@myapihq/cli 1.2.4 → 1.2.6

package/dist/commands/workflow.js

@@ -23,59 +23,100 @@ export const SCHEMA = {
 // Mirrors the backend's SupportedStepTypes list. Both alias and underscore
 // forms are accepted by the workflow runner. Keep this in sync if the
 // backend grows new step types.
-const SUPPORTED_STEP_TYPES = ['send_email', 'email', 'slack_message', 'slack'];
+//
+// 2026-05-15: backend added `http_request` (alias `http`). See
+// myapi-hq/internal/routes/workflow/execute.go.
+const SUPPORTED_STEP_TYPES = ['send_email', 'email', 'slack_message', 'slack', 'http_request', 'http'];
+const HTTP_METHODS = new Set(['GET', 'POST', 'PATCH', 'PUT', 'DELETE']);
 const SLACK_HOOK_RE = /^https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+/;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 // Per-step-type required fields. Validated client-side so typos and
 // hallucinated shapes fail fast, before the network call. Backend
 // performs the same validation as defense in depth.
-function validateSteps(steps) {
+//
+// `_validateSteps` is the pure form — returns the first error message
+// (string) or null on success. Suitable for unit tests. The internal
+// `validateSteps` wrapper calls `error()` on a non-null result, which
+// exits the process — used by command handlers.
+export function _validateSteps(steps) {
     if (!Array.isArray(steps))
-        error('--steps must be a JSON array of step objects.');
+        return '--steps must be a JSON array of step objects.';
     if (steps.length === 0)
-        error('--steps cannot be an empty array.');
-    steps.forEach((s, i) => {
+        return '--steps cannot be an empty array.';
+    for (let i = 0; i < steps.length; i++) {
+        const s = steps[i];
         const where = `step ${i}`;
         if (!s || typeof s !== 'object')
-            error(`${where}: must be a JSON object.`);
+            return `${where}: must be a JSON object.`;
         if (!s.type)
-            error(`${where}: missing required field "type". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`);
+            return `${where}: missing required field "type". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`;
         if (!SUPPORTED_STEP_TYPES.includes(s.type)) {
-            error(`${where}: unknown type "${s.type}". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`);
+            return `${where}: unknown type "${s.type}". Supported: ${SUPPORTED_STEP_TYPES.join(', ')}`;
         }
         if (s.type === 'send_email' || s.type === 'email') {
             const required = ['from', 'to', 'subject'];
             for (const f of required) {
                 if (!s[f] || typeof s[f] !== 'string') {
-                    error(`${where} (${s.type}): missing required field "${f}".`);
+                    return `${where} (${s.type}): missing required field "${f}".`;
                 }
             }
             const bodyForms = ['body', 'html', 'template_id'].filter(f => s[f] !== undefined && s[f] !== '');
             if (bodyForms.length === 0) {
-                error(`${where} (${s.type}): must include exactly one of "body", "html", or "template_id".`);
+                return `${where} (${s.type}): must include exactly one of "body", "html", or "template_id".`;
             }
             if (bodyForms.length > 1) {
-                error(`${where} (${s.type}): can only use one of "body", "html", "template_id" — got: ${bodyForms.join(', ')}.`);
+                return `${where} (${s.type}): can only use one of "body", "html", "template_id" — got: ${bodyForms.join(', ')}.`;
             }
             if (s.template_vars !== undefined && !s.template_id) {
-                error(`${where} (${s.type}): "template_vars" only makes sense with "template_id".`);
+                return `${where} (${s.type}): "template_vars" only makes sense with "template_id".`;
             }
             if (s.template_vars !== undefined && (typeof s.template_vars !== 'object' || Array.isArray(s.template_vars))) {
-                error(`${where} (${s.type}): "template_vars" must be a JSON object.`);
+                return `${where} (${s.type}): "template_vars" must be a JSON object.`;
             }
         }
         if (s.type === 'slack_message' || s.type === 'slack') {
             if (!s.webhook_url || typeof s.webhook_url !== 'string') {
-                error(`${where} (${s.type}): missing required field "webhook_url".`);
+                return `${where} (${s.type}): missing required field "webhook_url".`;
             }
             if (!SLACK_HOOK_RE.test(s.webhook_url)) {
-                error(`${where} (${s.type}): "webhook_url" must look like https://hooks.slack.com/services/T.../B.../xxx — got "${s.webhook_url}".`);
+                return `${where} (${s.type}): "webhook_url" must look like https://hooks.slack.com/services/T.../B.../xxx — got "${s.webhook_url}".`;
             }
             if (!s.text || typeof s.text !== 'string') {
-                error(`${where} (${s.type}): missing required field "text".`);
+                return `${where} (${s.type}): missing required field "text".`;
             }
         }
-    });
+        if (s.type === 'http_request' || s.type === 'http') {
+            if (!s.url || typeof s.url !== 'string') {
+                return `${where} (${s.type}): missing required field "url".`;
+            }
+            if (!/^https?:\/\//.test(s.url)) {
+                return `${where} (${s.type}): "url" must start with http:// or https:// — got "${s.url}".`;
+            }
+            if (s.method !== undefined) {
+                if (typeof s.method !== 'string' || !HTTP_METHODS.has(s.method.toUpperCase())) {
+                    return `${where} (${s.type}): "method" must be one of ${[...HTTP_METHODS].join(', ')}.`;
+                }
+            }
+            if (s.body !== undefined && typeof s.body !== 'string') {
+                return `${where} (${s.type}): "body" must be a string (template substitutions supported).`;
+            }
+            if (s.headers !== undefined) {
+                if (typeof s.headers !== 'object' || Array.isArray(s.headers)) {
+                    return `${where} (${s.type}): "headers" must be a JSON object of {string: string}.`;
+                }
+                for (const [k, v] of Object.entries(s.headers)) {
+                    if (typeof v !== 'string')
+                        return `${where} (${s.type}): "headers" value for "${k}" must be a string.`;
+                }
+            }
+        }
+    }
+    return null;
+}
+function validateSteps(steps) {
+    const err = _validateSteps(steps);
+    if (err)
+        error(err);
 }
 function summarizeWorkflow(w) {
     return {

