@myapihq/cli 1.2.5 → 1.2.6

package/dist/commands/billing.d.ts

@@ -8,3 +8,4 @@ export declare function balance(flags: Flags): Promise<void>;
 export declare function history(flags: Flags): Promise<void>;
 export declare function topup(amountStr: string, flags: Flags): Promise<void>;
 export declare function setup(_flags: Flags): Promise<void>;
+export declare function spendCap(arg: string | undefined, flags: Flags): Promise<void>;

package/dist/commands/billing.js

@@ -3,12 +3,16 @@ import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson } from '../output.js';
 import { confirm, isNonInteractive } from '../prompt.js';
 import { formatDate } from '../utils.js';
-export const SCHEMA = {};
+export const SCHEMA = {
+    period: 'string', // spend-cap window: month | day
+};
 export const EXPOSES = [
     'GET /hq/billing/balance',
     'GET /hq/billing/history',
     'POST /hq/billing/setup-payment',
     'POST /hq/billing/topup',
+    'GET /hq/account/me',
+    'PATCH /hq/account/spend-cap',
 ];
 const SUBCOMMAND_USAGE = {
     'balance': 'myapi billing balance [--json]',
@@ -20,6 +24,18 @@ Confirmation is required for amounts of $50 or more — pass --yes to skip it.
 
 Example: myapi billing topup 10`,
     'setup': 'myapi billing setup',
+    'spend-cap': `myapi billing spend-cap [<amount> | clear] [--period month|day]
+
+The account-level spend ceiling (IAM "Layer 2") — a self-imposed limit
+*below* your balance that bounds total spend across every key and function.
+
+  myapi billing spend-cap              Show the current cap + period spend
+  myapi billing spend-cap 50           Cap total spend at $50/month
+  myapi billing spend-cap 5 --period day   Cap at $5/day
+  myapi billing spend-cap clear         Remove the cap
+
+This is distinct from a per-key cap (myapi keys create --spend-cap). The
+account cap is the aggregate backstop; per-key caps bound each credential.`,
 };
 export async function run(subcommand, args, flags) {
     if (!subcommand || (flags.help && !subcommand)) {
@@ -29,7 +45,8 @@ Subcommands:
   balance    Check balance, credits, and payment method status
   history    View recent transactions and top-ups
   topup      Top up your balance (whole dollars)
-  setup      Open a checkout link to add or update payment method`);
+  setup      Open a checkout link to add or update payment method
+  spend-cap  Set/show/clear the account-level spend ceiling (IAM Layer 2)`);
         return;
     }
     if (flags.help) {
@@ -45,6 +62,7 @@ Subcommands:
         case 'history': return history(flags);
         case 'topup': return topup(args[0], flags);
         case 'setup': return setup(flags);
+        case 'spend-cap': return spendCap(args[0], flags);
         default: error(`Unknown subcommand: ${subcommand}. Run "myapi billing --help" for available subcommands.`);
     }
 }
@@ -114,3 +132,44 @@ export async function setup(_flags) {
     const result = await hq.setupPayment(config.api_key);
     success(`Open this URL in your browser to set up payment:\n${result.url}`);
 }
+// The account-level spend ceiling. No arg → show; "clear" → remove; a
+// dollar amount → set. Distinct from per-key caps (myapi keys create
+// --spend-cap): this is the aggregate backstop across the whole account.
+export async function spendCap(arg, flags) {
+    const config = requireConfig();
+    if (!arg) {
+        const acct = await hq.getAccount(config.api_key);
+        if (flags.json) {
+            printJson({
+                spend_cap_cents: acct.spend_cap_cents ?? null,
+                current_period_spend_cents: acct.current_period_spend_cents ?? null,
+            });
+            return;
+        }
+        if (acct.spend_cap_cents == null) {
+            info('No account spend cap set.');
+            info('Set one with: myapi billing spend-cap <dollars> [--period month|day]');
+        }
+        else {
+            const spent = acct.current_period_spend_cents ?? 0;
+            info(`Account spend cap: $${(spent / 100).toFixed(2)} spent / $${(acct.spend_cap_cents / 100).toFixed(2)} this period`);
+        }
+        return;
+    }
+    if (arg === 'clear' || arg === 'none') {
+        await hq.setAccountSpendCap(config.api_key, null);
+        success('Account spend cap cleared.');
+        return;
+    }
+    const dollars = Number(arg);
+    if (!Number.isFinite(dollars) || dollars < 0) {
+        error(`Invalid amount "${arg}". Use a non-negative dollar amount, or "clear" to remove the cap.\nExample: myapi billing spend-cap 50`);
+    }
+    const period = flags.period || 'month';
+    if (period !== 'month' && period !== 'day') {
+        error(`Invalid --period "${period}". Use month or day.`);
+    }
+    const res = await hq.setAccountSpendCap(config.api_key, Math.round(dollars * 100), period);
+    const cents = res.spend_cap_cents ?? Math.round(dollars * 100);
+    success(`Account spend cap set: $${(cents / 100).toFixed(2)} per ${res.spend_cap_period}.`);
+}

