'slack', 'http_request', 'http'];
+const HTTP_METHODS = new Set(['GET', 'POST', 'PATCH', 'PUT', 'DELETE']);
 const SLACK_HOOK_RE = /^https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+/;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 // Per-step-type required fields. Validated client-side so typos and
 // hallucinated shapes fail fast, before the network call. Backend
 // performs the same validation as defense in depth.
-function validateSteps(steps) {
+//
+// `_validateSteps` is the pure form — returns the first error message
+// (string) or null on success. Suitable for unit tests. The internal
+// `validateSteps` wrapper calls `error()` on a non-null result, which
+// exits the process — used by command handlers.
+export function _validateSteps(steps) {
     if (!Array.isArray(steps))
-        error('--steps must be a JSON array of step objects.');
+        return '--steps must be a JSON array of step objects.';
     if (steps.length === 0)
-        error('--steps cannot be an empty array.');
-    steps.forEach((s, i) => {
+        return '--steps cannot be an empty array.';
+    for (let i = 0; i < steps.length; i++) {
+        const s = steps[i];
         const where = `step ${i}`;
         if (!s || typeof s !== 'object')
-            error(`${where}: must be a JSON object.`);
+            return `${where}: must be a JSON object.`;
         if (!s.type)
-            error(`${where}: missing required field "type". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`);
+            return `${where}: missing required field "type". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`;
         if (!SUPPORTED_STEP_TYPES.includes(s.type)) {
-            error(`${where}: unknown type "${s.type}". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`);
+            return `${where}: unknown type "${s.type}". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`;
         }
         if (s.type === 'send_email' || s.type === 'email') {
             const required = ['from', 'to', 'subject'];
             for (const f of required) {
                 if (!s[f] || typeof s[f] !== 'string') {
-                    error(`${where} (${s.type}): missing required field "${f}".`);
+                    return `${where} (${s.type}): missing required field "${f}".`;
                 }
             }
             const bodyForms = ['body', 'html', 'template_id'].filter(f => s[f] !== undefined && s[f] !== '');
             if (bodyForms.length === 0) {
-                error(`${where} (${s.type}): must include exactly one of "body", "html", or "template_id".`);
+                return `${where} (${s.type}): must include exactly one of "body", "html", or "template_id".`;
             }
             if (bodyForms.length > 1) {
-                error(`${where} (${s.type}): can only use one of "body", "html", "template_id" — got: ${bodyForms.join(', ')}.`);
+                return `${where} (${s.type}): can only use one of "body", "html", "template_id" — got: ${bodyForms.join(', ')}.`;
             }
             if (s.template_vars !== undefined && !s.template_id) {
-                error(`${where} (${s.type}): "template_vars" only makes sense with "template_id".`);
+                return `${where} (${s.type}): "template_vars" only makes sense with "template_id".`;
             }
             if (s.template_vars !== undefined && (typeof s.template_vars !== 'object' || Array.isArray(s.template_vars))) {
-                error(`${where} (${s.type}): "template_vars" must be a JSON object.`);
+                return `${where} (${s.type}): "template_vars" must be a JSON object.`;
             }
         }
         if (s.type === 'slack_message' || s.type === 'slack') {
             if (!s.webhook_url || typeof s.webhook_url !== 'string') {
-                error(`${where} (${s.type}): missing required field "webhook_url".`);
+                return `${where} (${s.type}): missing required field "webhook_url".`;
             }
             if (!SLACK_HOOK_RE.test(s.webhook_url)) {
-                error(`${where} (${s.type}): "webhook_url" must look like https://hooks.slack.com/services/T.../B.../xxx — got "${s.webhook_url}".`);
+                return `${where} (${s.type}): "webhook_url" must look like https://hooks.slack.com/services/T.../B.../xxx — got "${s.webhook_url}".`;
             }
             if (!s.text || typeof s.text !== 'string') {
-                error(`${where} (${s.type}): missing required field "text".`);
+                return `${where} (${s.type}): missing required field "text".`;
             }
         }
-    });
+        if (s.type === 'http_request' || s.type === 'http') {
+            if (!s.url || typeof s.url !== 'string') {
+                return `${where} (${s.type}): missing required field "url".`;
+            }
+            if (!/^https?:\/\//.test(s.url)) {
+                return `${where} (${s.type}): "url" must start with http:// or https:// — got "${s.url}".`;
+            }
+            if (s.method !== undefined) {
+                if (typeof s.method !== 'string' || !HTTP_METHODS.has(s.method.toUpperCase())) {
+                    return `${where} (${s.type}): "method" must be one of ${[...HTTP_METHODS].join(', ')}.`;
+                }
+            }
+            if (s.body !== undefined && typeof s.body !== 'string') {
+                return `${where} (${s.type}): "body" must be a string (template substitutions supported).`;
+            }
+            if (s.headers !== undefined) {
+                if (typeof s.headers !== 'object' || Array.isArray(s.headers)) {
+                    return `${where} (${s.type}): "headers" must be a JSON object of {string: string}.`;
+                }
+                for (const [k, v] of Object.entries(s.headers)) {
+                    if (typeof v !== 'string')
+                        return `${where} (${s.type}): "headers" value for "${k}" must be a string.`;
+                }
+            }
+        }
+    }
+    return null;
+}
+function validateSteps(steps) {
+    const err = _validateSteps(steps);
+    if (err)
+        error(err);
 }
 function summarizeWorkflow(w) {
     return {

