@myapihq/cli 1.2.5 → 1.2.6

package/dist/sdk-function.test.js

@@ -33,7 +33,7 @@ describe('fn.createFunction', () => {
     it('POSTs to /function/orgs/{org_id}/functions with the bearer auth + JSON body', async () => {
         fetchMock.mockResolvedValueOnce(ok({
             function: { id: FN_ID, org_id: ORG_ID, name: 'my-app-api', trigger_type: 'http', invocation_url: '', created_at: 't1', updated_at: 't1' },
-            scoped_api_key: 'myapi_live_scoped_xyz',
+            scoped_api_key: 'hq_live_scoped_xyz',
             scoped_api_key_id: 'key_xyz',
         }));
         const result = await fn.createFunction(API_KEY, ORG_ID, { name: 'my-app-api', trigger_type: 'http' });
@@ -45,7 +45,7 @@ describe('fn.createFunction', () => {
         expect(init.headers['Content-Type']).toBe('application/json');
         expect(JSON.parse(init.body)).toEqual({ name: 'my-app-api', trigger_type: 'http' });
         expect(result.function.id).toBe(FN_ID);
-        expect(result.scoped_api_key).toBe('myapi_live_scoped_xyz');
+        expect(result.scoped_api_key).toBe('hq_live_scoped_xyz');
         expect(result.scoped_api_key_id).toBe('key_xyz');
         // Invocation URL is empty in Story 1 — populated by Story 2.
         expect(result.function.invocation_url).toBe('');
@@ -53,7 +53,7 @@ describe('fn.createFunction', () => {
     it('passes cron_schedule through when trigger_type=cron', async () => {
         fetchMock.mockResolvedValueOnce(ok({
             function: { id: FN_ID, org_id: ORG_ID, name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *', invocation_url: '', created_at: 't1', updated_at: 't1' },
-            scoped_api_key: 'myapi_live_scoped_xyz',
+            scoped_api_key: 'hq_live_scoped_xyz',
             scoped_api_key_id: 'key_xyz',
         }));
         await fn.createFunction(API_KEY, ORG_ID, { name: 'daily-report', trigger_type: 'cron', cron_schedule: '0 8 * * *' });
@@ -150,19 +150,86 @@ describe('fn.deleteFunction', () => {
         expect(init.method).toBe('DELETE');
     });
 });
+describe('fn.uploadBundle', () => {
+    it('POSTs multipart to /bundle with the `bundle` field + bearer auth', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            function: { id: FN_ID, org_id: ORG_ID, name: 'my-app-api', trigger_type: 'http', invocation_url: 'https://x.fn.myapihq.com', created_at: 't', updated_at: 't' },
+            invocation_url: 'https://x.fn.myapihq.com',
+            scoped_api_key: 'hq_live_rotated_abc',
+        }));
+        const result = await fn.uploadBundle(API_KEY, ORG_ID, FN_ID, 'export default {}', 'app.js');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}/bundle`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        // multipart — body is FormData, no JSON Content-Type set by the SDK.