package/dist/commands/domain.js

@@ -16,6 +16,11 @@ export const EXPOSES = [
     'GET /domain/orgs/{org_id}/{domain}/status',
     'POST /domain/orgs/{org_id}/{domain}/email-infra',
     'POST /domain/orgs/{org_id}/{domain}/retry-provisioning',
+    'GET /domain/orgs/{org_id}/{domain}/records',
+    'POST /domain/orgs/{org_id}/{domain}/records',
+    'GET /domain/orgs/{org_id}/{domain}/records/{record_id}',
+    'PATCH /domain/orgs/{org_id}/{domain}/records/{record_id}',
+    'DELETE /domain/orgs/{org_id}/{domain}/records/{record_id}',
 ];
 export const SCHEMA = {
     org: 'string',

package/dist/commands/fn.d.ts

@@ -10,4 +10,7 @@ export declare function create(flags: Flags): Promise<void>;
 export declare function list(flags: Flags): Promise<void>;
 export declare function get(id: string, flags: Flags): Promise<void>;
 export declare function del(id: string, flags: Flags): Promise<void>;
+export declare function deploy(id: string, bundlePath: string, flags: Flags): Promise<void>;
+export declare function setEnv(id: string, name: string, value: string, flags: Flags): Promise<void>;
+export declare function runs(id: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/fn.js