package/dist/exposes.test.js

@@ -37,6 +37,7 @@ const COMMAND_MODULES = [
     './commands/url.js',
     './commands/webhook.js',
     './commands/workflow.js',
+    './commands/fn.js',
 ];
 const ENDPOINT_PATTERN = /^(GET|POST|PATCH|PUT|DELETE) \/[A-Za-z0-9_\-./{}]*$/;
 describe('every CLI command exports a typed EXPOSES array (S-101)', () => {

package/dist/index.js

@@ -29,6 +29,7 @@ import * as audienceCmd from './commands/audience.js';
 import * as llmCmd from './commands/llm.js';
 import * as databaseCmd from './commands/database.js';
 import * as crmCmd from './commands/crm/index.js';
+import * as fnCmd from './commands/fn.js';
 import { initCompletion, installCompletion, uninstallCompletion } from './completion.js';
 // Each command file declares the value flags it understands. We union them
 // into a single schema for the upfront parse, so adding a new value flag in
@@ -55,6 +56,7 @@ const COMBINED_SCHEMA = {
     ...urlCmd.SCHEMA,
     ...webhookCmd.SCHEMA,
     ...workflowCmd.SCHEMA,
+    ...fnCmd.SCHEMA,
     // Top-level flags
     version: 'boolean',
     V: 'boolean',
@@ -197,6 +199,9 @@ async function main() {
             case 'url':
                 await urlCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'fn':
+                await fnCmd.run(subcommand, restArgs, flags);
+                break;
             // Convenience aliases
             case 'setup':
                 await setupCmd.setup(flags);
@@ -317,6 +322,7 @@ const HELP_TARGETS = {
     llm: f => llmCmd.run(undefined, [], f),
     database: f => databaseCmd.run(undefined, [], f),
     crm: f => crmCmd.run(undefined, [], f),
+    fn: f => fnCmd.run(undefined, [], f),
     org: f => orgCmd.run(undefined, [], f),
     billing: f => billingCmd.run(undefined, [], f),
     keys: f => keysCmd.run(undefined, [], f),
@@ -358,6 +364,7 @@ Commands:
   update          Update CLI and skills to the latest version
   domain          Manage domain configurations
   funnel          Manage websites (publish pages, custom domains, funnels)
+  fn              Create functions on the edge runtime (Story 1 — metadata + scoped key only; bundle upload pending Story 2)
   webhook         Manage inbound webhook endpoints and inspect deliveries
   email           Manage mailboxes, send/read email, templates, and campaigns
   workflow        Run actions (send email, post to Slack) when a webhook fires

package/dist/sdk-domain-assign.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-domain-assign.test.js