+        expect(init.body).toBeInstanceOf(FormData);
+        expect(init.body.has('bundle')).toBe(true);
+        expect(result.invocation_url).toBe('https://x.fn.myapihq.com');
+        expect(result.scoped_api_key).toBe('hq_live_rotated_abc');
+    });
+    it('surfaces BUNDLE_TOO_LARGE (413) as a typed MyApiError', async () => {
+        fetchMock.mockResolvedValueOnce(fail('BUNDLE_TOO_LARGE', 'bundle exceeds 4MB', 413));
+        await expect(fn.uploadBundle(API_KEY, ORG_ID, FN_ID, 'x'))
+            .rejects.toMatchObject({ code: 'BUNDLE_TOO_LARGE', status: 413 });
+    });
+    it('surfaces RUNTIME_UNAVAILABLE (503)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('RUNTIME_UNAVAILABLE', 'cf not configured', 503));
+        await expect(fn.uploadBundle(API_KEY, ORG_ID, FN_ID, 'x'))
+            .rejects.toMatchObject({ code: 'RUNTIME_UNAVAILABLE', status: 503 });
+    });
+});
+describe('fn.setFunctionEnv', () => {
+    it('POSTs {name,value} JSON and resolves on 204', async () => {
+        fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));
+        await fn.setFunctionEnv(API_KEY, ORG_ID, FN_ID, 'STRIPE_KEY', 'sk_live_x');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}/env`);
+        expect(init.method).toBe('POST');
+        expect(JSON.parse(init.body)).toEqual({ name: 'STRIPE_KEY', value: 'sk_live_x' });
+    });
+    it('surfaces NOT_DEPLOYED (409) when the function has no bundle yet', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NOT_DEPLOYED', 'deploy a bundle first', 409));
+        await expect(fn.setFunctionEnv(API_KEY, ORG_ID, FN_ID, 'K', 'v'))
+            .rejects.toMatchObject({ code: 'NOT_DEPLOYED', status: 409 });
+    });
+});
+describe('fn.listFunctionRuns', () => {
+    it('GETs /runs and returns the run records', async () => {
+        fetchMock.mockResolvedValueOnce(ok([
+            { id: 'run_1', function_id: FN_ID, invoked_at: 't', duration_ms: 12, status: 'ok' },
+            { id: 'run_2', function_id: FN_ID, invoked_at: 't', status: 'error', error_message: 'boom' },
+        ]));
+        const runs = await fn.listFunctionRuns(API_KEY, ORG_ID, FN_ID);
+        expect(runs).toHaveLength(2);
+        expect(runs[1].error_message).toBe('boom');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/function/orgs/${ORG_ID}/functions/${FN_ID}/runs`);
+        expect(init.method).toBe('GET');
+    });
+    it('returns an empty array when there are no runs', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        expect(await fn.listFunctionRuns(API_KEY, ORG_ID, FN_ID)).toEqual([]);
+    });
+});
 describe('fn.EXPOSES', () => {
-    it('matches the Story 1 contract — exactly 4 endpoints', () => {
+    it('matches the Story 1 + Story 2/4/5 contract — exactly 7 endpoints', () => {
         expect(fn.EXPOSES).toEqual([
             'POST /function/orgs/{org_id}/functions',
             'GET /function/orgs/{org_id}/functions',
             'GET /function/orgs/{org_id}/functions/{id}',
             'DELETE /function/orgs/{org_id}/functions/{id}',
+            'POST /function/orgs/{org_id}/functions/{id}/bundle',
+            'POST /function/orgs/{org_id}/functions/{id}/env',
+            'GET /function/orgs/{org_id}/functions/{id}/runs',
         ]);
     });
-    it('does NOT yet expose /logs or /env (Story 4/5 pending)', () => {
+    it('exposes deploy/env/runs but not /logs (still pending)', () => {
         const flat = fn.EXPOSES.join(' ');
+        expect(flat).toContain('/bundle');
+        expect(flat).toContain('/env');
+        expect(flat).toContain('/runs');
         expect(flat).not.toContain('/logs');
-        expect(flat).not.toContain('/env');
     });
 });
 // MyApiError is the universal error shape callers can `instanceof`-check or

package/dist/sdk-funnel-publish.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-funnel-publish.test.js

@@ -0,0 +1,89 @@
+// SDK-level unit tests for funnel.publishFiles — the my-funnel-api v2
+// directory publish. Verifies the multipart shape (all parts named `files`,
+// each part's filename = the site path), the form fields, and response
+// parsing against myapi-hq/internal/routes/funnel/files.go.