@@ -1,20 +1,23 @@
+import { readFile } from 'fs/promises';
 import { fn as sdkFn } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson, banner } from '../output.js';
+import { formatDate } from '../utils.js';
 import { requireOrg } from '../helpers.js';
 export const EXPOSES = [
     'POST /function/orgs/{org_id}/functions',
     'GET /function/orgs/{org_id}/functions',
     'GET /function/orgs/{org_id}/functions/{id}',
     'DELETE /function/orgs/{org_id}/functions/{id}',
+    'POST /function/orgs/{org_id}/functions/{id}/bundle',
+    'POST /function/orgs/{org_id}/functions/{id}/env',
+    'GET /function/orgs/{org_id}/functions/{id}/runs',
 ];
 export const SCHEMA = {
     cron: 'string',
 };
-// Backend: Story 1. The function CRUD persists metadata + issues a scoped
-// API key, but does NOT yet upload a JS bundle to Cloudflare Workers (Story
-// 2). So this CLI surface is intentionally narrow — `create` registers a
-// function, not "deploy" — keeping verb honesty until bundle upload ships.
+// Backend: Story 1 (function CRUD + scoped key) and Story 2/4/5 (deploy a
+// JS bundle to Cloudflare Workers, list runs, set env secrets).
 // Mirrors validateName in myapi-hq/internal/routes/function/crud.go. We
 // pre-validate client-side so typos fail before the network call; backend
 // runs the same regex as defence in depth.
@@ -45,7 +48,7 @@ function summarizeFn(f) {
         id: f.id,
         name: f.name,
         trigger: f.trigger_type === 'cron' ? `cron ${f.cron_schedule ?? '?'}` : 'http',
-        url: f.invocation_url || '(pending Story 2)',
+        url: f.invocation_url || '(not deployed)',
         updated_at: f.updated_at,
     };
 }
@@ -69,16 +72,15 @@ export async function create(flags) {
     info(`Name:            ${result.function.name}`);
     info(`Trigger:         ${result.function.trigger_type}${result.function.cron_schedule ? ` (${result.function.cron_schedule})` : ''}`);
     // The scoped key is returned ONCE — surface it prominently. It's used by
-    // the function runtime shim (Story 2) to call other slot endpoints
-    // without a baked-in auth token.
+    // the function runtime shim to call other slot endpoints without a
+    // baked-in auth token. Deploy rotates this key.
     info('');
     info(`Scoped API key (returned once — save it if you need it):`);
     info(`  ${result.scoped_api_key}`);
     info(`  (id: ${result.scoped_api_key_id}; scopes: slot_call; rejected at /hq/*, /admin/*, /internal/*)`);
-    // Story 2 hasn't landed yet — be explicit about what "create" produces today.
     if (!result.function.invocation_url) {
         info('');
-        banner('Note: bundle upload (Story 2) is not yet shipped — this function has no executable code. The metadata record + scoped key are persisted; the invocation URL will appear once Story 2 lands.');
+        banner(`Next: deploy code with  myapi fn deploy ${result.function.id} <bundle.js>`);
     }
 }
 export async function list(flags) {
@@ -107,7 +109,7 @@ export async function get(id, flags) {
     info(`ID:              ${fn.id}`);
     info(`Name:            ${fn.name}`);
     info(`Trigger:         ${fn.trigger_type}${fn.cron_schedule ? ` (${fn.cron_schedule})` : ''}`);
-    info(`Invocation URL:  ${fn.invocation_url || '(pending Story 2)'}`);
