@myapihq/cli 1.2.4 → 1.2.6

package/dist/sdk-iam.test.js

@@ -0,0 +1,190 @@
+// SDK unit tests for the capability-IAM + spend-cap surface shipped
+// 2026-05-15 (design-iam-capability-keys-2026-05-15.md). Verifies request
+// URL/body shape, response parsing, and error envelopes. Mocks global
+// fetch — no network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { hq, MyApiError } from '@myapihq/sdk';
+const KEY = 'hq_live_caller';
+const ORG = '11111111-1111-4111-8111-111111111111';
+let fetchMock;
+function ok(data, status = 200) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+function bodyOf(call) {
+    return JSON.parse(fetchMock.mock.calls[call][1].body);
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => vi.restoreAllMocks());
+// A representative keyView the backend returns.
+const KEY_VIEW = {
+    id: 'key_1', name: 'ci', prefix: 'hq_live_ab', kind: 'manual',
+    org_id: null, grants: { '*': 'write' },
+    spend_cap_cents: null, spend_cap_period: 'month',
+};
+describe('hq.createApiKey', () => {
+    it('POSTs to /hq/account/create/key with just {name} when no opts given', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ ...KEY_VIEW, api_key: 'hq_live_secret' }));
+        const key = await hq.createApiKey(KEY, 'ci');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain('/hq/account/create/key');
+        expect(init.method).toBe('POST');
+        expect(bodyOf(0)).toEqual({ name: 'ci' });
+        expect(key.api_key).toBe('hq_live_secret');
+        expect(key.kind).toBe('manual');
+    });
+    it('includes grants / org_id / spend_cap_cents when opts are passed', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            ...KEY_VIEW, org_id: ORG, grants: { email: 'write', crm: 'read' },
+            spend_cap_cents: 5000, api_key: 'hq_live_secret',
+        }));
+        await hq.createApiKey(KEY, 'billing-fn', {
+            grants: { email: 'write', crm: 'read' },
+            orgId: ORG,
+            spendCapCents: 5000,
+        });
+        expect(bodyOf(0)).toEqual({
+            name: 'billing-fn',
+            grants: { email: 'write', crm: 'read' },
+            org_id: ORG,
+            spend_cap_cents: 5000,
+        });
+    });
+    it('sends spend_cap_cents: 0 (a real cap of $0) but omits when undefined', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ ...KEY_VIEW, api_key: 'k' }));
+        await hq.createApiKey(KEY, 'zero', { spendCapCents: 0 });
+        expect(bodyOf(0)).toEqual({ name: 'zero', spend_cap_cents: 0 });
+    });
+    it('surfaces INVALID_GRANTS (422)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_GRANTS', 'unknown slot', 422));
+        await expect(hq.createApiKey(KEY, 'x', { grants: { bogus: 'write' } }))
+            .rejects.toMatchObject({ code: 'INVALID_GRANTS', status: 422 });
+    });
+    it('surfaces SCOPE_FORBIDDEN (403) when the request would escalate', async () => {
+        fetchMock.mockResolvedValueOnce(fail('SCOPE_FORBIDDEN', 'requested grants exceed authority', 403));
+        await expect(hq.createApiKey(KEY, 'x', { grants: { '*': 'write' } }))
+            .rejects.toMatchObject({ code: 'SCOPE_FORBIDDEN', status: 403 });
+    });
+});
+describe('hq.listApiKeys', () => {
+    it('GETs /hq/account/keys and returns the ApiKey[] shape', async () => {
+        fetchMock.mockResolvedValueOnce(ok([
+            { ...KEY_VIEW, id: 'k1' },
+            { ...KEY_VIEW, id: 'k2', kind: 'function', org_id: ORG,
+                grants: { email: 'write' }, spend_cap_cents: 2500,
+                current_period_spend_cents: 800 },
+        ]));
+        const keys = await hq.listApiKeys(KEY);
+        expect(fetchMock.mock.calls[0][1].method).toBe('GET');
+        expect(keys).toHaveLength(2);
+        expect(keys[1].kind).toBe('function');
+        expect(keys[1].current_period_spend_cents).toBe(800);
+        expect(keys[1].spend_cap_cents).toBe(2500);
+    });