+//
+// Mocks global fetch — does NOT hit the network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { funnel } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const FUNNEL_ID = '44444444-4444-4444-8444-444444444444';
+let fetchMock;
+function ok(data, status = 201) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status = 422) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('funnel.publishFiles', () => {
+    it('POSTs multipart to /files with one `files` part per file + bearer auth', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            manifest_id: 'm1', channel: 'prod', file_count: 2, size_bytes: 42,
+            spa_mode: true, published_url: 'https://site.makeautonomous.com',
+        }));
+        const res = await funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, [
+            { path: 'index.html', content: '<h1>hi</h1>' },
+            { path: 'assets/app.js', content: 'console.log(1)' },
+        ]);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/funnel/orgs/${ORG_ID}/funnels/${FUNNEL_ID}/files`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        expect(init.body).toBeInstanceOf(FormData);
+        // Both files share the part name `files`.
+        expect(init.body.getAll('files')).toHaveLength(2);
+        expect(res.file_count).toBe(2);
+        expect(res.published_url).toBe('https://site.makeautonomous.com');
+    });
+    it('includes env / spa_mode / api_function_id form fields when given', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            manifest_id: 'm1', channel: 'dev', file_count: 1, size_bytes: 10,
+            spa_mode: false, published_url: 'https://site-dev.makeautonomous.com',
+        }));
+        await funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, [{ path: 'index.html', content: 'x' }], { env: 'dev', spaMode: false, apiFunctionId: 'fn_1' });
+        const body = fetchMock.mock.calls[0][1].body;
+        expect(body.get('env')).toBe('dev');
+        expect(body.get('spa_mode')).toBe('false');
+        expect(body.get('api_function_id')).toBe('fn_1');
+    });
+    it('omits optional form fields when not given', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            manifest_id: 'm1', channel: 'prod', file_count: 1, size_bytes: 10,
+            spa_mode: true, published_url: 'https://site.makeautonomous.com',
+        }));
+        await funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, [{ path: 'index.html', content: 'x' }]);
+        const body = fetchMock.mock.calls[0][1].body;
+        expect(body.has('env')).toBe(false);
+        expect(body.has('spa_mode')).toBe(false);
+        expect(body.has('api_function_id')).toBe(false);
+    });
+    it('surfaces NO_FILES (422) as a typed MyApiError', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NO_FILES', 'files field required', 422));
+        await expect(funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, []))
+            .rejects.toMatchObject({ code: 'NO_FILES', status: 422 });
+    });
+    it('surfaces publish_too_large (413)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('publish_too_large', 'exceeds 25MB', 413));
+        await expect(funnel.publishFiles(API_KEY, ORG_ID, FUNNEL_ID, [{ path: 'big', content: 'x' }]))
+            .rejects.toMatchObject({ code: 'publish_too_large', status: 413 });
+    });
+});
+describe('funnel.EXPOSES includes the v2 publish endpoint', () => {
+    it('lists POST .../files', () => {
+        expect(funnel.EXPOSES).toContain('POST /funnel/orgs/{org_id}/funnels/{funnel_id}/files');
+    });
+});

package/dist/sdk-iam.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-iam.test.js

@@ -0,0 +1,190 @@
+// SDK unit tests for the capability-IAM + spend-cap surface shipped
+// 2026-05-15 (design-iam-capability-keys-2026-05-15.md). Verifies request
+// URL/body shape, response parsing, and error envelopes. Mocks global
+// fetch — no network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { hq, MyApiError } from '@myapihq/sdk';
+const KEY = 'hq_live_caller';
+const ORG = '11111111-1111-4111-8111-111111111111';
+let fetchMock;
+function ok(data, status = 200) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status, headers: { 'content-type': 'application/json' },
+    });
+}
+function bodyOf(call) {
+    return JSON.parse(fetchMock.mock.calls[call][1].body);
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => vi.restoreAllMocks());
+// A representative keyView the backend returns.