@@ -0,0 +1,53 @@
+// Verifies the 2026-05-15 additive contract change: POST
+// /domain/.../{domain}/assign now accepts an optional `funnel_id` in the body.
+// SDK assignDomain takes `{ funnelId?: string }` and forwards it.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { domain } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const DOMAIN = 'example.com';
+const FUNNEL_ID = '33333333-3333-4333-8333-333333333333';
+let fetchMock;
+function ok(data) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn().mockResolvedValue(ok({
+        domain: DOMAIN, org_id: ORG_ID, include_www: true, routes_bound: [DOMAIN, `www.${DOMAIN}`],
+    }));
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('domain.assignDomain — funnel_id (additive 2026-05-15)', () => {
+    it('omits funnel_id from body by default (back-compat)', async () => {
+        await domain.assignDomain(API_KEY, ORG_ID, DOMAIN);
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ org_id: ORG_ID });
+        expect(body).not.toHaveProperty('funnel_id');
+    });
+    it('includes funnel_id when passed in opts', async () => {
+        await domain.assignDomain(API_KEY, ORG_ID, DOMAIN, { funnelId: FUNNEL_ID });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ org_id: ORG_ID, funnel_id: FUNNEL_ID });
+    });
+    it('combines funnel_id with include_www=false', async () => {
+        await domain.assignDomain(API_KEY, ORG_ID, DOMAIN, { funnelId: FUNNEL_ID, includeWww: false });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ org_id: ORG_ID, include_www: false, funnel_id: FUNNEL_ID });
+    });
+    it('omits funnel_id when it is empty string (treat as not-set)', async () => {
+        await domain.assignDomain(API_KEY, ORG_ID, DOMAIN, { funnelId: '' });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).not.toHaveProperty('funnel_id');
+    });
+    it('still works for unassignDomain (no funnel_id involved)', async () => {
+        await domain.unassignDomain(API_KEY, ORG_ID, DOMAIN);
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ org_id: null });
+    });
+});

package/dist/sdk-function.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-function.test.js