+    it('returns [] when the account has no keys', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        expect(await hq.listApiKeys(KEY)).toEqual([]);
+    });
+});
+describe('hq.revokeAllKeys', () => {
+    it('POSTs an empty body for "all kinds"', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ revoked: 7 }));
+        const res = await hq.revokeAllKeys(KEY);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain('/hq/account/keys/revoke-all');
+        expect(init.method).toBe('POST');
+        expect(bodyOf(0)).toEqual({});
+        expect(res.revoked).toBe(7);
+    });
+    it('includes {kind} when narrowing', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ revoked: 3 }));
+        await hq.revokeAllKeys(KEY, 'function');
+        expect(bodyOf(0)).toEqual({ kind: 'function' });
+    });
+    it('surfaces INVALID_KIND (422)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_KIND', 'bad kind', 422));
+        await expect(hq.revokeAllKeys(KEY, 'bogus'))
+            .rejects.toMatchObject({ code: 'INVALID_KIND', status: 422 });
+    });
+});
+describe('hq.setAccountSpendCap', () => {
+    it('PATCHes a cents value', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ spend_cap_cents: 5000, spend_cap_period: 'month' }));
+        const res = await hq.setAccountSpendCap(KEY, 5000);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain('/hq/account/spend-cap');
+        expect(init.method).toBe('PATCH');
+        expect(bodyOf(0)).toEqual({ spend_cap_cents: 5000 });
+        expect(res.spend_cap_period).toBe('month');
+    });
+    it('PATCHes null to clear the cap', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ spend_cap_cents: null, spend_cap_period: 'month' }));
+        await hq.setAccountSpendCap(KEY, null);
+        expect(bodyOf(0)).toEqual({ spend_cap_cents: null });
+    });
+    it('includes period when given', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ spend_cap_cents: 500, spend_cap_period: 'day' }));
+        await hq.setAccountSpendCap(KEY, 500, 'day');
+        expect(bodyOf(0)).toEqual({ spend_cap_cents: 500, period: 'day' });
+    });
+    it('surfaces INVALID_PERIOD (422)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_PERIOD', 'bad period', 422));
+        await expect(hq.setAccountSpendCap(KEY, 500, 'week'))
+            .rejects.toMatchObject({ code: 'INVALID_PERIOD', status: 422 });
+    });
+});
+describe('hq.getAccount — spend-cap fields', () => {
+    it('parses spend_cap_cents + current_period_spend_cents', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            account_id: 'acc_1', email: 'x@y.com',
+            spend_cap_cents: 5000, current_period_spend_cents: 4200,
+        }));
+        const acct = await hq.getAccount(KEY);
+        expect(acct.spend_cap_cents).toBe(5000);
+        expect(acct.current_period_spend_cents).toBe(4200);
+    });
+    it('tolerates an account with no cap set (fields absent)', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ account_id: 'acc_1', email: 'x@y.com' }));
+        const acct = await hq.getAccount(KEY);
+        expect(acct.spend_cap_cents).toBeUndefined();
+    });
+});
+describe('hq IAM contract surface', () => {
+    it('EXPOSES includes the 2026-05-15 endpoints', () => {
+        expect(hq.EXPOSES).toContain('POST /hq/account/keys/revoke-all');
+        expect(hq.EXPOSES).toContain('PATCH /hq/account/spend-cap');
+    });
+    it('GRANTABLE_SLOTS matches the backend iam.GrantableSlots vocabulary', () => {
+        expect([...hq.GRANTABLE_SLOTS].sort()).toEqual(['audience', 'company', 'crm', 'database', 'domain', 'email', 'function',
+            'funnel', 'image', 'llm', 'people', 'storage', 'url', 'webhook', 'workflow']);
+    });
+    it('GRANTABLE_SLOTS excludes management/non-grantable surfaces', () => {
+        for (const s of ['hq', 'admin', 'internal', 'schema', 'ops', 'pixel']) {
+            expect(hq.GRANTABLE_SLOTS).not.toContain(s);
+        }
+    });
+});
+// MyApiError is the universal error shape — confirm IAM errors carry the body.