+const KEY_VIEW = {
+    id: 'key_1', name: 'ci', prefix: 'hq_live_ab', kind: 'manual',
+    org_id: null, grants: { '*': 'write' },
+    spend_cap_cents: null, spend_cap_period: 'month',
+};
+describe('hq.createApiKey', () => {
+    it('POSTs to /hq/account/create/key with just {name} when no opts given', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ ...KEY_VIEW, api_key: 'hq_live_secret' }));
+        const key = await hq.createApiKey(KEY, 'ci');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain('/hq/account/create/key');
+        expect(init.method).toBe('POST');
+        expect(bodyOf(0)).toEqual({ name: 'ci' });
+        expect(key.api_key).toBe('hq_live_secret');
+        expect(key.kind).toBe('manual');
+    });
+    it('includes grants / org_id / spend_cap_cents when opts are passed', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            ...KEY_VIEW, org_id: ORG, grants: { email: 'write', crm: 'read' },
+            spend_cap_cents: 5000, api_key: 'hq_live_secret',
+        }));
+        await hq.createApiKey(KEY, 'billing-fn', {
+            grants: { email: 'write', crm: 'read' },
+            orgId: ORG,
+            spendCapCents: 5000,
+        });
+        expect(bodyOf(0)).toEqual({
+            name: 'billing-fn',
+            grants: { email: 'write', crm: 'read' },
+            org_id: ORG,
+            spend_cap_cents: 5000,
+        });
+    });
+    it('sends spend_cap_cents: 0 (a real cap of $0) but omits when undefined', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ ...KEY_VIEW, api_key: 'k' }));
+        await hq.createApiKey(KEY, 'zero', { spendCapCents: 0 });
+        expect(bodyOf(0)).toEqual({ name: 'zero', spend_cap_cents: 0 });
+    });
+    it('surfaces INVALID_GRANTS (422)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_GRANTS', 'unknown slot', 422));
+        await expect(hq.createApiKey(KEY, 'x', { grants: { bogus: 'write' } }))
+            .rejects.toMatchObject({ code: 'INVALID_GRANTS', status: 422 });
+    });
+    it('surfaces SCOPE_FORBIDDEN (403) when the request would escalate', async () => {
+        fetchMock.mockResolvedValueOnce(fail('SCOPE_FORBIDDEN', 'requested grants exceed authority', 403));
+        await expect(hq.createApiKey(KEY, 'x', { grants: { '*': 'write' } }))
+            .rejects.toMatchObject({ code: 'SCOPE_FORBIDDEN', status: 403 });
+    });
+});
+describe('hq.listApiKeys', () => {
+    it('GETs /hq/account/keys and returns the ApiKey[] shape', async () => {
+        fetchMock.mockResolvedValueOnce(ok([
+            { ...KEY_VIEW, id: 'k1' },
+            { ...KEY_VIEW, id: 'k2', kind: 'function', org_id: ORG,
+                grants: { email: 'write' }, spend_cap_cents: 2500,
+                current_period_spend_cents: 800 },
+        ]));
+        const keys = await hq.listApiKeys(KEY);
+        expect(fetchMock.mock.calls[0][1].method).toBe('GET');
+        expect(keys).toHaveLength(2);
+        expect(keys[1].kind).toBe('function');
+        expect(keys[1].current_period_spend_cents).toBe(800);
+        expect(keys[1].spend_cap_cents).toBe(2500);
+    });
+    it('returns [] when the account has no keys', async () => {
+        fetchMock.mockResolvedValueOnce(ok([]));
+        expect(await hq.listApiKeys(KEY)).toEqual([]);
+    });
+});
+describe('hq.revokeAllKeys', () => {
+    it('POSTs an empty body for "all kinds"', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ revoked: 7 }));
+        const res = await hq.revokeAllKeys(KEY);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain('/hq/account/keys/revoke-all');
+        expect(init.method).toBe('POST');
+        expect(bodyOf(0)).toEqual({});
+        expect(res.revoked).toBe(7);
+    });
+    it('includes {kind} when narrowing', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ revoked: 3 }));
+        await hq.revokeAllKeys(KEY, 'function');
+        expect(bodyOf(0)).toEqual({ kind: 'function' });
+    });
+    it('surfaces INVALID_KIND (422)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_KIND', 'bad kind', 422));