package/dist/exposes.test.js

@@ -37,6 +37,8 @@ const COMMAND_MODULES = [
     './commands/url.js',
     './commands/webhook.js',
     './commands/workflow.js',
+    './commands/fn.js',
+    './commands/payments.js',
 ];
 const ENDPOINT_PATTERN = /^(GET|POST|PATCH|PUT|DELETE) \/[A-Za-z0-9_\-./{}]*$/;
 describe('every CLI command exports a typed EXPOSES array (S-101)', () => {

package/dist/index.js

@@ -29,6 +29,8 @@ import * as audienceCmd from './commands/audience.js';
 import * as llmCmd from './commands/llm.js';
 import * as databaseCmd from './commands/database.js';
 import * as crmCmd from './commands/crm/index.js';
+import * as fnCmd from './commands/fn.js';
+import * as paymentsCmd from './commands/payments.js';
 import { initCompletion, installCompletion, uninstallCompletion } from './completion.js';
 // Each command file declares the value flags it understands. We union them
 // into a single schema for the upfront parse, so adding a new value flag in
@@ -55,6 +57,8 @@ const COMBINED_SCHEMA = {
     ...urlCmd.SCHEMA,
     ...webhookCmd.SCHEMA,
     ...workflowCmd.SCHEMA,
+    ...fnCmd.SCHEMA,
+    ...paymentsCmd.SCHEMA,
     // Top-level flags
     version: 'boolean',
     V: 'boolean',
@@ -197,6 +201,12 @@ async function main() {
             case 'url':
                 await urlCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'fn':
+                await fnCmd.run(subcommand, restArgs, flags);
+                break;
+            case 'payments':
+                await paymentsCmd.run(subcommand, restArgs, flags);
+                break;
             // Convenience aliases
             case 'setup':
                 await setupCmd.setup(flags);
@@ -317,6 +327,8 @@ const HELP_TARGETS = {
     llm: f => llmCmd.run(undefined, [], f),
     database: f => databaseCmd.run(undefined, [], f),
     crm: f => crmCmd.run(undefined, [], f),
+    fn: f => fnCmd.run(undefined, [], f),
+    payments: f => paymentsCmd.run(undefined, [], f),
     org: f => orgCmd.run(undefined, [], f),
     billing: f => billingCmd.run(undefined, [], f),
     keys: f => keysCmd.run(undefined, [], f),
@@ -358,6 +370,8 @@ Commands:
   update          Update CLI and skills to the latest version
   domain          Manage domain configurations
   funnel          Manage websites (publish pages, custom domains, funnels)
+  fn              Create and deploy functions on the edge runtime
+  payments        Take payments with Stripe Checkout (connect, charge, refund)
   webhook         Manage inbound webhook endpoints and inspect deliveries
   email           Manage mailboxes, send/read email, templates, and campaigns
   workflow        Run actions (send email, post to Slack) when a webhook fires