+describe('MyApiError on IAM rejections', () => {
+    it('preserves code + status', async () => {
+        fetchMock.mockResolvedValueOnce(fail('SCOPE_FORBIDDEN', 'an org-scoped key can only mint same-org keys', 403));
+        try {
+            await hq.createApiKey(KEY, 'x', { orgId: ORG });
+            expect.fail('should have thrown');
+        }
+        catch (e) {
+            expect(e).toBeInstanceOf(MyApiError);
+            expect(e.code).toBe('SCOPE_FORBIDDEN');
+            expect(e.status).toBe(403);
+        }
+    });
+});

package/dist/sdk-payments.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-payments.test.js

@@ -0,0 +1,139 @@
+// SDK-level unit tests for the payments module. Verifies request URL/body
+// shape, response parsing, and error envelopes against the T0 contract
+// shipped by myapi-hq/internal/routes/payments/.
+//
+// Mocks global fetch — does NOT hit the network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { payments } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const CHARGE_ID = '33333333-3333-4333-8333-333333333333';
+let fetchMock;
+function ok(data, status = 200) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status = 422) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('payments.connect', () => {
+    it('POSTs {tier:"t0",stripe_secret_key} to /connect', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ tier: 't0', stripe_account_id: 'acct_1', onboarding_status: 'complete' }, 201));
+        const res = await payments.connect(API_KEY, ORG_ID, 'sk_live_xyz');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/payments/orgs/${ORG_ID}/connect`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        expect(JSON.parse(init.body)).toEqual({ tier: 't0', stripe_secret_key: 'sk_live_xyz' });
+        expect(res.stripe_account_id).toBe('acct_1');
+    });
+    it('passes tier through so a t1 caller can see the deferral', async () => {
+        fetchMock.mockResolvedValueOnce(fail('T1_DEFERRED', 'Connect Express is not yet available', 501));
+        await expect(payments.connect(API_KEY, ORG_ID, 'sk_x', 't1'))
+            .rejects.toMatchObject({ code: 'T1_DEFERRED', status: 501 });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body).tier).toBe('t1');
+    });
+    it('surfaces KEY_REJECTED (422)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('KEY_REJECTED', 'Stripe rejected the key', 422));
+        await expect(payments.connect(API_KEY, ORG_ID, 'sk_bad'))
+            .rejects.toMatchObject({ code: 'KEY_REJECTED', status: 422 });
+    });
+});
+describe('payments.getConnect', () => {
+    it('GETs /connect and returns the status', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ tier: 't0', stripe_account_id: 'acct_1', onboarding_status: 'complete', application_fee_bps: 0 }));
+        const res = await payments.getConnect(API_KEY, ORG_ID);
+        expect(res.application_fee_bps).toBe(0);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/payments/orgs/${ORG_ID}/connect`);
+        expect(init.method).toBe('GET');
+    });
+    it('surfaces NOT_CONNECTED (404)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NOT_CONNECTED', 'no Stripe connection', 404));
+        await expect(payments.getConnect(API_KEY, ORG_ID))
+            .rejects.toMatchObject({ code: 'NOT_CONNECTED', status: 404 });
+    });
+});
+describe('payments.createCharge', () => {
+    it('POSTs the charge payload and returns the checkout URL', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ payment_id: CHARGE_ID, checkout_url: 'https://checkout.stripe.com/x', status: 'pending' }, 201));
+        const res = await payments.createCharge(API_KEY, ORG_ID, { amount_cents: 1900, description: 'Pro plan' });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/payments/orgs/${ORG_ID}/charges`);