+        await expect(hq.revokeAllKeys(KEY, 'bogus'))
+            .rejects.toMatchObject({ code: 'INVALID_KIND', status: 422 });
+    });
+});
+describe('hq.setAccountSpendCap', () => {
+    it('PATCHes a cents value', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ spend_cap_cents: 5000, spend_cap_period: 'month' }));
+        const res = await hq.setAccountSpendCap(KEY, 5000);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain('/hq/account/spend-cap');
+        expect(init.method).toBe('PATCH');
+        expect(bodyOf(0)).toEqual({ spend_cap_cents: 5000 });
+        expect(res.spend_cap_period).toBe('month');
+    });
+    it('PATCHes null to clear the cap', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ spend_cap_cents: null, spend_cap_period: 'month' }));
+        await hq.setAccountSpendCap(KEY, null);
+        expect(bodyOf(0)).toEqual({ spend_cap_cents: null });
+    });
+    it('includes period when given', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ spend_cap_cents: 500, spend_cap_period: 'day' }));
+        await hq.setAccountSpendCap(KEY, 500, 'day');
+        expect(bodyOf(0)).toEqual({ spend_cap_cents: 500, period: 'day' });
+    });
+    it('surfaces INVALID_PERIOD (422)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('INVALID_PERIOD', 'bad period', 422));
+        await expect(hq.setAccountSpendCap(KEY, 500, 'week'))
+            .rejects.toMatchObject({ code: 'INVALID_PERIOD', status: 422 });
+    });
+});
+describe('hq.getAccount — spend-cap fields', () => {
+    it('parses spend_cap_cents + current_period_spend_cents', async () => {
+        fetchMock.mockResolvedValueOnce(ok({
+            account_id: 'acc_1', email: 'x@y.com',
+            spend_cap_cents: 5000, current_period_spend_cents: 4200,
+        }));
+        const acct = await hq.getAccount(KEY);
+        expect(acct.spend_cap_cents).toBe(5000);
+        expect(acct.current_period_spend_cents).toBe(4200);
+    });
+    it('tolerates an account with no cap set (fields absent)', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ account_id: 'acc_1', email: 'x@y.com' }));
+        const acct = await hq.getAccount(KEY);
+        expect(acct.spend_cap_cents).toBeUndefined();
+    });
+});
+describe('hq IAM contract surface', () => {
+    it('EXPOSES includes the 2026-05-15 endpoints', () => {
+        expect(hq.EXPOSES).toContain('POST /hq/account/keys/revoke-all');
+        expect(hq.EXPOSES).toContain('PATCH /hq/account/spend-cap');
+    });
+    it('GRANTABLE_SLOTS matches the backend iam.GrantableSlots vocabulary', () => {
+        expect([...hq.GRANTABLE_SLOTS].sort()).toEqual(['audience', 'company', 'crm', 'database', 'domain', 'email', 'function',
+            'funnel', 'image', 'llm', 'people', 'storage', 'url', 'webhook', 'workflow']);
+    });
+    it('GRANTABLE_SLOTS excludes management/non-grantable surfaces', () => {
+        for (const s of ['hq', 'admin', 'internal', 'schema', 'ops', 'pixel']) {
+            expect(hq.GRANTABLE_SLOTS).not.toContain(s);
+        }
+    });
+});
+// MyApiError is the universal error shape — confirm IAM errors carry the body.
+describe('MyApiError on IAM rejections', () => {
+    it('preserves code + status', async () => {
+        fetchMock.mockResolvedValueOnce(fail('SCOPE_FORBIDDEN', 'an org-scoped key can only mint same-org keys', 403));
+        try {
+            await hq.createApiKey(KEY, 'x', { orgId: ORG });
+            expect.fail('should have thrown');
+        }
+        catch (e) {
+            expect(e).toBeInstanceOf(MyApiError);
+            expect(e.code).toBe('SCOPE_FORBIDDEN');
+            expect(e.status).toBe(403);
+        }
+    });
+});

package/dist/sdk-payments.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sdk-payments.test.js

@@ -0,0 +1,139 @@
+// SDK-level unit tests for the payments module. Verifies request URL/body
+// shape, response parsing, and error envelopes against the T0 contract
+// shipped by myapi-hq/internal/routes/payments/.