+    info(`Invocation URL:  ${fn.invocation_url || '(not deployed)'}`);
     info(`Created:         ${fn.created_at}`);
     info(`Updated:         ${fn.updated_at}`);
 }
@@ -119,26 +121,113 @@ export async function del(id, flags) {
     await sdkFn.deleteFunction(config.api_key, orgId, id);
     success(`Deleted function ${id}`);
 }
+// deploy uploads a single-file JS bundle. The backend wraps it with the
+// MYAPI shim and ships it to Cloudflare Workers. The scoped API key is
+// rotated on every deploy — the fresh value is shown once here.
+export async function deploy(id, bundlePath, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn deploy <id> <bundle.js> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi fn deploy <id> <bundle.js>');
+    if (!bundlePath)
+        error('Missing bundle file.\nUsage: myapi fn deploy <id> <bundle.js>\n\n→ <bundle.js> is a single-file JavaScript bundle (≤4MB).');
+    let data;
+    try {
+        data = await readFile(bundlePath);
+    }
+    catch (e) {
+        if (e?.code === 'ENOENT')
+            error(`File not found: ${bundlePath}`);
+        if (e?.code === 'EACCES')
+            error(`Permission denied: ${bundlePath}`);
+        error(`Could not read ${bundlePath}: ${e?.message ?? e}`);
+    }
+    const result = await sdkFn.uploadBundle(config.api_key, orgId, id, data, bundlePath.split('/').pop() || 'bundle.js');
+    if (flags.json) {
+        printJson(result);
+        return;
+    }
+    success(`Deployed function ${id}`);
+    info(`Invocation URL:  ${result.invocation_url}`);
+    info('');
+    info(`Scoped API key was rotated. New value (returned once — save it if you need it):`);
+    info(`  ${result.scoped_api_key}`);
+}
+// env sets a Worker Secret (Stripe key, etc.) on a deployed function.
+export async function setEnv(id, name, value, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn env <id> <name> <value> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi fn env <id> <name> <value>');
+    if (!name)
+        error('Missing secret name.\nUsage: myapi fn env <id> <name> <value>');
+    if (value === undefined)
+        error('Missing secret value.\nUsage: myapi fn env <id> <name> <value>');
+    await sdkFn.setFunctionEnv(config.api_key, orgId, id, name, value);
+    success(`Set ${name} on function ${id}`);
+    info('The value is encrypted at rest by Cloudflare and never stored or echoed by MyAPI.');
+}
+// runs lists recent invocation records, most recent first.
+export async function runs(id, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi fn runs <id> [--org <id>]');
+    if (!id)
+        error('Missing id.\nUsage: myapi fn runs <id>');
+    const records = await sdkFn.listFunctionRuns(config.api_key, orgId, id);
+    if (flags.json) {
+        printJson(records);
+        return;
+    }
+    printTable(records.map(r => ({
+        id: r.id,
+        invoked_at: formatDate(r.invoked_at),
+        status: r.status || '?',
+        duration_ms: r.duration_ms ?? '',
+        error: r.error_message || '',
+    })), {
+        flags,
+        empty: 'No runs recorded yet for this function.',
+    });
+}
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     'create': `myapi fn create --name <name> [--cron <expr>] [--org <id>]
 