+        expect(init.method).toBe('POST');
+        expect(JSON.parse(init.body)).toEqual({ amount_cents: 1900, description: 'Pro plan' });
+        expect(res.checkout_url).toBe('https://checkout.stripe.com/x');
+        expect(res.payment_id).toBe(CHARGE_ID);
+    });
+    it('passes `every` through for subscriptions', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ payment_id: CHARGE_ID, checkout_url: 'u', status: 'pending' }, 201));
+        await payments.createCharge(API_KEY, ORG_ID, { amount_cents: 999, every: 'month' });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body).every).toBe('month');
+    });
+    it('surfaces NOT_CONNECTED (409) when Stripe is not linked', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NOT_CONNECTED', 'connect Stripe first', 409));
+        await expect(payments.createCharge(API_KEY, ORG_ID, { amount_cents: 100 }))
+            .rejects.toMatchObject({ code: 'NOT_CONNECTED', status: 409 });
+    });
+});
+describe('payments.listCharges / getCharge', () => {
+    it('GETs the charge list', async () => {
+        fetchMock.mockResolvedValueOnce(ok([
+            { id: CHARGE_ID, amount_cents: 1900, currency: 'usd', status: 'succeeded', created_at: 't' },
+        ]));
+        const list = await payments.listCharges(API_KEY, ORG_ID);
+        expect(list).toHaveLength(1);
+        expect(list[0].amount_cents).toBe(1900);
+    });
+    it('GETs a single charge', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: CHARGE_ID, amount_cents: 1900, currency: 'usd', status: 'succeeded', created_at: 't' }));
+        const c = await payments.getCharge(API_KEY, ORG_ID, CHARGE_ID);
+        expect(c.id).toBe(CHARGE_ID);
+        expect(fetchMock.mock.calls[0][0]).toContain(`/payments/orgs/${ORG_ID}/charges/${CHARGE_ID}`);
+    });
+    it('surfaces charge_not_found (404)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('charge_not_found', 'not found', 404));
+        await expect(payments.getCharge(API_KEY, ORG_ID, CHARGE_ID))
+            .rejects.toMatchObject({ code: 'charge_not_found', status: 404 });
+    });
+});
+describe('payments.refundCharge', () => {
+    it('POSTs to /refund and returns the refunded status', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: CHARGE_ID, status: 'refunded' }));
+        const res = await payments.refundCharge(API_KEY, ORG_ID, CHARGE_ID);
+        expect(res.status).toBe('refunded');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/payments/orgs/${ORG_ID}/charges/${CHARGE_ID}/refund`);
+        expect(init.method).toBe('POST');
+    });
+    it('surfaces "already refunded" (409)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('charge already refunded', 'charge already refunded', 409));
+        await expect(payments.refundCharge(API_KEY, ORG_ID, CHARGE_ID))
+            .rejects.toMatchObject({ status: 409 });
+    });
+});
+describe('payments.EXPOSES', () => {
+    it('covers connect, charges CRUD, refund, and the webhook', () => {
+        expect(payments.EXPOSES).toEqual([
+            'POST /payments/orgs/{org_id}/connect',
+            'GET /payments/orgs/{org_id}/connect',
+            'POST /payments/orgs/{org_id}/charges',
+            'GET /payments/orgs/{org_id}/charges',
+            'GET /payments/orgs/{org_id}/charges/{id}',
+            'POST /payments/orgs/{org_id}/charges/{id}/refund',
+            'POST /payments/webhook/{org_id}',
+        ]);
+    });
+});

package/dist/sdk-webhook.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-webhook.test.js

@@ -0,0 +1,86 @@
+// 2026-05-15 additive changes for my-webhook-api:
+//   - POST /webhook/orgs/{org_id}/endpoints body now accepts forward_url.
+//   - PATCH /webhook/orgs/{org_id}/endpoints/{id} is a new endpoint.
+//
+// Both surfaced through the SDK (createEndpoint+forward_url, updateEndpoint).