@@ -0,0 +1,190 @@
+// SDK-level unit tests for the function module. Verifies request URL/body
+// shape, response parsing, and error envelopes against the Story 1 contract
+// shipped by myapi-hq/internal/routes/function/crud.go.
+//
+// Mocks global fetch — does NOT hit the network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { fn, MyApiError } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const FN_ID = '22222222-2222-4222-8222-222222222222';
+let fetchMock;
+function ok(data, status = 200) {
+    // Backend wraps everything in `{ success, data, meta }`. The SDK unwraps.
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status = 422) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('fn.createFunction', () => {
+    it('POSTs to /function/orgs/{org_id}/functions with the bearer auth + JSON body', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: ORG_ID, name: 'my-app-api', trigger_type: 'http', invocation_url: '', created_at: 't1', updated_at: 't1' },
+            scoped_api_key: 'myapi_live_scoped_xyz',
+            scoped_api_key_id: 'key_xyz',
+        }));
+        const result = await fn.createFunction(API_KEY, ORG_ID, { name: 'my-app-api', trigger_type: 'http' });
+        expect(fetchMock).toHaveBeenCalledOnce();
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        expect(init.headers['Content-Type']).toBe('application/json');
+        expect(JSON.parse(init.body)).toEqual({ name: 'my-app-api', trigger_type: 'http' });
+        expect(result.function.id).toBe(FN_ID);
+        expect(result.scoped_api_key).toBe('myapi_live_scoped_xyz');
+        expect(result.scoped_api_key_id).toBe('key_xyz');
+        // Invocation URL is empty in Story 1 — populated by Story 2.
+        expect(result.function.invocation_url).toBe('');
+    });
+    it('passes cron_schedule through when trigger_type=cron', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: ORG_ID, name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *', invocation_url: '', created_at: 't1', updated_at: 't1' },
+            scoped_api_key: 'myapi_live_scoped_xyz',
+            scoped_api_key_id: 'key_xyz',
+        }));
+        await fn.createFunction(API_KEY, ORG_ID, { name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *' });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *' });
+    });
+    it('encodes path params (defensive against : ? / # in org id)', async () => {
+        // UUIDs don't contain reserved chars in practice — but the SDK still
+        // encodes, so an alternate id with unsafe chars wouldn't break path
+        // routing.
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: 'org/with?weird#chars', name: 'x', trigger_type: 'http', invocation_url: '', created_at: 't', updated_at: 't' },
+            scoped_api_key: 'k', scoped_api_key_id: 'i',
+        }));
+        await fn.createFunction(API_KEY, 'org/with?weird#chars', { name: 'x' });
+        const [url] = fetchMock.mock.calls[0];
+        expect(url).toContain('/function/orgs/org%2Fwith%3Fweird%23chars/functions');
+    });
+    it('surfaces backend INVALID_NAME (422) as a typed MyApiError', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_NAME', 'name must match ^[a-z0-9][a-z0-9-]{0,49}$', 422));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'BAD NAME' }))
+            .rejects.toMatchObject({
+            name: 'MyApiError',
+            code: 'INVALID_NAME',
+            status: 422,
+        });
+    });
+    it('surfaces NAME_TAKEN (409) cleanly', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NAME_TAKEN', 'function name "x" is already used in this org', 409));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'NAME_TAKEN', status: 409 });
+    });
+    it('surfaces 401 (invalid api key)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('unauthorized', 'invalid api key', 401));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ status: 401 });
+    });
+    it('surfaces 403 SCOPE_FORBIDDEN when called with a slot_call-only key', async () => {
+        // 2026-05-15 enforcement: scoped api_keys with scopes=["slot_call"]
+        // can only call slot endpoints, not /hq/*, /admin/*, /internal/*.
+        // Note: /function/* IS a slot path, so SCOPE_FORBIDDEN shouldn't trigger
+        // here in practice — but the SDK must still surface it cleanly if it
+        // ever appears (e.g. for /hq/* mistakes).
+        fetchMock.mockResolvedValueOnce(fail('SCOPE_FORBIDDEN', 'this key cannot call /hq/* endpoints', 403));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'SCOPE_FORBIDDEN', status: 403 });
+    });
+    it('wraps non-JSON 5xx responses (HTML error pages) helpfully', async () => {
+        fetchMock.mockResolvedValueOnce(new Response('<html>502 Bad Gateway</html>', {
+            status: 502, headers: { 'content-type': 'text/html' },
+        }));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'invalid_json_response', status: 502 });
+    });
+});
+describe('fn.listFunctions', () => {
+    it('GETs /function/orgs/{org_id}/functions with bearer auth + no body', async () => {
+        fetchMock.mockResolvedValueOnce(ok([
+            { id: FN_ID, org_id: ORG_ID, name: 'a', trigger_type: 'http', invocation_url: '', created_at: 't', updated_at: 't' },
+        ]));
+        const fns = await fn.listFunctions(API_KEY, ORG_ID);
+        expect(fns).toHaveLength(1);
+        expect(fns[0].name).toBe('a');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions`);
+        expect(init.method).toBe('GET');
+        expect(init.body).toBeUndefined();
+    });
+    it('returns an empty array when org has no functions', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        expect(await fn.listFunctions(API_KEY, ORG_ID)).toEqual([]);
+    });
+});
+describe('fn.getFunction', () => {
+    it('GETs /function/orgs/{org_id}/functions/{id}', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: FN_ID, org_id: ORG_ID, name: 'a', trigger_type: 'http', invocation_url: '', created_at: 't', updated_at: 't' }));
+        const got = await fn.getFunction(API_KEY, ORG_ID, FN_ID);
+        expect(got.id).toBe(FN_ID);
+        const [url] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}`);
+    });
+    it('throws function_not_found on 404', async () => {
+        fetchMock.mockResolvedValueOnce(fail('function_not_found', 'not found', 404));
+        await expect(fn.getFunction(API_KEY, ORG_ID, FN_ID))
+            .rejects.toMatchObject({ code: 'function_not_found', status: 404 });
+    });
+});
+describe('fn.deleteFunction', () => {
+    it('DELETEs /function/orgs/{org_id}/functions/{id}', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        await fn.deleteFunction(API_KEY, ORG_ID, FN_ID);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}`);
+        expect(init.method).toBe('DELETE');
+    });
+});
+describe('fn.EXPOSES', () => {
+    it('matches the Story 1 contract — exactly 4 endpoints', () => {
+        expect(fn.EXPOSES).toEqual([
+            'POST /function/orgs/{org_id}/functions',
+            'GET /function/orgs/{org_id}/functions',
+            'GET /function/orgs/{org_id}/functions/{id}',
+            'DELETE /function/orgs/{org_id}/functions/{id}',
+        ]);
+    });
+    it('does NOT yet expose /logs or /env (Story 4/5 pending)', () => {
+        const flat = fn.EXPOSES.join(' ');
+        expect(flat).not.toContain('/logs');
+        expect(flat).not.toContain('/env');
+    });
+});
+// MyApiError is the universal error shape callers can `instanceof`-check or
+// switch on `.code`. Validate it surfaces the right fields from typed
+// (object) errors and raw-string errors alike.
+describe('MyApiError surfacing', () => {
+    it('preserves the body object on object-shaped errors (for CF_API_ERROR etc.)', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(JSON.stringify({
+            success: false,
+            error: { code: 'CF_API_ERROR', message: 'cf failed', cf_message: 'Forbidden zone', cf_status: 403 },
+            meta: {},
+        }), { status: 500, headers: { 'content-type': 'application/json' } }));
+        try {
+            await fn.createFunction(API_KEY, ORG_ID, { name: 'x' });
+            expect.fail('Should have thrown');
+        }
+        catch (e) {
+            expect(e).toBeInstanceOf(MyApiError);
+            const err = e;
+            expect(err.code).toBe('CF_API_ERROR');
+            expect(err.body?.cf_message).toBe('Forbidden zone');
+            expect(err.body?.cf_status).toBe(403);
+        }
+    });
+});