-Backend Story 1: persists a function record + issues a scoped API key.
-Bundle upload (Story 2) is NOT yet shipped — this command does not deploy
-JavaScript code today. When Story 2 lands, the CLI surface will grow to
-accept --bundle <file.js>.
+Persists a function record + issues a scoped API key. Deploy code separately
+with "myapi fn deploy".
 
 Triggers:
-  (default)         HTTP — function will receive a public invocation URL in Story 2.
-  --cron <expr>     Cron — function will run on the schedule (e.g. "0 8 * * *").
+  (default)         HTTP — function gets a public invocation URL once deployed.
+  --cron <expr>     Cron — function runs on the schedule (e.g. "0 8 * * *").
 
 Examples:
   myapi fn create --name my-app-api
   myapi fn create --name daily-report --cron "0 8 * * *"
 
-The response returns the scoped API key ONCE. Save it if you need to call
-other MyAPI slots from a script with the function's permissions (scopes=slot_call;
-rejected at /hq/*, /admin/*, /internal/*).`,
+The response returns the scoped API key ONCE. It lets the function call
+other MyAPI slots with its own permissions (scopes=slot_call; rejected at
+/hq/*, /admin/*, /internal/*).`,
+    'deploy': `myapi fn deploy <id> <bundle.js> [--org <id>] [--json]
+
+Uploads a single-file JavaScript bundle (≤4MB) to the edge runtime. The
+backend wraps it with the MYAPI shim and ships it to Cloudflare Workers.
+
+The scoped API key is rotated on every deploy — the fresh value is printed
+once. After deploy the function has a live invocation URL.
+
+Example:
+  myapi fn deploy <id> ./dist/bundle.js`,
+    'env': `myapi fn env <id> <name> <value> [--org <id>]
+
+Sets a secret (Stripe key, API token, ...) as a Cloudflare Worker Secret on
+a deployed function. The value is encrypted at rest and never stored in
+MyAPI or echoed back. The function must already be deployed.
+
+Example:
+  myapi fn env <id> STRIPE_KEY sk_live_...`,
+    'runs': `myapi fn runs <id> [--org <id>] [--json]
+
+Lists recent invocation records (most recent first, up to 100).`,
     'list': 'myapi fn list [--org <id>] [--json]',
     'get': 'myapi fn get <id> [--org <id>] [--json]',
     'delete': 'myapi fn delete <id> [--org <id>]',
@@ -147,14 +236,13 @@ export async function run(subcommand, args, flags) {
     if (!subcommand || (flags.help && !subcommand)) {
         info(`Usage: myapi fn <subcommand>
 
-Create and manage functions on the MyAPI edge runtime.
-
-Backend status: Story 1 shipped (metadata + scoped API key). Story 2 (CF
-Workers upload, invocation URL, /logs, /env) lands soon. CLI verbs grow
-once Story 2 ships; today only "create" / "list" / "get" / "delete" work.
+Create, deploy, and manage functions on the MyAPI edge runtime.
 
