@myapihq/cli 2.26.0 → 2.27.0

package/dist/commands/funnel-pages-content.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/funnel-pages-content.test.js

@@ -0,0 +1,75 @@
+// `funnel push` overwrites whatever is live at the target, and nothing could
+// tell you what that was.
+//
+// `funnel pages` listed paths only. The API has supported ?include_content=true
+// all along; no client ever sent it. So an agent asked to change one section of
+// a published page had two options: regenerate the whole page from scratch, or
+// scrape the public URL and hope. Every funnel edit was a blind write.
+//
+// Found by asking the reverse-coverage question of QUERY parameters rather than
+// request bodies — the direction the request-field linter documents as out of
+// scope, and the same blind spot that hid `?confirm=` on org delete.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const ORG = '11111111-1111-4111-8111-111111111111';
+const FUNNEL = 'f1';
+const sdk = vi.hoisted(() => ({
+    funnel: { listFunnelPages: vi.fn() },
+    hq: { listOrgs: vi.fn() },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: ORG, default_funnel: FUNNEL }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: ORG, default_funnel: FUNNEL }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+let printed;
+beforeEach(async () => {
+    printed = [];
+    vi.clearAllMocks();
+    const output = await import('../output.js');
+    const cap = ((m) => { printed.push(typeof m === 'string' ? m : JSON.stringify(m)); });
+    vi.spyOn(output, 'info').mockImplementation(cap);
+    vi.spyOn(output, 'printJson').mockImplementation(cap);
+    vi.spyOn(output, 'printTable').mockImplementation(cap);
+    vi.spyOn(output, 'banner').mockImplementation(() => { });
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        printed.push(String(m));
+        throw new Error('__EXIT__');
+    }));
+});
+afterEach(() => vi.restoreAllMocks());
+async function run(flags) {
+    const { pages } = await import('./funnel.js');
+    try {
+        await pages(FUNNEL, flags);
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('funnel pages --with-content', () => {
+    it('asks the API for content, so an edit can read before it writes', async () => {
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/', content: '<h1>live</h1>' }]);
+        await run({ 'with-content': true, json: true });
+        expect(sdk.funnel.listFunnelPages).toHaveBeenCalledWith('hq_live_test', ORG, FUNNEL, { includeContent: true });
+    });
+    it('does not ask for it otherwise — listing paths must stay cheap', async () => {
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/' }]);
+        await run({ json: true });
+        expect(sdk.funnel.listFunnelPages).toHaveBeenCalledWith('hq_live_test', ORG, FUNNEL, undefined);
+    });
+    it('puts the content in --json, which is what an agent reads', async () => {
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/', content: '<h1>live</h1>' }]);
+        await run({ 'with-content': true, json: true });
+        expect(printed.join('\n')).toContain('<h1>live</h1>');
+    });
+    it('keeps HTML out of the human view, showing sizes instead', async () => {
+        // Six pages of markup in a terminal buries the thing being looked for.
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/', content: '<h1>live</h1>' }]);
+        await run({ 'with-content': true });
+        const out = printed.join('\n');
+        expect(out).not.toContain('<h1>live</h1>');
+        expect(out).toContain('13');
+    });
+});

