@myapihq/cli 1.2.4 → 1.2.6

package/dist/commands/payments.js

@@ -0,0 +1,219 @@
+import { payments as sdkPayments } from '@myapihq/sdk';
+import { requireConfig } from '../config.js';
+import { success, error, printTable, info, printJson } from '../output.js';
+import { formatDate } from '../utils.js';
+import { requireOrg } from '../helpers.js';
+export const EXPOSES = [
+    'POST /payments/orgs/{org_id}/connect',
+    'GET /payments/orgs/{org_id}/connect',
+    'POST /payments/orgs/{org_id}/charges',
+    'GET /payments/orgs/{org_id}/charges',
+    'GET /payments/orgs/{org_id}/charges/{id}',
+    'POST /payments/orgs/{org_id}/charges/{id}/refund',
+    'POST /payments/webhook/{org_id}',
+];
+export const SCHEMA = {
+    'stripe-key': 'string',
+    amount: 'string',
+    description: 'string',
+    email: 'string',
+    every: 'string',
+    'success-url': 'string',
+    'cancel-url': 'string',
+};
+// Dollars → positive cents. The CLI surface is dollars; the API is cents.
+// Pure form returns cents or an error-message string. Charges must be > 0,
+// so $0 is rejected (unlike a spend cap, where $0 is meaningful).
+export function _amountToCents(raw) {
+    const trimmed = raw.trim();
+    const n = Number(trimmed);
+    if (trimmed === '' || !Number.isFinite(n) || n <= 0) {
+        return `"${raw}" is not a valid amount — use a positive number, e.g. 19 or 9.99.`;
+    }
+    return Math.round(n * 100);
+}
+function dollars(cents) {
+    return `$${(cents / 100).toFixed(2)}`;
+}
+function summarizeCharge(c) {
+    return {
+        id: c.id,
+        amount: `${dollars(c.amount_cents)} ${c.currency.toUpperCase()}`,
+        every: c.every || 'one-off',
+        status: c.status,
+        email: c.customer_email || '',
+        created_at: c.created_at ? formatDate(c.created_at) : '',
+    };
+}
+// ── Subcommands ──────────────────────────────────────────────────────────────
+export async function connect(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi payments connect --stripe-key <sk_...> [--org <id>]');
+    const key = flags['stripe-key'];
+    if (!key) {
+        error('Missing --stripe-key.\nUsage: myapi payments connect --stripe-key <sk_...>\n\n→ Your own Stripe secret key (starts with "sk_"). T0 is bring-your-own-Stripe.');
+    }
+    if (!key.startsWith('sk_'))
+        error('--stripe-key must be a Stripe secret key (starts with "sk_").');
+    const res = await sdkPayments.connect(config.api_key, orgId, key);
+    success('Stripe connected.');
+    info(`Tier:              ${res.tier}`);
+    info(`Stripe account:    ${res.stripe_account_id}`);
+    info(`Onboarding:        ${res.onboarding_status}`);
+}
+export async function status(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi payments status [--org <id>]');
+    const res = await sdkPayments.getConnect(config.api_key, orgId);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    info(`Tier:              ${res.tier}`);
+    info(`Stripe account:    ${res.stripe_account_id}`);
+    info(`Onboarding:        ${res.onboarding_status}`);
+    if (res.application_fee_bps != null) {
+        info(`Platform fee:      ${res.application_fee_bps} bps`);
+    }
+}
+export async function charge(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi payments charge --amount <usd> [--description <text>] [--email <addr>] [--every month|year]');
+    const amountRaw = flags.amount;
+    if (!amountRaw) {
+        error('Missing --amount.\nUsage: myapi payments charge --amount <usd> [--description <text>] [--email <addr>] [--every month|year]\n\n→ --amount is in dollars (e.g. 19 or 9.99).');
+    }
+    const cents = _amountToCents(amountRaw);
+    if (typeof cents === 'string')
+        error(`--amount: ${cents}`);
+    const every = flags.every;
+    if (every && every !== 'month' && every !== 'year') {
+        error(`Invalid --every "${every}". Use "month" or "year" for a subscription, or omit for a one-off payment.`);
+    }
+    const payload = { amount_cents: cents };
+    if (flags.description)
+        payload.description = flags.description;
+    if (flags.email)
+        payload.email = flags.email;
+    if (every)
+        payload.every = every;
+    if (flags['success-url'])
+        payload.success_url = flags['success-url'];
+    if (flags['cancel-url'])
+        payload.cancel_url = flags['cancel-url'];
+    const res = await sdkPayments.createCharge(config.api_key, orgId, payload);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Charge created: ${res.payment_id}`);
+    info(`Status:        ${res.status}`);