 Subcommands:
   create               Register a function and get its scoped API key (returned once)
+  deploy <id> <file>   Upload a JS bundle and go live
+  env <id> <k> <v>     Set a Worker Secret on a deployed function
+  runs <id>            List recent invocation records
   list                 List functions in your org
   get <id>             Inspect a function
   delete <id>          Soft-delete and revoke its scoped API key
@@ -172,6 +260,9 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
     }
     switch (subcommand) {
         case 'create': return create(flags);
+        case 'deploy': return deploy(args[0], args[1], flags);
+        case 'env': return setEnv(args[0], args[1], args[2], flags);
+        case 'runs': return runs(args[0], flags);
         case 'list': return list(flags);
         case 'get': return get(args[0], flags);
         case 'delete': return del(args[0], flags);

package/dist/commands/funnel.d.ts

@@ -10,4 +10,5 @@ export declare function del(id: string, flags: Flags): Promise<void>;
 export declare function pages(funnelArg: string, flags: Flags): Promise<void>;
 export declare function push(slug: string, flags: Flags): Promise<void>;
 export declare function verify(slug: string, flags: Flags): Promise<void>;
+export declare function publish(dir: string, flags: Flags): Promise<void>;
 export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;

package/dist/commands/funnel.js

@@ -1,3 +1,5 @@
+import { readdir, readFile, stat } from 'fs/promises';
+import { join, relative, sep } from 'path';
 import { funnel as sdkFunnel, hq } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
 import { success, error, printTable, info, printJson } from '../output.js';
@@ -10,12 +12,15 @@ export const EXPOSES = [
     'DELETE /funnel/orgs/{org_id}/funnels/{funnel_id}',
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/push-page',
     'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/verify',
+    'POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files',
     'GET /funnel/orgs/{org_id}/funnels/{funnel_id}/pages',
     'GET /hq/orgs/{org_id}',
 ];
 export const SCHEMA = {
     funnel: 'string',
     slug: 'string',
+    env: 'string',
+    'api-fn': 'string',
 };
 // Backend (2026-05-15): POST /funnels accepts an optional `name` (defaults
 // to the org's preview_subdomain for back-compat). Mirror the backend's
@@ -193,6 +198,66 @@ export async function verify(slug, flags) {
     const v = await sdkFunnel.verifyFunnel(config.api_key, orgId, funnelId, { slug: finalSlug });
     printJson(v);
 }
+// Recursively collect every file under `dir`, returning site-relative
+// paths (POSIX separators) paired with their contents.
+async function collectFiles(dir, root) {
+    const out = [];
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+        const abs = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            out.push(...await collectFiles(abs, root));
+        }
+        else if (entry.isFile()) {
+            out.push({ path: relative(root, abs).split(sep).join('/'), content: await readFile(abs) });
+        }
+    }
+    return out;
+}
+// publish uploads a whole directory as the funnel's site (my-funnel-api v2).
+// Resolves the funnel the same way push/verify do.
+export async function publish(dir, flags) {
+    const config = requireConfig();
+    const orgId = requireOrg(flags, config, 'myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--org <id>]');
+    if (!dir)
+        error('Missing directory.\nUsage: myapi funnel publish <dir> [--funnel <id>] [--env dev|prod]');
+    let dirStat;
+    try {
+        dirStat = await stat(dir);
+    }
+    catch {
+        error(`Directory not found: ${dir}`);
+    }
+    if (!dirStat.isDirectory())
+        error(`Not a directory: ${dir}. Pass the site's root folder.`);
+    const env = flags.env;
+    if (env && env !== 'dev' && env !== 'prod')
+        error(`Invalid --env "${env}". Use "dev" or "prod" (default prod).`);
+    let funnelId = flags.funnel || config.default_funnel;
+    if (!funnelId) {
+        const existing = await sdkFunnel.listFunnels(config.api_key, orgId);
+        if (existing.length === 0)
+            error('No funnel found for this org. Create one with: myapi funnel create');
+        if (existing.length > 1) {
+            error(`Multiple funnels exist for this org and no default is set.\nPick one with --funnel <id>, or set a default:\n  myapi config set-funnel <id>\n\nFunnels:\n${existing.map(f => `  ${f.id}`).join('\n')}`);
+        }
+        funnelId = existing[0].id;
+    }
+    const files = await collectFiles(dir, dir);
+    if (files.length === 0)
+        error(`No files found under ${dir}.`);
+    const result = await sdkFunnel.publishFiles(config.api_key, orgId, funnelId, files, {
+        env: env,
+        apiFunctionId: flags['api-fn'],
+    });
+    if (flags.json) {
+        printJson(result);
+        return;
+    }
+    success(`Published ${result.file_count} file(s) to the ${result.channel} channel`);
+    info(`Size:   ${(result.size_bytes / 1024).toFixed(1)} KB`);
+    info(`SPA:    ${result.spa_mode ? 'on' : 'off'}`);
+    info(`Live:   ${result.published_url}`);
+}
 // ── Dispatcher ───────────────────────────────────────────────────────────────
 const SUBCOMMAND_USAGE = {
     'list': 'myapi funnel list [--org <id>] [--json]',
@@ -200,6 +265,22 @@ const SUBCOMMAND_USAGE = {
     'get': 'myapi funnel get <id> [--org <id>] [--json]',
     'delete': 'myapi funnel delete <id> [--org <id>]',
     'pages': 'myapi funnel pages [funnel_id] [--funnel <id>] [--org <id>] [--json]',
+    'publish': `myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--api-fn <id>] [--org <id>]
+
+Uploads a whole local directory as the funnel's site. Each file's path
+within <dir> becomes its path on the site (e.g. dir/about/index.html →
+/about/index.html). 25MB total cap.
+
+  --env dev|prod    Target channel (default prod). dev publishes to
+                    <name>-dev.makeautonomous.com for preview.
+  --api-fn <id>     Bind /api/* on the site to a deployed function.
+
+SPA fallback is auto-enabled when the publish has a root index.html.
+
+Examples:
+  myapi funnel publish ./dist
+  myapi funnel publish ./dist --env dev
+  myapi funnel publish ./site --api-fn <function_id>`,
     'push': `myapi funnel push [slug] [--funnel <id>] [--slug <path>] [--org <id>] < page.html
 