package/dist/commands/funnel.js

@@ -28,6 +28,8 @@ export const SCHEMA = {
     slug: 'string',
     env: 'string',
     force: 'boolean',
+    // \`funnel pages --with-content\` — read what is live before overwriting it.
+    'with-content': 'boolean',
     'api-fn': 'string',
     // form
     fields: 'string',
@@ -214,7 +216,11 @@ export async function pages(funnelArg, flags) {
     const funnelId = funnelArg || flags.funnel || config.default_funnel;
     if (!funnelId)
         error('Missing funnel id. Pass it as a positional arg, --funnel <id>, or set: myapi config set-funnel <id>');
-    const list = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId);
+    // --with-content is what makes an edit a read-then-write instead of a blind
+    // overwrite. `funnel push` replaces whatever is live at the target, and until
+    // now nothing could tell you what that was: an agent asked to change one
+    // section had to regenerate the whole page or scrape the public URL.
+    const list = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId, flags['with-content'] ? { includeContent: true } : undefined);
     // An empty inventory is not proof the funnel is empty. Verified 2026-07-28:
     // a funnel answering 200 with real content on both its subdomain and a bound
     // custom domain reported `{"pages":[]}`. Someone auditing what is deployed
@@ -244,10 +250,21 @@ export async function pages(funnelArg, flags) {
         printJson(list);
         return;
     }
-    printTable(list, {
+    // Human output never dumps the content — six pages of HTML in a terminal
+    // buries the thing being looked for. The size is the useful summary; --json
+    // carries the content itself, which is the shape an agent reads anyway.
+    printTable(flags['with-content']
+        ? list.map(p => ({
+            slug: p.slug,
+            bytes: typeof p.content === 'string' ? p.content.length : '—',
+            updated_at: p.updated_at ?? '',
+        }))
+        : list, {
         flags,
         empty: 'No pages published to this funnel yet. Push one with: echo "<h1>Hello</h1>" | myapi funnel push /',
     });
+    if (flags['with-content'])
+        info('  Content is in --json; this view shows sizes so a terminal is not flooded.');
 }
 export async function push(slug, flags) {
     const config = requireConfig();
@@ -660,7 +677,11 @@ future platform features (rate-limit, captcha, field validation) for
 free.`,
     'get': 'myapi funnel get <id> [--org <id>] [--json]',
     'list': 'myapi funnel list [--org <id>] [--json]',
-    'pages': 'myapi funnel pages [funnel_id] [--funnel <id>] [--org <id>] [--json]',
+    'pages': `myapi funnel pages [funnel_id] [--funnel <id>] [--with-content] [--org <id>] [--json]
+
+Lists what is published. --with-content also fetches each page's live content, which
+is how you read a page before overwriting it — \`funnel push\` replaces whatever
+is there. Human output shows sizes; --json carries the content.`,
     'publish': `myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--api-fn <id>] [--force] [--org <id>]
 
 Uploads a whole local directory as the funnel's site. Each file's path

package/dist/commands/org-create-default.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/org-create-default.test.js

@@ -0,0 +1,108 @@
+// `org create --yes` used to re-point the whole machine.
+//
+// --yes meant two things at once: skip the "set as default?" prompt, AND make
+// the new org the default. Since `org create --name X --yes` is the documented
+// non-interactive form, every scripted or agent-driven org creation retargeted
+// the machine's default org — so a throwaway org made by one project became the
+// target of every bare command in every other project on that laptop.
+//
+// That is the cross-project collision customers report, arriving through a door
+// nobody was watching: they were told to stop using `config set-org`, and
+// `org create --yes` kept doing it to them anyway. It moved my own default org
+// twice in one day, once while I was building the fix for the other door.
+//
+// The two meanings are now separate, and the interesting assertions are about
+// what does NOT happen.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const ORG_A = 'aaaaaaaa-1111-4111-8111-aaaaaaaaaaaa';
+const NEW_ORG = 'nnnnnnnn-2222-4222-8222-nnnnnnnnnnnn';
+const sdk = vi.hoisted(() => ({
+    hq: { createOrg: vi.fn() },
+    funnel: { listFunnels: vi.fn() },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+const saved = vi.hoisted(() => []);
+let stored;
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ ...stored }),
+    loadConfig: () => ({ ...stored }),
+    saveConfig: (c) => { saved.push(c); },
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+const confirmMock = vi.hoisted(() => vi.fn());
+vi.mock('../prompt.js', () => ({
+    confirm: confirmMock,
+    isNonInteractive: () => false,
+}));
+let printed;
+beforeEach(async () => {
+    saved.length = 0;
+    printed = [];
+    vi.clearAllMocks();
+    stored = { api_key: 'hq_live_test', account_id: 'acct' };
+    sdk.hq.createOrg.mockResolvedValue({ id: NEW_ORG, name: 'Throwaway' });
+    sdk.funnel.listFunnels.mockResolvedValue([]);
+    const output = await import('../output.js');
+    const cap = ((m) => { printed.push(String(m)); });
+    vi.spyOn(output, 'info').mockImplementation(cap);
+    vi.spyOn(output, 'success').mockImplementation(cap);
+    vi.spyOn(output, 'printJson').mockImplementation(cap);
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        printed.push(String(m));
+        throw new Error('__EXIT__');
+    }));
+});
+afterEach(() => vi.restoreAllMocks());
+async function createOrg(flags) {
+    const { create } = await import('./org.js');
+    try {
+        await create(['Throwaway'], flags);
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('org create and the machine default', () => {
+    it('--yes does NOT re-point an existing default', async () => {
+        stored.default_org = ORG_A;
+        await createOrg({ yes: true });
+        expect(saved).toEqual([]);
+    });
+    it('says the default is unchanged, rather than saying nothing', async () => {
+        // Silence is what let a throwaway org take over a machine without anyone
+        // noticing which command did it.
+        stored.default_org = ORG_A;
+        stored.org_names = { [ORG_A]: 'Real Work' };
+        await createOrg({ yes: true });
+        const out = printed.join('\n');
+        expect(out).toMatch(/default org is unchanged/i);
+        expect(out).toContain('Real Work');
+        expect(out).toContain(`myapi init --org ${NEW_ORG}`);
+    });
+    it('--set-default re-points it, because that was asked for by name', async () => {
+        stored.default_org = ORG_A;
+        await createOrg({ yes: true, 'set-default': true });
+        expect(saved.at(-1)).toMatchObject({ default_org: NEW_ORG });
+    });
+    it('sets the default when there is none, since nothing can be clobbered', async () => {
+        // A user with no default cannot run an org-scoped command at all, so the
+        // first org is pure gain.
+        await createOrg({ yes: true });
+        expect(saved.at(-1)).toMatchObject({ default_org: NEW_ORG });
+        expect(printed.join('\n')).toMatch(/no default org/i);
+    });
+    it('still asks when interactive without --yes, and honours a no', async () => {
+        stored.default_org = ORG_A;
+        confirmMock.mockResolvedValue(false);
+        await createOrg({});
+        expect(confirmMock).toHaveBeenCalled();
+        expect(saved).toEqual([]);
+    });
+    it('honours a yes at the prompt', async () => {
+        stored.default_org = ORG_A;
+        confirmMock.mockResolvedValue(true);
+        await createOrg({});
+        expect(saved.at(-1)).toMatchObject({ default_org: NEW_ORG });
+    });
+});