+    info('');
+    info('Send the customer to this hosted Stripe Checkout URL:');
+    info(`  ${res.checkout_url}`);
+}
+export async function list(flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi payments list [--org <id>]');
+    const charges = await sdkPayments.listCharges(config.api_key, orgId);
+    if (flags.json) {
+        printJson(charges);
+        return;
+    }
+    printTable(charges.map(summarizeCharge), {
+        flags,
+        empty: 'No charges yet. Create one with: myapi payments charge --amount <usd>',
+    });
+}
+export async function get(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi payments get <charge_id> [--org <id>]');
+    if (!id)
+        error('Missing charge id.\nUsage: myapi payments get <charge_id>');
+    const c = await sdkPayments.getCharge(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(c);
+        return;
+    }
+    info(`ID:          ${c.id}`);
+    info(`Amount:      ${dollars(c.amount_cents)} ${c.currency.toUpperCase()}`);
+    info(`Billing:     ${c.every ? `every ${c.every}` : 'one-off'}`);
+    if (c.description)
+        info(`Description: ${c.description}`);
+    if (c.customer_email)
+        info(`Customer:    ${c.customer_email}`);
+    info(`Status:      ${c.status}`);
+    if (c.created_at)
+        info(`Created:     ${formatDate(c.created_at)}`);
+    if (c.succeeded_at)
+        info(`Succeeded:   ${formatDate(c.succeeded_at)}`);
+    if (c.refunded_at)
+        info(`Refunded:    ${formatDate(c.refunded_at)}`);
+}
+export async function refund(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi payments refund <charge_id> [--org <id>]');
+    if (!id)
+        error('Missing charge id.\nUsage: myapi payments refund <charge_id>');
+    const res = await sdkPayments.refundCharge(config.api_key, orgId, id);
+    success(`Charge ${res.id} refunded (status: ${res.status}).`);
+}
+// ── Dispatcher ───────────────────────────────────────────────────────────────
+const SUBCOMMAND_USAGE = {
+    'connect': `myapi payments connect --stripe-key <sk_...> [--org <id>]
+
+Links your own Stripe account (T0 — bring-your-own-Stripe). The key is
+validated live against Stripe, stored encrypted, and never echoed. Connect
+Express (T1) is not yet available.`,
+    'status': 'myapi payments status [--org <id>] [--json]',
+    'charge': `myapi payments charge --amount <usd> [--description <text>] [--email <addr>] [--every month|year] [--success-url <url>] [--cancel-url <url>] [--org <id>]
+
+Opens a Stripe Checkout Session on your connected account and returns a
+hosted checkout URL to send the customer to. --amount is in dollars.
+--every makes it a recurring subscription; omit it for a one-off payment.
+
+Examples:
+  myapi payments charge --amount 19 --description "Pro plan"
+  myapi payments charge --amount 9.99 --every month --email user@example.com`,
+    'list': 'myapi payments list [--org <id>] [--json]',
+    'get': 'myapi payments get <charge_id> [--org <id>] [--json]',
+    'refund': `myapi payments refund <charge_id> [--org <id>]
+
+Issues a full refund. Partial refunds are not supported.`,
+};
+export async function run(subcommand, args, flags) {
+    if (!subcommand || (flags.help && !subcommand)) {
+        info(`Usage: myapi payments <subcommand>
+
+Take payments with Stripe Checkout. Connect your Stripe account, then
+create one-off or recurring charges and refund them.
+
+Subcommands:
+  connect              Link your Stripe account (T0 — bring your own key)
+  status               Show the org's Stripe connection status
+  charge               Create a charge and get a hosted checkout URL
+  list                 List charges in your org
+  get <charge_id>      Inspect a charge
+  refund <charge_id>   Full-refund a charge
+
+All commands accept --org <id> (or set default: myapi config set-org <id>).`);
+        return;
+    }
+    if (flags.help) {
+        const usage = SUBCOMMAND_USAGE[subcommand];
+        if (usage)
+            info(`Usage: ${usage}`);
+        else
+            info(`Unknown subcommand: ${subcommand}. Run "myapi payments --help" for the list.`);
+        return;
+    }
+    switch (subcommand) {
+        case 'connect': return connect(flags);
+        case 'status': return status(flags);
+        case 'charge': return charge(flags);
+        case 'list': return list(flags);
+        case 'get': return get(args[0], flags);
+        case 'refund': return refund(args[0], flags);
+        default: error(`Unknown subcommand: ${subcommand}. Run "myapi payments --help" for available subcommands.`);
+    }
+}