package/dist/sdk-domain-assign.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-domain-assign.test.js

@@ -0,0 +1,53 @@
+// Verifies the 2026-05-15 additive contract change: POST
+// /domain/.../{domain}/assign now accepts an optional `funnel_id` in the body.
+// SDK assignDomain takes `{ funnelId?: string }` and forwards it.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { domain } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const DOMAIN = 'example.com';
+const FUNNEL_ID = '33333333-3333-4333-8333-333333333333';
+let fetchMock;
+function ok(data) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn().mockResolvedValue(ok({
+        domain: DOMAIN, org_id: ORG_ID, include_www: true, routes_bound: [DOMAIN, `www.${DOMAIN}`],
+    }));
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('domain.assignDomain — funnel_id (additive 2026-05-15)', () => {
+    it('omits funnel_id from body by default (back-compat)', async () => {
+        await domain.assignDomain(API_KEY, ORG_ID, DOMAIN);
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ org_id: ORG_ID });
+        expect(body).not.toHaveProperty('funnel_id');
+    });
+    it('includes funnel_id when passed in opts', async () => {
+        await domain.assignDomain(API_KEY, ORG_ID, DOMAIN, { funnelId: FUNNEL_ID });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ org_id: ORG_ID, funnel_id: FUNNEL_ID });
+    });
+    it('combines funnel_id with include_www=false', async () => {
+        await domain.assignDomain(API_KEY, ORG_ID, DOMAIN, { funnelId: FUNNEL_ID, includeWww: false });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ org_id: ORG_ID, include_www: false, funnel_id: FUNNEL_ID });
+    });
+    it('omits funnel_id when it is empty string (treat as not-set)', async () => {
+        await domain.assignDomain(API_KEY, ORG_ID, DOMAIN, { funnelId: '' });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).not.toHaveProperty('funnel_id');
+    });
+    it('still works for unassignDomain (no funnel_id involved)', async () => {
+        await domain.unassignDomain(API_KEY, ORG_ID, DOMAIN);
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ org_id: null });
+    });
+});

package/dist/sdk-function.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-function.test.js