package/dist/commands/org.js

@@ -21,6 +21,9 @@ export const SCHEMA = {
     description: 'string',
     'business-sector': 'string',
     'logo-url': 'string',
+    // Setting the machine's default org is now something you ask for, not
+    // something --yes does to you on the way past.
+    'set-default': 'boolean',
     org: 'string',
 };
 const SYNC_BRAND_TIMEOUT_MS = 5 * 60 * 1000;
@@ -45,11 +48,23 @@ export async function create(restArgs, flags) {
             info(`Preview domain: https://${org.preview_subdomain}.makeautonomous.com`);
         }
     }
-    // Never re-point the CLI's defaults on a silent fallback: in non-interactive
-    // contexts (CI, agent pipelines) only --yes may switch the default org —
-    // an unanswered prompt must not count as consent.
-    const setDefault = !!flags.yes ||
-        (!isNonInteractive() && await confirm('› Set as default org and funnel? (Y/n) ', true));
+    // `--yes` used to mean two things: skip the prompt, AND make this the default
+    // org. Since `org create --name X --yes` is the documented non-interactive
+    // form, every scripted or agent-driven org creation silently re-pointed the
+    // machine's default — so a throwaway org created by one project became the
+    // target of every bare command in every other project on that machine. That
+    // is the cross-project collision customers report, arriving through a door
+    // nobody was watching. I did it to my own default org twice in one day.
+    //
+    // Now the two are separate:
+    //   - no default yet   → set it. First org, nothing to clobber, and a user
+    //                        with no default cannot run an org-scoped command.
+    //   - --set-default    → set it, because it was asked for by name.
+    //   - interactive      → ask, as before. A prompt is consent.
+    //   - --yes with an existing default → leave it alone and say so.
+    const hasDefault = !!config.default_org;
+    const setDefault = !!flags['set-default'] || !hasDefault ||
+        (!flags.yes && !isNonInteractive() && await confirm('› Set as default org and funnel? (Y/n) ', true));
     let funnelId;
     if (setDefault) {
         config.default_org = org.id;
@@ -59,8 +74,18 @@ export async function create(restArgs, flags) {
             funnelId = funnels[0].id;
         }
         saveConfig(config);
-        if (!flags.json)
+        if (!flags.json) {
             success(`Default org${funnelId ? ' and funnel' : ''} updated.`);
+            if (!hasDefault)
+                info('  (you had no default org — set because an org-scoped command needs one)');
+        }
+    }
+    else if (!flags.json && hasDefault) {
+        // Say what did NOT happen. Silence here is what let a throwaway org take
+        // over a machine without anyone noticing which command did it.
+        const name = config.org_names?.[config.default_org] ?? config.default_org;
+        info(`  Your default org is unchanged (${name}).`);
+        info(`  Work in the new one with: myapi init --org ${org.id}   (binds this directory only)`);
     }
     if (flags.json) {
         const result = { id: org.id, name: org.name };
@@ -232,16 +257,25 @@ Examples:
   myapi org update --tagline "Now with even more cowbell"
   myapi org update abc-123 --name "Acme Inc" --description "Updated tagline"
   myapi org update --logo-url https://example.com/logo.png --json`,
-    'create': `myapi org create <name> [--tagline <str>] [--description <str>] [--business-sector <str>] [--logo-url <url>] [--yes] [--json]
+    'create': `myapi org create <name> [--tagline <str>] [--description <str>] [--business-sector <str>] [--logo-url <url>] [--yes] [--set-default] [--json]
        myapi org create --name <name> [...]
 