package/dist/commands/webhook-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/webhook-validation.test.js

@@ -0,0 +1,35 @@
+// Unit tests for the webhook CLI's forward_url validator (2026-05-15).
+import { describe, it, expect } from 'vitest';
+import { _validateForwardUrl } from './webhook.js';
+describe('_validateForwardUrl', () => {
+    describe('accepts', () => {
+        it.each([
+            ['', 'empty string (means "unset")'],
+            ['https://example.com/forward', 'standard https'],
+            ['http://example.com/forward', 'http (non-TLS)'],
+            ['https://api.stripe.com', 'no path'],
+            ['https://example.com:8443/path?q=v#h', 'port, query, fragment'],
+        ])('accepts %s (%s)', (url) => {
+            expect(_validateForwardUrl(url)).toBeNull();
+        });
+    });
+    describe('rejects non-http(s) protocols', () => {
+        it.each([
+            ['ftp://example.com', 'ftp'],
+            ['javascript:alert(1)', 'javascript: scheme'],
+            ['file:///etc/passwd', 'file:'],
+            ['data:text/plain,foo', 'data:'],
+        ])('rejects %s (%s)', (url) => {
+            expect(_validateForwardUrl(url)).toMatch(/http:\/\/ or https:\/\//);
+        });
+    });
+    describe('rejects malformed URLs', () => {
+        it.each([
+            'not a url',
+            'http//missing-colon.example.com',
+            'just-some-text',
+        ])('rejects %s', (url) => {
+            expect(_validateForwardUrl(url)).toMatch(/not a valid URL/);
+        });
+    });
+});

package/dist/commands/webhook.d.ts

@@ -5,6 +5,8 @@ export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
 export declare function list(flags: Flags): Promise<void>;
 export declare function create(nameArg: string | undefined, flags: Flags): Promise<void>;
+export declare function update(id: string, flags: Flags): Promise<void>;
+export declare function _validateForwardUrl(url: string): string | null;
 export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function delivery(id: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/webhook.js

