@myapihq/cli 2.26.1 → 2.27.0

package/dist/commands/funnel-pages-content.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/funnel-pages-content.test.js

@@ -0,0 +1,75 @@
+// `funnel push` overwrites whatever is live at the target, and nothing could
+// tell you what that was.
+//
+// `funnel pages` listed paths only. The API has supported ?include_content=true
+// all along; no client ever sent it. So an agent asked to change one section of
+// a published page had two options: regenerate the whole page from scratch, or
+// scrape the public URL and hope. Every funnel edit was a blind write.
+//
+// Found by asking the reverse-coverage question of QUERY parameters rather than
+// request bodies — the direction the request-field linter documents as out of
+// scope, and the same blind spot that hid `?confirm=` on org delete.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const ORG = '11111111-1111-4111-8111-111111111111';
+const FUNNEL = 'f1';
+const sdk = vi.hoisted(() => ({
+    funnel: { listFunnelPages: vi.fn() },
+    hq: { listOrgs: vi.fn() },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ api_key: 'hq_live_test', default_org: ORG, default_funnel: FUNNEL }),
+    loadConfig: () => ({ api_key: 'hq_live_test', default_org: ORG, default_funnel: FUNNEL }),
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+let printed;
+beforeEach(async () => {
+    printed = [];
+    vi.clearAllMocks();
+    const output = await import('../output.js');
+    const cap = ((m) => { printed.push(typeof m === 'string' ? m : JSON.stringify(m)); });
+    vi.spyOn(output, 'info').mockImplementation(cap);
+    vi.spyOn(output, 'printJson').mockImplementation(cap);
+    vi.spyOn(output, 'printTable').mockImplementation(cap);
+    vi.spyOn(output, 'banner').mockImplementation(() => { });
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        printed.push(String(m));
+        throw new Error('__EXIT__');
+    }));
+});
+afterEach(() => vi.restoreAllMocks());
+async function run(flags) {
+    const { pages } = await import('./funnel.js');
+    try {
+        await pages(FUNNEL, flags);
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('funnel pages --with-content', () => {
+    it('asks the API for content, so an edit can read before it writes', async () => {
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/', content: '<h1>live</h1>' }]);
+        await run({ 'with-content': true, json: true });
+        expect(sdk.funnel.listFunnelPages).toHaveBeenCalledWith('hq_live_test', ORG, FUNNEL, { includeContent: true });
+    });
+    it('does not ask for it otherwise — listing paths must stay cheap', async () => {
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/' }]);
+        await run({ json: true });
+        expect(sdk.funnel.listFunnelPages).toHaveBeenCalledWith('hq_live_test', ORG, FUNNEL, undefined);
+    });
+    it('puts the content in --json, which is what an agent reads', async () => {
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/', content: '<h1>live</h1>' }]);
+        await run({ 'with-content': true, json: true });
+        expect(printed.join('\n')).toContain('<h1>live</h1>');
+    });
+    it('keeps HTML out of the human view, showing sizes instead', async () => {
+        // Six pages of markup in a terminal buries the thing being looked for.
+        sdk.funnel.listFunnelPages.mockResolvedValue([{ slug: '/', content: '<h1>live</h1>' }]);
+        await run({ 'with-content': true });
+        const out = printed.join('\n');
+        expect(out).not.toContain('<h1>live</h1>');
+        expect(out).toContain('13');
+    });
+});

package/dist/commands/funnel.js

@@ -28,6 +28,8 @@ export const SCHEMA = {
     slug: 'string',
     env: 'string',
     force: 'boolean',
+    // \`funnel pages --with-content\` — read what is live before overwriting it.
+    'with-content': 'boolean',
     'api-fn': 'string',
     // form
     fields: 'string',
@@ -214,7 +216,11 @@ export async function pages(funnelArg, flags) {
     const funnelId = funnelArg || flags.funnel || config.default_funnel;
     if (!funnelId)
         error('Missing funnel id. Pass it as a positional arg, --funnel <id>, or set: myapi config set-funnel <id>');
-    const list = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId);
+    // --with-content is what makes an edit a read-then-write instead of a blind
+    // overwrite. `funnel push` replaces whatever is live at the target, and until
+    // now nothing could tell you what that was: an agent asked to change one
+    // section had to regenerate the whole page or scrape the public URL.
+    const list = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId, flags['with-content'] ? { includeContent: true } : undefined);
     // An empty inventory is not proof the funnel is empty. Verified 2026-07-28:
     // a funnel answering 200 with real content on both its subdomain and a bound
     // custom domain reported `{"pages":[]}`. Someone auditing what is deployed
@@ -244,10 +250,21 @@ export async function pages(funnelArg, flags) {
         printJson(list);
         return;
     }
-    printTable(list, {
+    // Human output never dumps the content — six pages of HTML in a terminal
+    // buries the thing being looked for. The size is the useful summary; --json
+    // carries the content itself, which is the shape an agent reads anyway.
+    printTable(flags['with-content']
+        ? list.map(p => ({
+            slug: p.slug,
+            bytes: typeof p.content === 'string' ? p.content.length : '—',
+            updated_at: p.updated_at ?? '',
+        }))
+        : list, {
         flags,
         empty: 'No pages published to this funnel yet. Push one with: echo "<h1>Hello</h1>" | myapi funnel push /',
     });
+    if (flags['with-content'])
+        info('  Content is in --json; this view shows sizes so a terminal is not flooded.');
 }
 export async function push(slug, flags) {
     const config = requireConfig();
@@ -660,7 +677,11 @@ future platform features (rate-limit, captcha, field validation) for
 free.`,
     'get': 'myapi funnel get <id> [--org <id>] [--json]',
     'list': 'myapi funnel list [--org <id>] [--json]',
-    'pages': 'myapi funnel pages [funnel_id] [--funnel <id>] [--org <id>] [--json]',
+    'pages': `myapi funnel pages [funnel_id] [--funnel <id>] [--with-content] [--org <id>] [--json]
+
+Lists what is published. --with-content also fetches each page's live content, which
+is how you read a page before overwriting it — \`funnel push\` replaces whatever
+is there. Human output shows sizes; --json carries the content.`,
     'publish': `myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--api-fn <id>] [--force] [--org <id>]
 