 Creates a new organization. A funnel (website) is automatically created alongside it.
-Pass --yes to skip the "set as default?" prompt (useful in CI / agent workflows).
+
+--yes skips the "set as default?" prompt and leaves your default org ALONE.
+--set-default points your machine's default at the new org.
+
+They are separate because they used to be the same flag: every scripted
+\`org create --yes\` re-pointed the whole machine, so a throwaway org created by
+one project became the target of bare commands in every other project.
+
+To work in the new org without touching anything else, bind the directory:
+  myapi init --org <new-org-id>
 
 Examples:
   myapi org create "Acme Inc"
-  myapi org create "Acme Inc" --yes
-  myapi org create --name "Acme Inc" --yes`,
+  myapi org create "Acme Inc" --yes                 # default org untouched
+  myapi org create "Acme Inc" --yes --set-default`,
     'get': 'myapi org get <id> [--json]',
     'delete': `myapi org delete <id> [--yes]
 

package/dist/index.js

@@ -518,7 +518,7 @@ Commands:
   install-skills  Install or update the MyAPI skills pack for AI agents
   llm             Run LLM completions and embeddings (chat + embed, with usage/cost)
   login           Sign in via your browser — Google or email code (preview: --mock)
-  org             Manage organizations (tip: myapi org create "name" --yes to auto-set as default)
+  org             Manage organizations (create, list, delete; --set-default to re-point the machine)
   payments        Take payments with Stripe Checkout (connect, charge, refund)
   people          Search the contact database (filter by industry, seniority, country, ...)
   pixel           Read pixel analytics: visits, events, identity resolution

package/dist/regression-register.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/regression-register.test.js