@@ -5,6 +5,7 @@ import { requireOrg } from '../helpers.js';
 export const EXPOSES = [
     'POST /webhook/orgs/{org_id}/endpoints',
     'GET /webhook/orgs/{org_id}/endpoints',
+    'PATCH /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
     'DELETE /webhook/orgs/{org_id}/endpoints/{endpoint_id}',
     'GET /webhook/orgs/{org_id}/deliveries/{delivery_id}',
 ];
@@ -13,6 +14,8 @@ export const SCHEMA = {
     name: 'string',
     description: 'string',
     'crm-email-path': 'string',
+    // 2026-05-15: backend's POST/PATCH endpoints accept forward_url.
+    'forward-url': 'string',
 };
 export async function list(flags) {
     const config = requireConfig();
@@ -29,21 +32,78 @@ export async function list(flags) {
 }
 export async function create(nameArg, flags) {
     const config = requireConfig();
-    const orgId = requireOrg(flags, config, 'myapi webhook create <name> [--description <desc>] [--org <id>]');
+    const orgId = requireOrg(flags, config, 'myapi webhook create <name> [--description <desc>] [--crm-email-path <path>] [--forward-url <url>] [--org <id>]');
     const name = nameArg || flags.name;
     if (!name)
-        error('Missing required arguments.\nUsage: myapi webhook create <name> [--description <desc>] [--crm-email-path <path>] [--org <id>]\n   or: myapi webhook create --name <name> [...]');
+        error('Missing required arguments.\nUsage: myapi webhook create <name> [--description <desc>] [--crm-email-path <path>] [--forward-url <url>] [--org <id>]\n   or: myapi webhook create --name <name> [...]');
     const opts = {};
     if (typeof flags.description === 'string')
         opts.description = flags.description;
     if (typeof flags['crm-email-path'] === 'string')
         opts.crm_email_path = flags['crm-email-path'];
+    if (typeof flags['forward-url'] === 'string') {
+        validateForwardUrl(flags['forward-url']);
+        opts.forward_url = flags['forward-url'];
+    }
     const res = await sdkWebhook.createEndpoint(config.api_key, orgId, name, opts);
     if (flags.json) {
         printJson(res);
         return;
     }
     success(`Webhook created! ID: ${res.id}\nInbound URL: ${res.url}`);
+    if (opts.forward_url)
+        info(`Forwarding to: ${opts.forward_url}`);
+}
+export async function update(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi webhook update <id> [--name <name>] [--description <desc>] [--crm-email-path <path>] [--forward-url <url>] [--org <id>]');
+    if (!id)
+        error('Missing required arguments.\nUsage: myapi webhook update <id> [--name <name>] [--description <desc>] [--crm-email-path <path>] [--forward-url <url>]');
+    const payload = {};
+    if (typeof flags.name === 'string')
+        payload.name = flags.name;
+    if (typeof flags.description === 'string')
+        payload.description = flags.description;
+    // crm-email-path & forward-url accept "" (empty string) to explicitly
+    // disable. Don't coerce to undefined — that would mean "leave as-is".
+    if (typeof flags['crm-email-path'] === 'string')
+        payload.crm_email_path = flags['crm-email-path'];
+    if (typeof flags['forward-url'] === 'string') {
+        const fu = flags['forward-url'];
+        if (fu !== '')
+            validateForwardUrl(fu);
+        payload.forward_url = fu;
+    }
+    if (Object.keys(payload).length === 0) {
+        error('Nothing to update. Provide at least one of --name, --description, --crm-email-path, --forward-url.');
+    }
+    const res = await sdkWebhook.updateEndpoint(config.api_key, orgId, id, payload);
+    if (flags.json) {
+        printJson(res);
+        return;
+    }
+    success(`Webhook ${res.id} updated`);
+}
+// Exported for unit tests. Returns null on success, error message on failure.
+// Matches the backend's documented "Use http:// or https://" constraint.
+export function _validateForwardUrl(url) {
+    if (url === '')
+        return null; // empty = unset; valid
+    try {
+        const u = new URL(url);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+            return `--forward-url must use http:// or https:// (got ${u.protocol})`;
+        }
+        return null;
+    }
+    catch {
+        return `--forward-url is not a valid URL: "${url}"`;
+    }
+}
+function validateForwardUrl(url) {
+    const err = _validateForwardUrl(url);
+    if (err)
+        error(err);
 }
 export async function del(id, flags) {
     const config = requireConfig();
@@ -74,6 +134,14 @@ CRM auto-ingest (optional):
                                 Default 'email' (top-level). For Stripe:
                                 'data.object.customer_email'. For GitHub:
                                 'sender.email'. Empty string disables ingest.`,
+    'update': `myapi webhook update <id> [--name <name>] [--description <desc>] [--crm-email-path <path>] [--forward-url <url>] [--org <id>]
+
+All fields optional — only the ones you pass get changed. Pass an empty
+string to --crm-email-path or --forward-url to explicitly clear that
+field (e.g., --forward-url "" disables forwarding without deleting the
+endpoint).
+
+Slug is immutable; create a new endpoint if you need a different slug.`,
     'delete': 'myapi webhook delete <id> [--org <id>]',
     'delivery': 'myapi webhook delivery <delivery_id> [--org <id>]',
 };
@@ -84,6 +152,7 @@ export async function run(subcommand, args, flags) {
 Subcommands:
   list       List all inbound webhook endpoints
   create     Create a new endpoint to receive data (returns an inbound URL)
+  update     Patch endpoint name / description / crm-email-path / forward-url
   delete     Delete a webhook endpoint
   delivery   Inspect a specific webhook delivery (payload, received_at)
 