@@ -0,0 +1,257 @@
+// SDK-level unit tests for the function module. Verifies request URL/body
+// shape, response parsing, and error envelopes against the Story 1 contract
+// shipped by myapi-hq/internal/routes/function/crud.go.
+//
+// Mocks global fetch — does NOT hit the network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { fn, MyApiError } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const FN_ID = '22222222-2222-4222-8222-222222222222';
+let fetchMock;
+function ok(data, status = 200) {
+    // Backend wraps everything in `{ success, data, meta }`. The SDK unwraps.
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status = 422) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('fn.createFunction', () => {
+    it('POSTs to /function/orgs/{org_id}/functions with the bearer auth + JSON body', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: ORG_ID, name: 'my-app-api', trigger_type: 'http', invocation_url: '', created_at: 't1', updated_at: 't1' },
+            scoped_api_key: 'hq_live_scoped_xyz',
+            scoped_api_key_id: 'key_xyz',
+        }));
+        const result = await fn.createFunction(API_KEY, ORG_ID, { name: 'my-app-api', trigger_type: 'http' });
+        expect(fetchMock).toHaveBeenCalledOnce();
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        expect(init.headers['Content-Type']).toBe('application/json');
+        expect(JSON.parse(init.body)).toEqual({ name: 'my-app-api', trigger_type: 'http' });
+        expect(result.function.id).toBe(FN_ID);
+        expect(result.scoped_api_key).toBe('hq_live_scoped_xyz');
+        expect(result.scoped_api_key_id).toBe('key_xyz');
+        // Invocation URL is empty in Story 1 — populated by Story 2.
+        expect(result.function.invocation_url).toBe('');
+    });
+    it('passes cron_schedule through when trigger_type=cron', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: ORG_ID, name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *', invocation_url: '', created_at: 't1', updated_at: 't1' },
+            scoped_api_key: 'hq_live_scoped_xyz',
+            scoped_api_key_id: 'key_xyz',
+        }));
+        await fn.createFunction(API_KEY, ORG_ID, { name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *' });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *' });
+    });
+    it('encodes path params (defensive against : ? / # in org id)', async () => {
+        // UUIDs don't contain reserved chars in practice — but the SDK still
+        // encodes, so an alternate id with unsafe chars wouldn't break path
+        // routing.
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: 'org/with?weird#chars', name: 'x', trigger_type: 'http', invocation_url: '', created_at: 't', updated_at: 't' },
+            scoped_api_key: 'k', scoped_api_key_id: 'i',
+        }));
+        await fn.createFunction(API_KEY, 'org/with?weird#chars', { name: 'x' });
+        const [url] = fetchMock.mock.calls[0];
+        expect(url).toContain('/function/orgs/org%2Fwith%3Fweird%23chars/functions');
+    });
+    it('surfaces backend INVALID_NAME (422) as a typed MyApiError', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_NAME', 'name must match ^[a-z0-9][a-z0-9-]{0,49}$', 422));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'BAD NAME' }))
+            .rejects.toMatchObject({
+            name: 'MyApiError',
+            code: 'INVALID_NAME',
+            status: 422,
+        });
+    });
+    it('surfaces NAME_TAKEN (409) cleanly', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NAME_TAKEN', 'function name "x" is already used in this org', 409));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'NAME_TAKEN', status: 409 });
+    });
+    it('surfaces 401 (invalid api key)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('unauthorized', 'invalid api key', 401));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ status: 401 });
+    });
+    it('surfaces 403 SCOPE_FORBIDDEN when called with a slot_call-only key', async () => {
+        // 2026-05-15 enforcement: scoped api_keys with scopes=["slot_call"]
+        // can only call slot endpoints, not /hq/*, /admin/*, /internal/*.
+        // Note: /function/* IS a slot path, so SCOPE_FORBIDDEN shouldn't trigger
+        // here in practice — but the SDK must still surface it cleanly if it
+        // ever appears (e.g. for /hq/* mistakes).
+        fetchMock.mockResolvedValueOnce(fail('SCOPE_FORBIDDEN', 'this key cannot call /hq/* endpoints', 403));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'SCOPE_FORBIDDEN', status: 403 });
+    });
+    it('wraps non-JSON 5xx responses (HTML error pages) helpfully', async () => {
+        fetchMock.mockResolvedValueOnce(new Response('<html>502 Bad Gateway</html>', {
+            status: 502, headers: { 'content-type': 'text/html' },
+        }));
+        await expect(fn.createFunction(API_KEY, ORG_ID, { name: 'x' }))
+            .rejects.toMatchObject({ code: 'invalid_json_response', status: 502 });
+    });
+});
+describe('fn.listFunctions', () => {
+    it('GETs /function/orgs/{org_id}/functions with bearer auth + no body', async () => {
+        fetchMock.mockResolvedValueOnce(ok([
+            { id: FN_ID, org_id: ORG_ID, name: 'a', trigger_type: 'http', invocation_url: '', created_at: 't', updated_at: 't' },
+        ]));
+        const fns = await fn.listFunctions(API_KEY, ORG_ID);
+        expect(fns).toHaveLength(1);
+        expect(fns[0].name).toBe('a');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions`);
+        expect(init.method).toBe('GET');
+        expect(init.body).toBeUndefined();
+    });
+    it('returns an empty array when org has no functions', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        expect(await fn.listFunctions(API_KEY, ORG_ID)).toEqual([]);
+    });
+});
+describe('fn.getFunction', () => {
+    it('GETs /function/orgs/{org_id}/functions/{id}', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: FN_ID, org_id: ORG_ID, name: 'a', trigger_type: 'http', invocation_url: '', created_at: 't', updated_at: 't' }));