@@ -0,0 +1,71 @@
+// Every customer incident names the guard that fails if it comes back — and
+// this checks the guard is really there.
+//
+// A register that nobody verifies is worse than none: it reads as "we checked,
+// we know" while the test it names has been renamed, skipped or deleted. That
+// exact rot has already happened three times in this repo's linters, in the
+// form of waivers claiming gaps that were closed.
+//
+// So the register is only as good as this file. It asserts, for every entry:
+// the guard file exists, it still contains the named assertion, and that
+// assertion is not skipped. Entries with no guard must say why, so a gap is
+// counted rather than quietly absent.
+//
+// What it deliberately does NOT claim: that we have thought of everything. It
+// covers incidents customers have already hit. The unknown ones are the
+// probe's job (scripts/probe/probe.mjs) — this is memory, that is discovery.
+import { describe, it, expect } from 'vitest';
+import { readFileSync, existsSync } from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const REPO_ROOT = fileURLToPath(new URL('../../../', import.meta.url));
+const REGISTER = path.join(REPO_ROOT, 'regressions.json');
+const register = JSON.parse(readFileSync(REGISTER, 'utf-8'));
+describe('the regression register', () => {
+    it('has entries (or it is a file that proves nothing)', () => {
+        expect(register.incidents.length).toBeGreaterThanOrEqual(9);
+    });
+    it.each(register.incidents.map(i => [i.id, i]))('%s — its guard exists and still asserts it', (_id, incident) => {
+        const guardPath = path.join(REPO_ROOT, incident.guard.file);
+        expect(existsSync(guardPath), `${incident.guard.file} is named as the guard for ` +
+            `"${incident.id}" and does not exist. Either restore it, or move the incident to ` +
+            '"unguarded" with the reason — silently dropping the guard is how a fixed bug ' +
+            'comes back.').toBe(true);
+        const source = readFileSync(guardPath, 'utf-8');
+        expect(source.includes(incident.guard.test), `${incident.guard.file} no longer contains "${incident.guard.test}".\n` +
+            `That assertion is the only thing standing between this customer and:\n  ` +
+            `${incident.symptom}\n` +
+            'Renaming it is fine — update regressions.json to match.').toBe(true);
+    });
+    it.each(register.incidents.map(i => [i.id, i]))('%s — its guard is not skipped', (_id, incident) => {
+        const source = readFileSync(path.join(REPO_ROOT, incident.guard.file), 'utf-8');
+        // A skipped guard is the worst shape: present, green, and asserting
+        // nothing. Cheaper to catch here than to discover from a repeat report.
+        const skipped = new RegExp(`(it|test|describe)\\.(skip|todo)\\(\\s*['\`"]${escapeRe(incident.guard.test)}`).test(source) || /describe\.skip\(/.test(source);
+        expect(skipped, `the guard for "${incident.id}" is skipped`).toBe(false);
+    });
+    it('every incident says who it cost and what it cost them', () => {
+        // The register is read when someone is deciding whether a behaviour is safe
+        // to change. Without the cost it reads as a list of trivia, and gets
+        // treated like one.
+        const thin = register.incidents.filter(i => !i.symptom?.trim() || !i.cost?.trim() || !i.customer?.trim());
+        expect(thin.map(i => i.id)).toEqual([]);
+    });
+    it('every unguarded gap explains itself, so none is silent', () => {
+        const unexplained = (register.unguarded ?? []).filter(u => !u.why_no_guard_here?.trim());
+        expect(unexplained.map(u => u.id)).toEqual([]);
+    });
+    it('reports how much is NOT guarded here, rather than only what is', () => {
+        // Printed on every run. A register that only ever shows its green half
+        // teaches the reader it is complete, which is the one thing it is not.
+        const gaps = register.unguarded ?? [];
+        // eslint-disable-next-line no-console
+        console.log(`  regression register: ${register.incidents.length} incident(s) guarded here, ` +
+            `${gaps.length} not (${gaps.filter(g => g.cross_repo).length} guarded in myapi-hq, ` +
+            `${gaps.filter(g => !g.cross_repo).length} not guarded anywhere).`);
+        expect(Array.isArray(gaps)).toBe(true);
+    });
+});
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

package/dist/skills/my-api-hq/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-api-hq
-version: 1.3.1
+version: 1.3.2
 description: >
   Auth, organizations, and billing hub. Start here to get an api_key and org_id — every other service depends on both.
 triggers: [api key, account, organization, org, billing, balance, topup, credits, setup, defaults, brand, sync brand, doctor, health check, is my org healthy]
-checksum: sha256-f8e308fd3cd4b0ed4097e6f54c620e49cfe59c5b4275cfea4c1a0e18dd78f5e4
+checksum: sha256-d09b77d74b93ca44d7b913fce6b684a6dda21d0dff9efe2686143abffeb217ee
 ---
 
 # MyApiHQ
@@ -26,7 +26,7 @@ An anonymous account upgrades any time with `myapi account link <email>`; the cr
 
 ### Health check
 
-`myapi doctor` runs an org-wide consistency check across every slot, plus customer-perspective DNS/HTTP probes from your machine. It returns per-section findings (`✓` pass / `⚠` warning / `✗` critical) with remediation hints; add `--json` for machine output. The exit code is non-zero **only** on customer-actionable criticals — platform-side issues the MyAPI team is already handling are surfaced with an `ℹ` marker but don't fail the run. Run it to self-check before building (is the org set up?) and after (did everything wire up?).
+`myapi doctor` runs an org-wide consistency check across every slot, plus customer-perspective DNS/HTTP probes from your machine. Per-section findings (`✓` / `⚠` / `✗`) with remediation hints; `--json` for machine output. Exit is non-zero **only** on customer-actionable criticals — platform-side issues show as `ℹ` and do not fail the run, so it works as a CI gate.
 <!-- llm:end -->
 