@@ -118,6 +187,7 @@ See the my-webhook-api skill for the full HTML + JS recipe.`);
     switch (subcommand) {
         case 'list': return list(flags);
         case 'create': return create(args[0], flags);
+        case 'update': return update(args[0], flags);
         case 'delete': return del(args[0], flags);
         case 'delivery': return delivery(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi webhook --help" for a list of valid subcommands.`);

package/dist/commands/workflow-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/workflow-validation.test.js

@@ -0,0 +1,137 @@
+// Unit tests for workflow.ts CLI's pure step validator. The 2026-05-15
+// additive contract change adds `http_request` (alias `http`) to the
+// supported step types; this test file pins the new validation rules and
+// regression-tests the prior shapes.
+import { describe, it, expect } from 'vitest';
+import { _validateSteps } from './workflow.js';
+const VALID_EMAIL = { type: 'send_email', from: 'a@x.com', to: 'b@x.com', subject: 'hi', html: '<p>x</p>' };
+const VALID_SLACK = { type: 'slack_message', webhook_url: 'https://hooks.slack.com/services/T1/B1/abc', text: 'hi' };
+const VALID_HTTP = { type: 'http_request', url: 'https://example.com/hook' };
+describe('_validateSteps — input shape', () => {
+    it('rejects non-array', () => {
+        expect(_validateSteps('not an array')).toMatch(/must be a JSON array/);
+        expect(_validateSteps({})).toMatch(/must be a JSON array/);
+        expect(_validateSteps(null)).toMatch(/must be a JSON array/);
+    });
+    it('rejects empty array', () => {
+        expect(_validateSteps([])).toMatch(/cannot be an empty array/);
+    });
+    it('rejects steps that are not objects', () => {
+        expect(_validateSteps(['string'])).toMatch(/must be a JSON object/);
+        expect(_validateSteps([null])).toMatch(/must be a JSON object/);
+    });
+    it('rejects unknown step types', () => {
+        expect(_validateSteps([{ type: 'pigeon' }])).toMatch(/unknown type "pigeon"/);
+    });
+    it('rejects steps missing the type field', () => {
+        expect(_validateSteps([{ from: 'x' }])).toMatch(/missing required field "type"/);
+    });
+});
+describe('_validateSteps — send_email / email', () => {
+    it('accepts valid send_email with html body', () => {
+        expect(_validateSteps([VALID_EMAIL])).toBeNull();
+    });
+    it('accepts the `email` alias', () => {
+        expect(_validateSteps([{ ...VALID_EMAIL, type: 'email' }])).toBeNull();
+    });
+    it('rejects send_email missing required fields', () => {
+        expect(_validateSteps([{ type: 'send_email', from: 'a@x.com' }]))
+            .toMatch(/missing required field "to"/);
+    });
+    it('rejects send_email with no body form', () => {
+        expect(_validateSteps([{ type: 'send_email', from: 'a@x.com', to: 'b@x.com', subject: 's' }]))
+            .toMatch(/must include exactly one of "body", "html", or "template_id"/);
+    });
+    it('rejects send_email with multiple body forms', () => {
+        expect(_validateSteps([{ ...VALID_EMAIL, body: 'plain', html: '<p>x</p>' }]))
+            .toMatch(/can only use one of/);
+    });
+    it('rejects template_vars without template_id', () => {
+        expect(_validateSteps([{ ...VALID_EMAIL, template_vars: { name: 'x' } }]))
+            .toMatch(/"template_vars" only makes sense with "template_id"/);
+    });
+});
+describe('_validateSteps — slack_message / slack', () => {
+    it('accepts valid slack_message', () => {
+        expect(_validateSteps([VALID_SLACK])).toBeNull();
+    });
+    it('accepts the `slack` alias', () => {
+        expect(_validateSteps([{ ...VALID_SLACK, type: 'slack' }])).toBeNull();
+    });
+    it('rejects slack with non-Slack webhook URL', () => {
+        expect(_validateSteps([{ ...VALID_SLACK, webhook_url: 'https://example.com/hook' }]))