+        const got = await fn.getFunction(API_KEY, ORG_ID, FN_ID);
+        expect(got.id).toBe(FN_ID);
+        const [url] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}`);
+    });
+    it('throws function_not_found on 404', async () => {
+        fetchMock.mockResolvedValueOnce(fail('function_not_found', 'not found', 404));
+        await expect(fn.getFunction(API_KEY, ORG_ID, FN_ID))
+            .rejects.toMatchObject({ code: 'function_not_found', status: 404 });
+    });
+});
+describe('fn.deleteFunction', () => {
+    it('DELETEs /function/orgs/{org_id}/functions/{id}', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        await fn.deleteFunction(API_KEY, ORG_ID, FN_ID);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}`);
+        expect(init.method).toBe('DELETE');
+    });
+});
+describe('fn.uploadBundle', () => {
+    it('POSTs multipart to /bundle with the `bundle` field + bearer auth', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: ORG_ID, name: 'my-app-api', trigger_type: 'http', invocation_url: 'https://x.fn.myapihq.com', created_at: 't', updated_at: 't' },
+            invocation_url: 'https://x.fn.myapihq.com',
+            scoped_api_key: 'hq_live_rotated_abc',
+        }));
+        const result = await fn.uploadBundle(API_KEY, ORG_ID, FN_ID, 'export default {}', 'app.js');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}/bundle`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        // multipart — body is FormData, no JSON Content-Type set by the SDK.
+        expect(init.body).toBeInstanceOf(FormData);
+        expect(init.body.has('bundle')).toBe(true);
+        expect(result.invocation_url).toBe('https://x.fn.myapihq.com');
+        expect(result.scoped_api_key).toBe('hq_live_rotated_abc');
+    });
+    it('surfaces BUNDLE_TOO_LARGE (413) as a typed MyApiError', async () => {
+        fetchMock.mockResolvedValueOnce(fail('BUNDLE_TOO_LARGE', 'bundle exceeds 4MB', 413));
+        await expect(fn.uploadBundle(API_KEY, ORG_ID, FN_ID, 'x'))
+            .rejects.toMatchObject({ code: 'BUNDLE_TOO_LARGE', status: 413 });
+    });
+    it('surfaces RUNTIME_UNAVAILABLE (503)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('RUNTIME_UNAVAILABLE', 'cf not configured', 503));
+        await expect(fn.uploadBundle(API_KEY, ORG_ID, FN_ID, 'x'))
+            .rejects.toMatchObject({ code: 'RUNTIME_UNAVAILABLE', status: 503 });
+    });
+});
+describe('fn.setFunctionEnv', () => {
+    it('POSTs {name,value} JSON and resolves on 204', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        await fn.setFunctionEnv(API_KEY, ORG_ID, FN_ID, 'STRIPE_KEY', 'sk_live_x');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}/env`);
+        expect(init.method).toBe('POST');
+        expect(JSON.parse(init.body)).toEqual({ name: 'STRIPE_KEY', value: 'sk_live_x' });
+    });
+    it('surfaces NOT_DEPLOYED (409) when the function has no bundle yet', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NOT_DEPLOYED', 'deploy a bundle first', 409));
+        await expect(fn.setFunctionEnv(API_KEY, ORG_ID, FN_ID, 'K', 'v'))
+            .rejects.toMatchObject({ code: 'NOT_DEPLOYED', status: 409 });
+    });
+});
+describe('fn.listFunctionRuns', () => {
+    it('GETs /runs and returns the run records', async () => {
+        fetchMock.mockResolvedValueOnce(ok([
+            { id: 'run_1', function_id: FN_ID, invoked_at: 't', duration_ms: 12, status: 'ok' },
+            { id: 'run_2', function_id: FN_ID, invoked_at: 't', status: 'error', error_message: 'boom' },
+        ]));
+        const runs = await fn.listFunctionRuns(API_KEY, ORG_ID, FN_ID);
+        expect(runs).toHaveLength(2);
+        expect(runs[1].error_message).toBe('boom');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}/runs`);
+        expect(init.method).toBe('GET');
+    });
+    it('returns an empty array when there are no runs', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        expect(await fn.listFunctionRuns(API_KEY, ORG_ID, FN_ID)).toEqual([]);
+    });
+});
+describe('fn.EXPOSES', () => {
+    it('matches the Story 1 + Story 2/4/5 contract — exactly 7 endpoints', () => {
+        expect(fn.EXPOSES).toEqual([
+            'POST /function/orgs/{org_id}/functions',
+            'GET /function/orgs/{org_id}/functions',
+            'GET /function/orgs/{org_id}/functions/{id}',
+            'DELETE /function/orgs/{org_id}/functions/{id}',
+            'POST /function/orgs/{org_id}/functions/{id}/bundle',
+            'POST /function/orgs/{org_id}/functions/{id}/env',
+            'GET /function/orgs/{org_id}/functions/{id}/runs',
+        ]);
+    });
+    it('exposes deploy/env/runs but not /logs (still pending)', () => {
+        const flat = fn.EXPOSES.join(' ');
+        expect(flat).toContain('/bundle');
+        expect(flat).toContain('/env');
+        expect(flat).toContain('/runs');
+        expect(flat).not.toContain('/logs');
+    });
+});
+// MyApiError is the universal error shape callers can `instanceof`-check or
+// switch on `.code`. Validate it surfaces the right fields from typed
+// (object) errors and raw-string errors alike.
+describe('MyApiError surfacing', () => {
+    it('preserves the body object on object-shaped errors (for CF_API_ERROR etc.)', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(JSON.stringify({
+            success: false,
+            error: { code: 'CF_API_ERROR', message: 'cf failed', cf_message: 'Forbidden zone', cf_status: 403 },
+            meta: {},
+        }), { status: 500, headers: { 'content-type': 'application/json' } }));
+        try {
+            await fn.createFunction(API_KEY, ORG_ID, { name: 'x' });
+            expect.fail('Should have thrown');
+        }
+        catch (e) {
+            expect(e).toBeInstanceOf(MyApiError);
+            const err = e;
+            expect(err.code).toBe('CF_API_ERROR');
+            expect(err.body?.cf_message).toBe('Forbidden zone');
+            expect(err.body?.cf_status).toBe(403);
+        }
+    });
+});