+//
+// Mocks global fetch — does NOT hit the network.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { payments } from '@myapihq/sdk';
+const API_KEY = 'myapi_test_abc';
+const ORG_ID = '11111111-1111-4111-8111-111111111111';
+const CHARGE_ID = '33333333-3333-4333-8333-333333333333';
+let fetchMock;
+function ok(data, status = 200) {
+    return new Response(JSON.stringify({ success: true, data, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function fail(code, message, status = 422) {
+    return new Response(JSON.stringify({ success: false, error: { code, message }, meta: {} }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+beforeEach(() => {
+    fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('payments.connect', () => {
+    it('POSTs {tier:"t0",stripe_secret_key} to /connect', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ tier: 't0', stripe_account_id: 'acct_1', onboarding_status: 'complete' }, 201));
+        const res = await payments.connect(API_KEY, ORG_ID, 'sk_live_xyz');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/payments/orgs/${ORG_ID}/connect`);
+        expect(init.method).toBe('POST');
+        expect(init.headers.Authorization).toBe(`Bearer ${API_KEY}`);
+        expect(JSON.parse(init.body)).toEqual({ tier: 't0', stripe_secret_key: 'sk_live_xyz' });
+        expect(res.stripe_account_id).toBe('acct_1');
+    });
+    it('passes tier through so a t1 caller can see the deferral', async () => {
+        fetchMock.mockResolvedValueOnce(fail('T1_DEFERRED', 'Connect Express is not yet available', 501));
+        await expect(payments.connect(API_KEY, ORG_ID, 'sk_x', 't1'))
+            .rejects.toMatchObject({ code: 'T1_DEFERRED', status: 501 });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body).tier).toBe('t1');
+    });
+    it('surfaces KEY_REJECTED (422)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('KEY_REJECTED', 'Stripe rejected the key', 422));
+        await expect(payments.connect(API_KEY, ORG_ID, 'sk_bad'))
+            .rejects.toMatchObject({ code: 'KEY_REJECTED', status: 422 });
+    });
+});
+describe('payments.getConnect', () => {
+    it('GETs /connect and returns the status', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ tier: 't0', stripe_account_id: 'acct_1', onboarding_status: 'complete', application_fee_bps: 0 }));
+        const res = await payments.getConnect(API_KEY, ORG_ID);
+        expect(res.application_fee_bps).toBe(0);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/payments/orgs/${ORG_ID}/connect`);
+        expect(init.method).toBe('GET');
+    });
+    it('surfaces NOT_CONNECTED (404)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NOT_CONNECTED', 'no Stripe connection', 404));
+        await expect(payments.getConnect(API_KEY, ORG_ID))
+            .rejects.toMatchObject({ code: 'NOT_CONNECTED', status: 404 });
+    });
+});
+describe('payments.createCharge', () => {
+    it('POSTs the charge payload and returns the checkout URL', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ payment_id: CHARGE_ID, checkout_url: 'https://checkout.stripe.com/x', status: 'pending' }, 201));
+        const res = await payments.createCharge(API_KEY, ORG_ID, { amount_cents: 1900, description: 'Pro plan' });
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/payments/orgs/${ORG_ID}/charges`);
+        expect(init.method).toBe('POST');
+        expect(JSON.parse(init.body)).toEqual({ amount_cents: 1900, description: 'Pro plan' });
+        expect(res.checkout_url).toBe('https://checkout.stripe.com/x');
+        expect(res.payment_id).toBe(CHARGE_ID);
+    });
+    it('passes `every` through for subscriptions', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ payment_id: CHARGE_ID, checkout_url: 'u', status: 'pending' }, 201));
+        await payments.createCharge(API_KEY, ORG_ID, { amount_cents: 999, every: 'month' });