+            .toMatch(/must look like https:\/\/hooks\.slack\.com/);
+    });
+    it('rejects slack missing text', () => {
+        expect(_validateSteps([{ type: 'slack_message', webhook_url: VALID_SLACK.webhook_url }]))
+            .toMatch(/missing required field "text"/);
+    });
+});
+describe('_validateSteps — http_request / http (2026-05-15)', () => {
+    it('accepts the canonical type name', () => {
+        expect(_validateSteps([VALID_HTTP])).toBeNull();
+    });
+    it('accepts the `http` alias', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, type: 'http' }])).toBeNull();
+    });
+    it('accepts all supported HTTP methods', () => {
+        for (const m of ['GET', 'POST', 'PATCH', 'PUT', 'DELETE']) {
+            expect(_validateSteps([{ ...VALID_HTTP, method: m }])).toBeNull();
+        }
+    });
+    it('accepts a body string with templating', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, body: '{"email":"{{ payload.email }}"}' }])).toBeNull();
+    });
+    it('accepts a headers map of strings', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, headers: { 'X-Token': 'abc', 'X-Other': 'def' } }])).toBeNull();
+    });
+    it('rejects when url is missing', () => {
+        expect(_validateSteps([{ type: 'http_request' }]))
+            .toMatch(/missing required field "url"/);
+    });
+    it('rejects when url is not a string', () => {
+        expect(_validateSteps([{ type: 'http_request', url: 12345 }]))
+            .toMatch(/missing required field "url"/);
+    });
+    it('rejects non-http(s) URLs', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, url: 'ftp://example.com' }]))
+            .toMatch(/must start with http:\/\/ or https:\/\//);
+        expect(_validateSteps([{ ...VALID_HTTP, url: 'javascript:alert(1)' }]))
+            .toMatch(/must start with http:\/\/ or https:\/\//);
+    });
+    it('rejects unknown HTTP methods', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, method: 'TRACE' }]))
+            .toMatch(/"method" must be one of/);
+    });
+    it('rejects body as a non-string (object)', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, body: { not: 'a string' } }]))
+            .toMatch(/"body" must be a string/);
+    });
+    it('rejects headers as a non-object', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, headers: 'X-Token: abc' }]))
+            .toMatch(/"headers" must be a JSON object/);
+    });
+    it('rejects headers as an array', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, headers: ['X-Token: abc'] }]))
+            .toMatch(/"headers" must be a JSON object/);
+    });
+    it('rejects header value that is not a string', () => {
+        expect(_validateSteps([{ ...VALID_HTTP, headers: { 'X-Token': 42 } }]))
+            .toMatch(/"headers" value for "X-Token" must be a string/);
+    });
+});
+describe('_validateSteps — mixed-type pipelines', () => {
+    it('accepts an http_request after a send_email (pipeline shape)', () => {
+        expect(_validateSteps([
+            VALID_EMAIL,
+            { ...VALID_HTTP, body: '{"sent_to":"{{ payload.email }}"}' },
+        ])).toBeNull();
+    });
+    it('reports the failing step index in the error message', () => {
+        expect(_validateSteps([
+            VALID_EMAIL,
+            VALID_SLACK,
+            { type: 'http_request' }, // missing url at index 2
+        ])).toMatch(/^step 2 \(http_request\):/);
+    });
+});

package/dist/commands/workflow.d.ts

@@ -3,6 +3,7 @@ import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+export declare function _validateSteps(steps: unknown): string | null;
 export declare function list(flags: Flags): Promise<void>;
 export declare function get(id: string, flags: Flags): Promise<void>;
 export declare function create(nameArg: string | undefined, flags: Flags): Promise<void>;