package/dist/sdk-funnel-name.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-funnel-name.test.js

@@ -0,0 +1,48 @@
+// 2026-05-15: POST /funnel/orgs/{org_id}/funnels now accepts optional
+// `name` (defaults server-side to the org's preview_subdomain). SDK
+// createFunnel was extended to forward { name } through.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { funnel } from '@myapihq/sdk';
+const API_KEY = 'myapi_test';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+let fetchMock;
+function ok(data) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn().mockResolvedValue(ok({
+        funnel: { id: 'f1', org_id: ORG_ID, name: 'my-app', created_at: 't', updated_at: 't' },
+        subdomain_url: 'https://my-app.makeautonomous.com',
+    }));
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => { vi.restoreAllMocks(); });
+describe('funnel.createFunnel — name (additive 2026-05-15)', () => {
+    it('omits name from body when not provided (back-compat — server picks preview_subdomain)', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID);
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({});
+    });
+    it('omits name when opts is provided but has no name', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID, {});
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({});
+    });
+    it('includes name when provided', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID, { name: 'my-app' });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ name: 'my-app' });
+    });
+    it('hits the right path and method', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID, { name: 'x' });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/funnel/orgs/${ORG_ID}/funnels`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+    });
+    it('returns the funnel with name populated', async () => {
+        const result = await funnel.createFunnel(API_KEY, ORG_ID, { name: 'my-app' });
+        expect(result.funnel.name).toBe('my-app');
+        expect(result.subdomain_url).toBe('https://my-app.makeautonomous.com');
+    });
+});

package/dist/sdk-webhook.test.d.ts

@@ -0,0 +1 @@
+export {};