package/dist/sdk-funnel-name.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-funnel-name.test.js

@@ -0,0 +1,48 @@
+// 2026-05-15: POST /funnel/orgs/{org_id}/funnels now accepts optional
+// `name` (defaults server-side to the org's preview_subdomain). SDK
+// createFunnel was extended to forward { name } through.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { funnel } from '@myapihq/sdk';
+const API_KEY = 'myapi_test';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+let fetchMock;
+function ok(data) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn().mockResolvedValue(ok({
+        funnel: { id: 'f1', org_id: ORG_ID, name: 'my-app', created_at: 't', updated_at: 't' },
+        subdomain_url: 'https://my-app.makeautonomous.com',
+    }));
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => { vi.restoreAllMocks(); });
+describe('funnel.createFunnel — name (additive 2026-05-15)', () => {
+    it('omits name from body when not provided (back-compat — server picks preview_subdomain)', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID);
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({});
+    });
+    it('omits name when opts is provided but has no name', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID, {});
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({});
+    });
+    it('includes name when provided', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID, { name: 'my-app' });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ name: 'my-app' });
+    });
+    it('hits the right path and method', async () => {
+        await funnel.createFunnel(API_KEY, ORG_ID, { name: 'x' });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/funnel/orgs/${ORG_ID}/funnels`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+    });
+    it('returns the funnel with name populated', async () => {
+        const result = await funnel.createFunnel(API_KEY, ORG_ID, { name: 'my-app' });
+        expect(result.funnel.name).toBe('my-app');
+        expect(result.subdomain_url).toBe('https://my-app.makeautonomous.com');
+    });
+});