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { webhook } from '@myapihq/sdk';
+const API_KEY = 'myapi_test';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const ENDPOINT_ID = '22222222-2222-4222-8222-222222222222';
+let fetchMock;
+function ok(data) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn().mockResolvedValue(ok({
+        id: ENDPOINT_ID, org_id: ORG_ID, name: 'x', slug: 'abc', url: 'https://webhook/in/abc',
+    }));
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('webhook.createEndpoint — forward_url (additive 2026-05-15)', () => {
+    it('omits forward_url by default (back-compat)', async () => {
+        await webhook.createEndpoint(API_KEY, ORG_ID, 'my-hook');
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({ name: 'my-hook' });
+        expect(body).not.toHaveProperty('forward_url');
+    });
+    it('includes forward_url when passed', async () => {
+        await webhook.createEndpoint(API_KEY, ORG_ID, 'my-hook', {
+            forward_url: 'https://example.com/forward',
+        });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body.forward_url).toBe('https://example.com/forward');
+    });
+    it('allows explicit empty string for forward_url (clears it)', async () => {
+        await webhook.createEndpoint(API_KEY, ORG_ID, 'my-hook', { forward_url: '' });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toHaveProperty('forward_url', '');
+    });
+    it('combines forward_url with other options', async () => {
+        await webhook.createEndpoint(API_KEY, ORG_ID, 'my-hook', {
+            description: 'Stripe events',
+            crm_email_path: 'data.object.customer_email',
+            forward_url: 'https://example.com/forward',
+        });
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toEqual({
+            name: 'my-hook',
+            description: 'Stripe events',
+            crm_email_path: 'data.object.customer_email',
+            forward_url: 'https://example.com/forward',
+        });
+    });
+});
+describe('webhook.updateEndpoint — PATCH (new 2026-05-15)', () => {
+    it('PATCHes /webhook/orgs/{org_id}/endpoints/{id}', async () => {
+        await webhook.updateEndpoint(API_KEY, ORG_ID, ENDPOINT_ID, { name: 'renamed' });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/webhook/orgs/${ORG_ID}/endpoints/${ENDPOINT_ID}`);
+        expect(init.method).toBe('PATCH');
+        expect(JSON.parse(init.body)).toEqual({ name: 'renamed' });
+    });
+    it('sends only the fields that were provided', async () => {
+        await webhook.updateEndpoint(API_KEY, ORG_ID, ENDPOINT_ID, {
+            forward_url: 'https://other.example.com/fwd',
+        });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({
+            forward_url: 'https://other.example.com/fwd',
+        });
+    });
+    it('preserves empty-string sentinel (explicit clear)', async () => {
+        await webhook.updateEndpoint(API_KEY, ORG_ID, ENDPOINT_ID, { forward_url: '' });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).toEqual({ forward_url: '' });
+    });
+});
+describe('webhook.EXPOSES — current contract', () => {
+    it('includes PATCH for endpoints (2026-05-15)', () => {
+        expect(webhook.EXPOSES).toContain('PATCH /webhook/orgs/{org_id}/endpoints/{endpoint_id}');
+    });
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -18,6 +18,8 @@
     "test": "vitest run src test/scripts",
     "test:smoke": "npm run build && vitest run src test/smoke test/scripts",
     "test:online": "npm run build && MYAPI_RUN_RESET=1 vitest run test/online",
+    "test:realistic": "npm run build && MYAPI_RUN_REALISTIC=1 vitest run test/realistic/autonomous-company.test.ts",
+    "test:realistic:cleanup": "npm run build && vitest run test/realistic/cleanup.test.ts",
     "test:all": "npm run build && MYAPI_RUN_RESET=1 vitest run src test/smoke test/scripts test/online",
     "check-coverage": "npm run build && node scripts/check-coverage.js",
     "check-coverage:live": "npm run build && node scripts/check-coverage.js --live",
@@ -27,7 +29,7 @@
     "lint:changelog": "node ../../scripts/lint-changelog.js"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.2.4",
+    "@myapihq/sdk": "^1.2.6",
     "omelette": "^0.4.17"
   },
   "devDependencies": {