 ## Commands
@@ -57,6 +57,7 @@ An anonymous account upgrades any time with `myapi account link <email>`; the cr
 | `myapi account mailing-address ["<address>"]` | Get or set the account's CAN-SPAM mailing address (required for email send) |
 | `myapi init --org <id>` | Bind this directory to one org: locked key + `.myapi.json` (`--force` re-binds). Use instead of `config set-org` when a machine has more than one project |
 | `myapi config set-org <id>` / `set-funnel <id>` / `set-domain <name>` | Set machine-wide CLI defaults (single-project machines only) |
+| `myapi org create <name> --yes` | Create an org; your default org is untouched (`--set-default` re-points it) |
 | `myapi install-skills` | Install agent skills into ~/.claude/, ~/.gemini/, ~/.cursor/ |
 | `myapi doctor [--verbose] [--json]` | Org-wide health check: config/integrity findings + DNS/HTTP probes |
 <!-- generated:end -->

package/dist/skills/my-funnel-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-funnel-api
-version: 1.0.0
+version: 1.0.1
 description: >
   Create and publish websites (funnels) to the edge. Push raw HTML to any slug and it goes live instantly on your org's domain or preview subdomain.
 triggers: [funnel, landing page, website, page, publish, push, slug, html, edge, preview subdomain, makeautonomous]
-checksum: sha256-24c12e48a6153087641369319ac67e79c1fa36b950b140621d1e118128755b53
+checksum: sha256-7bcaeef9bd17839aa28c62a8e39f67e29a39967397f9e0ee717e19765983e499
 ---
 
 # MyFunnelAPI
@@ -19,7 +19,7 @@ Funnels are the publishing surface. You create a funnel under an org (one comman
 
 By default, your funnel lives on a free preview subdomain (`*.makeautonomous.com`) you get with every org. To serve on a custom domain, register and assign one via **mydomainapi** first.
 
-Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and exposes two public proxy endpoints your HTML can call without an API key: a **form submit** at `POST /funnel/funnels/{id}/submit/{slug}` (delivers through that webhook — CRM upsert + bound workflows fire automatically), and an **analytics/event ingest** for pageviews and click tracking. Bind individual slugs to other destinations with `myapi funnel form ... --capture-to webhook:<id>`.
+Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`) and exposes two public endpoints your HTML can call without an API key: **form submit** at `POST /funnel/funnels/{id}/submit/{slug}`, which delivers through that webhook (CRM upsert + bound workflows fire automatically), and **event ingest** for pageviews and click tracking. Send a slug elsewhere with `myapi funnel form ... --capture-to webhook:<id>`.
 <!-- llm:end -->
 
 ## Commands
@@ -32,7 +32,7 @@ Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and e
 | `myapi funnel delete <id>` | Delete the funnel and purge its edge pages |
 | `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`). **Overwrites** an existing page — refused without `--force`. `--json` prints `{slug, subdomain_url, overwritten, org_id, funnel_id}` |
 | `myapi funnel publish <dir>` | Upload a whole directory as the funnel's site (`--env dev\|prod`, default prod; `--api-fn <id>`; `--json`). Prod refuses to replace a live site without `--force` |
-| `myapi funnel pages [funnel_id]` | List the pages currently published to a funnel |
+| `myapi funnel pages [funnel_id]` | Pages published to a funnel; `--with-content` fetches what is on them |
 | `myapi funnel form [funnel_id]` | Emit canonical form HTML (`--capture-to`, `--cta`, `--success`, `--honeypot`) |
 | `myapi funnel verify [slug]` | Verify a published page is reachable + check links/webhooks |
 <!-- generated:end -->
@@ -42,7 +42,7 @@ Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and e
 A write targets a `(org, funnel, slug)` address. Get all three right *before* pushing — the CLI will help, but the thinking is yours:
 
 1. **Confirm the org.** `--org` (or `default_org`) decides whose namespace you touch. For a demo or a new project, pass `--org <id>` explicitly every time — don't trust the ambient default. `myapi org list` shows the orgs you can reach.
-2. **Look before you write.** `myapi funnel list --org <id>` shows the org's funnels; `myapi funnel pages --funnel <id>` shows what's already published. If a slug is taken by something real, you're about to replace it.
+2. **Look before you write.** `myapi funnel list --org <id>` shows the org's funnels; `myapi funnel pages --funnel <id>` shows what is published, and `--with-content` what is on each page (`--json` carries it). `push` replaces a whole page, so edit by reading it first.
 3. **A new demo = a new funnel.** Don't reuse an org's existing funnel for an unrelated demo. `myapi funnel create --name <demo> --org <id>` gives you a clean namespace and its own preview subdomain.
 4. **Pin the funnel.** When an org has exactly one funnel, `push`/`publish` auto-pick it — convenient, but it's how a demo lands on the wrong site. Pass `--funnel <id>` (or set a default) so the target is explicit, not inferred.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.26.0",
+  "version": "2.27.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.26.0"
+    "@myapihq/sdk": "^2.27.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",