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body).every).toBe('month');
+    });
+    it('surfaces NOT_CONNECTED (409) when Stripe is not linked', async () => {
+        fetchMock.mockResolvedValueOnce(fail('NOT_CONNECTED', 'connect Stripe first', 409));
+        await expect(payments.createCharge(API_KEY, ORG_ID, { amount_cents: 100 }))
+            .rejects.toMatchObject({ code: 'NOT_CONNECTED', status: 409 });
+    });
+});
+describe('payments.listCharges / getCharge', () => {
+    it('GETs the charge list', async () => {
+        fetchMock.mockResolvedValueOnce(ok([
+            { id: CHARGE_ID, amount_cents: 1900, currency: 'usd', status: 'succeeded', created_at: 't' },
+        ]));
+        const list = await payments.listCharges(API_KEY, ORG_ID);
+        expect(list).toHaveLength(1);
+        expect(list[0].amount_cents).toBe(1900);
+    });
+    it('GETs a single charge', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: CHARGE_ID, amount_cents: 1900, currency: 'usd', status: 'succeeded', created_at: 't' }));
+        const c = await payments.getCharge(API_KEY, ORG_ID, CHARGE_ID);
+        expect(c.id).toBe(CHARGE_ID);
+        expect(fetchMock.mock.calls[0][0]).toContain(`/payments/orgs/${ORG_ID}/charges/${CHARGE_ID}`);
+    });
+    it('surfaces charge_not_found (404)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('charge_not_found', 'not found', 404));
+        await expect(payments.getCharge(API_KEY, ORG_ID, CHARGE_ID))
+            .rejects.toMatchObject({ code: 'charge_not_found', status: 404 });
+    });
+});
+describe('payments.refundCharge', () => {
+    it('POSTs to /refund and returns the refunded status', async () => {
+        fetchMock.mockResolvedValueOnce(ok({ id: CHARGE_ID, status: 'refunded' }));
+        const res = await payments.refundCharge(API_KEY, ORG_ID, CHARGE_ID);
+        expect(res.status).toBe('refunded');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toContain(`/payments/orgs/${ORG_ID}/charges/${CHARGE_ID}/refund`);
+        expect(init.method).toBe('POST');
+    });
+    it('surfaces "already refunded" (409)', async () => {
+        fetchMock.mockResolvedValueOnce(fail('charge already refunded', 'charge already refunded', 409));
+        await expect(payments.refundCharge(API_KEY, ORG_ID, CHARGE_ID))
+            .rejects.toMatchObject({ status: 409 });
+    });
+});
+describe('payments.EXPOSES', () => {
+    it('covers connect, charges CRUD, refund, and the webhook', () => {
+        expect(payments.EXPOSES).toEqual([
+            'POST /payments/orgs/{org_id}/connect',
+            'GET /payments/orgs/{org_id}/connect',
+            'POST /payments/orgs/{org_id}/charges',
+            'GET /payments/orgs/{org_id}/charges',
+            'GET /payments/orgs/{org_id}/charges/{id}',
+            'POST /payments/orgs/{org_id}/charges/{id}/refund',
+            'POST /payments/webhook/{org_id}',
+        ]);
+    });
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -18,6 +18,8 @@
     "test": "vitest run src test/scripts",
     "test:smoke": "npm run build && vitest run src test/smoke test/scripts",
     "test:online": "npm run build && MYAPI_RUN_RESET=1 vitest run test/online",
+    "test:realistic": "npm run build && MYAPI_RUN_REALISTIC=1 vitest run test/realistic/autonomous-company.test.ts",
+    "test:realistic:cleanup": "npm run build && vitest run test/realistic/cleanup.test.ts",
     "test:all": "npm run build && MYAPI_RUN_RESET=1 vitest run src test/smoke test/scripts test/online",
     "check-coverage": "npm run build && node scripts/check-coverage.js",
     "check-coverage:live": "npm run build && node scripts/check-coverage.js --live",
@@ -27,7 +29,7 @@
     "lint:changelog": "node ../../scripts/lint-changelog.js"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.2.5",
+    "@myapihq/sdk": "^1.2.6",
     "omelette": "^0.4.17"
   },
   "devDependencies": {