 Uploads a whole local directory as the funnel's site. Each file's path

package/dist/skills/my-funnel-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-funnel-api
-version: 1.0.0
+version: 1.0.1
 description: >
   Create and publish websites (funnels) to the edge. Push raw HTML to any slug and it goes live instantly on your org's domain or preview subdomain.
 triggers: [funnel, landing page, website, page, publish, push, slug, html, edge, preview subdomain, makeautonomous]
-checksum: sha256-24c12e48a6153087641369319ac67e79c1fa36b950b140621d1e118128755b53
+checksum: sha256-7bcaeef9bd17839aa28c62a8e39f67e29a39967397f9e0ee717e19765983e499
 ---
 
 # MyFunnelAPI
@@ -19,7 +19,7 @@ Funnels are the publishing surface. You create a funnel under an org (one comman
 
 By default, your funnel lives on a free preview subdomain (`*.makeautonomous.com`) you get with every org. To serve on a custom domain, register and assign one via **mydomainapi** first.
 
-Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and exposes two public proxy endpoints your HTML can call without an API key: a **form submit** at `POST /funnel/funnels/{id}/submit/{slug}` (delivers through that webhook — CRM upsert + bound workflows fire automatically), and an **analytics/event ingest** for pageviews and click tracking. Bind individual slugs to other destinations with `myapi funnel form ... --capture-to webhook:<id>`.
+Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`) and exposes two public endpoints your HTML can call without an API key: **form submit** at `POST /funnel/funnels/{id}/submit/{slug}`, which delivers through that webhook (CRM upsert + bound workflows fire automatically), and **event ingest** for pageviews and click tracking. Send a slug elsewhere with `myapi funnel form ... --capture-to webhook:<id>`.
 <!-- llm:end -->
 
 ## Commands
@@ -32,7 +32,7 @@ Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and e
 | `myapi funnel delete <id>` | Delete the funnel and purge its edge pages |
 | `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`). **Overwrites** an existing page — refused without `--force`. `--json` prints `{slug, subdomain_url, overwritten, org_id, funnel_id}` |
 | `myapi funnel publish <dir>` | Upload a whole directory as the funnel's site (`--env dev\|prod`, default prod; `--api-fn <id>`; `--json`). Prod refuses to replace a live site without `--force` |
-| `myapi funnel pages [funnel_id]` | List the pages currently published to a funnel |
+| `myapi funnel pages [funnel_id]` | Pages published to a funnel; `--with-content` fetches what is on them |
 | `myapi funnel form [funnel_id]` | Emit canonical form HTML (`--capture-to`, `--cta`, `--success`, `--honeypot`) |
 | `myapi funnel verify [slug]` | Verify a published page is reachable + check links/webhooks |
 <!-- generated:end -->
@@ -42,7 +42,7 @@ Every funnel auto-provisions a **webhook** at creation (`org_webhook_id`), and e
 A write targets a `(org, funnel, slug)` address. Get all three right *before* pushing — the CLI will help, but the thinking is yours:
 
 1. **Confirm the org.** `--org` (or `default_org`) decides whose namespace you touch. For a demo or a new project, pass `--org <id>` explicitly every time — don't trust the ambient default. `myapi org list` shows the orgs you can reach.
-2. **Look before you write.** `myapi funnel list --org <id>` shows the org's funnels; `myapi funnel pages --funnel <id>` shows what's already published. If a slug is taken by something real, you're about to replace it.
+2. **Look before you write.** `myapi funnel list --org <id>` shows the org's funnels; `myapi funnel pages --funnel <id>` shows what is published, and `--with-content` what is on each page (`--json` carries it). `push` replaces a whole page, so edit by reading it first.
 3. **A new demo = a new funnel.** Don't reuse an org's existing funnel for an unrelated demo. `myapi funnel create --name <demo> --org <id>` gives you a clean namespace and its own preview subdomain.
 4. **Pin the funnel.** When an org has exactly one funnel, `push`/`publish` auto-pick it — convenient, but it's how a demo lands on the wrong site. Pass `--funnel <id>` (or set a default) so the target is explicit, not inferred.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.26.1",
+  "version": "2.27.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.26.1"
+    "@myapihq/sdk": "^2.27.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",