 Reads HTML from stdin and publishes to <slug> on your funnel. Funnel is resolved
@@ -235,6 +316,7 @@ Subcommands:
   create     Create a funnel (optional --name; backend defaults to org's preview_subdomain)
   get <id>   Get funnel details
   delete     Delete a funnel
+  publish    Publish a whole local directory as the site (dev or prod)
   push       Push a raw HTML page from stdin to a slug
   pages      List the pages currently published to a funnel
   verify     Verify a published page is reachable
@@ -255,6 +337,7 @@ All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         case 'create': return create(flags);
         case 'get': return get(args[0], flags);
         case 'delete': return del(args[0], flags);
+        case 'publish': return publish(args[0], flags);
         case 'push': return push(args[0], flags);
         case 'verify': return verify(args[0], flags);
         case 'pages': return pages(args[0], flags);

package/dist/commands/keys-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/keys-validation.test.js

@@ -0,0 +1,87 @@
+// Unit tests for the keys-command pure validators: `--grant` parsing and
+// dollar→cents conversion. Both mirror server-side rules so a bad value
+// fails before the network call.
+import { describe, it, expect } from 'vitest';
+import { _parseGrants, _dollarsToCents } from './keys.js';
+import { hq } from '@myapihq/sdk';
+describe('_parseGrants', () => {
+    describe('accepts', () => {
+        it('a bare slot — write is implied', () => {
+            expect(_parseGrants('email')).toEqual({ email: 'write' });
+        });
+        it('an explicit slot:access pair', () => {
+            expect(_parseGrants('crm:read')).toEqual({ crm: 'read' });
+        });
+        it('multiple comma-separated entries, mixed forms', () => {
+            expect(_parseGrants('email:write,crm:read,database')).toEqual({
+                email: 'write', crm: 'read', database: 'write',
+            });
+        });
+        it('the "*" wildcard slot', () => {
+            expect(_parseGrants('*:read')).toEqual({ '*': 'read' });
+            expect(_parseGrants('*')).toEqual({ '*': 'write' });
+        });
+        it('every grantable slot from the SDK vocabulary', () => {
+            for (const slot of hq.GRANTABLE_SLOTS) {
+                expect(_parseGrants(slot)).toEqual({ [slot]: 'write' });
+            }
+        });
+        it('tolerates surrounding whitespace', () => {
+            expect(_parseGrants(' email : write , crm '.replace(/ /g, ''))).toEqual({
+                email: 'write', crm: 'write',
+            });
+            expect(_parseGrants('email, crm')).toEqual({ email: 'write', crm: 'write' });
+        });
+    });
+    describe('rejects (returns an error string)', () => {
+        it('an unknown slot', () => {
+            const r = _parseGrants('rabbitmq:write');
+            expect(typeof r).toBe('string');
+            expect(r).toMatch(/Unknown slot "rabbitmq"/);
+        });
+        it('a management slot — hq is not grantable', () => {
+            expect(typeof _parseGrants('hq:write')).toBe('string');
+            expect(_parseGrants('hq:write')).toMatch(/Unknown slot "hq"/);
+        });
+        it('an invalid access level', () => {
+            const r = _parseGrants('email:admin');
+            expect(typeof r).toBe('string');
+            expect(r).toMatch(/Invalid access "admin"/);
+        });
+        it('an empty string', () => {
+            expect(typeof _parseGrants('')).toBe('string');
+            expect(_parseGrants('')).toMatch(/--grant was empty/);
+        });
+        it('a string of only commas/whitespace', () => {
+            expect(typeof _parseGrants(' , , ')).toBe('string');
+        });
+        it('reports the FIRST bad entry when several are present', () => {
+            // crm is valid, bogus is not — error names bogus.
+            expect(_parseGrants('crm:read,bogus:write')).toMatch(/Unknown slot "bogus"/);
+        });
+    });
+});
+describe('_dollarsToCents', () => {
+    describe('accepts', () => {
+        it.each([
+            ['50', 5000],
+            ['9.99', 999],
+            ['0', 0],
+            ['0.5', 50],
+            ['100', 10000],
+            ['0.01', 1],
+        ])('%s → %d cents', (input, cents) => {
+            expect(_dollarsToCents(input)).toBe(cents);
+        });
+        it('rounds sub-cent input', () => {
+            expect(_dollarsToCents('9.999')).toBe(1000); // 999.9 → 1000
+        });
+    });
+    describe('rejects (returns an error string)', () => {
+        it.each(['-5', 'abc', '', 'free', '$50', '10usd'])('rejects %s', (input) => {
+            const r = _dollarsToCents(input);
+            expect(typeof r).toBe('string');
+            expect(r).toMatch(/not a valid dollar amount/);
+        });
+    });
+});

package/dist/commands/keys.d.ts

@@ -1,10 +1,14 @@
+import { hq } from '@myapihq/sdk';
 import type { FlagSchema } from '../flags.js';
 import type { Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const SCHEMA: FlagSchema;
 export declare const EXPOSES: Exposes;
-export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;
-export declare function runApiKeys(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;
+export declare function _parseGrants(raw: string): hq.Grants | string;
+export declare function _dollarsToCents(raw: string): number | string;
 export declare function createNew(flags: Flags): Promise<void>;
 export declare function list(flags: Flags): Promise<void>;
 export declare function revoke(id: string, _flags: Flags): Promise<void>;
+export declare function revokeAll(flags: Flags): Promise<void>;
+export declare function run(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;
+export declare function runApiKeys(subcommand: string | undefined, args: string[], flags: Flags): Promise<void>;