package/dist/sdk-funnel-publish.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-funnel-publish.test.js

@@ -0,0 +1,89 @@
+// SDK-level unit tests for funnel.publishFiles — the my-funnel-api v2
+// directory publish. Verifies the multipart shape (all parts named `files`,
+// each part's filename = the site path), the form fields, and response
+// parsing against myapi-hq/internal/routes/funnel/files.go.
+//
+// Mocks global fetch — does NOT hit the network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { funnel } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const FUNNEL_ID = '44444444-4444-4444-8444-444444444444';
+let fetchMock;
+function ok(data, status = 201) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status = 422) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('funnel.publishFiles', () => {
+    it('POSTs multipart to /files with one `files` part per file + bearer auth', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            manifest_id: 'm1', channel: 'prod', file_count: 2, size_bytes: 42,
+            spa_mode: true, published_url: 'https://site.makeautonomous.com',
+        }));
+        const res = await funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, [
+            { path: 'index.html', content: '<h1>hi</h1>' },
+            { path: 'assets/app.js', content: 'console.log(1)' },
+        ]);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/funnel/orgs/${ORG_ID}/funnels/${FUNNEL_ID}/files`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        expect(init.body).toBeInstanceOf(FormData);
+        // Both files share the part name `files`.
+        expect(init.body.getAll('files')).toHaveLength(2);
+        expect(res.file_count).toBe(2);
+        expect(res.published_url).toBe('https://site.makeautonomous.com');
+    });
+    it('includes env / spa_mode / api_function_id form fields when given', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            manifest_id: 'm1', channel: 'dev', file_count: 1, size_bytes: 10,
+            spa_mode: false, published_url: 'https://site-dev.makeautonomous.com',
+        }));
+        await funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, [{ path: 'index.html', content: 'x' }], { env: 'dev', spaMode: false, apiFunctionId: 'fn_1' });
+        const body = fetchMock.mock.calls[0][1].body;
+        expect(body.get('env')).toBe('dev');
+        expect(body.get('spa_mode')).toBe('false');
+        expect(body.get('api_function_id')).toBe('fn_1');
+    });
+    it('omits optional form fields when not given', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            manifest_id: 'm1', channel: 'prod', file_count: 1, size_bytes: 10,
+            spa_mode: true, published_url: 'https://site.makeautonomous.com',
+        }));
+        await funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, [{ path: 'index.html', content: 'x' }]);
+        const body = fetchMock.mock.calls[0][1].body;
+        expect(body.has('env')).toBe(false);
+        expect(body.has('spa_mode')).toBe(false);
+        expect(body.has('api_function_id')).toBe(false);
+    });
+    it('surfaces NO_FILES (422) as a typed MyApiError', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NO_FILES', 'files field required', 422));
+        await expect(funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, []))
+            .rejects.toMatchObject({ code: 'NO_FILES', status: 422 });
+    });
+    it('surfaces publish_too_large (413)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('publish_too_large', 'exceeds 25MB', 413));
+        await expect(funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, [{ path: 'big', content: 'x' }]))
+            .rejects.toMatchObject({ code: 'publish_too_large', status: 413 });
+    });
+});
+describe('funnel.EXPOSES includes the v2 publish endpoint', () => {
+    it('lists POST .../files', () => {
+        expect(funnel.EXPOSES).toContain('POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files');
+    });
+});

package/dist/sdk-iam.test.d.ts

@@ -0,0 +1 @@
+export {};